64ad5e61...5383 | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Ransomware, Dropper

1.exe

Windows Exe (x86-32)

Created at 2019-07-03T15:12:00

...

Remarks (2/2)

(0x200000e): The overall sleep time of all monitored processes was truncated from "5 minutes, 30 seconds" to "1 minute, 10 seconds" to reveal dormant functionality.

(0x2000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0xa20 Analysis Target High (Elevated) 1.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1.exe" -
#5 0xb14 Child Process High (Elevated) regasm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" #1
#6 0xb48 Child Process High (Elevated) regasm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" #1
#7 0xb6c Child Process High (Elevated) cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1.exe" #1
#8 0xb84 Child Process High (Elevated) choice.exe choice /C Y /N /D Y /T 3 #7
#9 0xbc8 Child Process High (Elevated) schtasks.exe "schtasks" /delete /tn "" /f #6
#10 0xbec Child Process High (Elevated) cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" /a #6
#11 0x56c Child Process High (Elevated) choice.exe choice /C Y /N /D Y /T 3 #10
#12 0x8c4 Child Process High (Elevated) vbc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" #5
#13 0x410 Child Process High (Elevated) cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" #5
#14 0x4f0 Child Process High (Elevated) choice.exe choice /C Y /N /D Y /T 3 #13
#16 0x540 Autostart Medium vbc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" e -

Behavior Information - Grouped by Category

Process #1: 1.exe
521 0
»
Information Value
ID #1
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:24, Reason: Analysis Target
Unmonitor End Time: 00:01:25, Reason: Self Terminated
Monitor Duration 00:01:00
OS Process Information
»
Information Value
PID 0xa20
Parent PID 0x45c (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A24
0x A28
0x A2C
0x A30
0x A44
0x A48
0x A4C
0x A50
0x ACC
0x AD0
0x AD4
0x AD8
0x ADC
0x B50
0x B60
0x B64
0x B68
0x 908
0x 904
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
system.configuration.ni.dll 0x74820000 0x7490FFFF Content Changed - 32-bit 0x7484A000 False False
...
system.configuration.ni.dll 0x74820000 0x7490FFFF Content Changed - 32-bit 0x74852360 False False
...
system.configuration.ni.dll 0x74820000 0x7490FFFF Content Changed - 32-bit 0x7484C000 False False
...
system.configuration.ni.dll 0x74820000 0x7490FFFF Content Changed - 32-bit 0x7484D000 False False
...
system.configuration.ni.dll 0x74820000 0x7490FFFF Content Changed - 32-bit 0x7484E000 False False
...
system.configuration.ni.dll 0x74820000 0x7490FFFF Content Changed - 32-bit 0x74845518, 0x74844054 False False
...
system.configuration.ni.dll 0x74820000 0x7490FFFF Content Changed - 32-bit 0x7484F040 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73DD9B80 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73DDCAA8 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73DDCAA8 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E904A4 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E97948 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E8189C False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73DDBB70 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73DDBB70 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E8F6EC False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E4FEC8 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E8E87C False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E7F028 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E9472C, 0x73E7EFD4 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E529E4, 0x73E508AC, ... False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73DDD094 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73DDD094 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E51000 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73DDA0C0, 0x73DD9678, ... False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73DDC088, 0x73E5279C, ... False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E7E080, 0x73E8F554, ... False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E83860 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E8A598 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E43C3C False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E44684 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E4729C False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E904A4 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E4C610, 0x73E4A548 False False
...
system.management.ni.dll 0x73DC0000 0x73EDBFFF Content Changed - 32-bit 0x73E4D040 False False
...
buffer 0x00940000 0x00942FFF First Execution - 32-bit 0x00942005, 0x00941E97, ... False True
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1.exe 747.00 KB MD5: 51bae3ef8cda64d0fc68fa101d9f4e08
SHA1: 806af15ca70e3ff46717438011666892c02e8d52
SHA256: 64ad5e61454fee018519a63a1475f8ac9d269ca5466c6d71eb92e30da17d5383
SSDeep: 12288:nTCv7vkIyg16D0fpcZDHbE5lIJ639mu3wL5n+eKW4fmLyo0N/GG:nT2BED0fpMDHbE0QwvKW4+Wo+ 		False
...
Host Behavior
COM (6)
»
Operation Class Interface Additional Information Success Count Logfile
Create WbemDefaultPathParser IClassFactory cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER True 2
Fn
Create WBEMLocator IClassFactory cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER True 1
Fn
Create WBEMLocator IWbemLocator cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Execute WBEMLocator IWbemLocator method_name = ConnectServer, network_resource = \\.\ROOT\cimv2 True 1
Fn
Execute WBEMLocator IWbemServices method_name = ExecQuery, query_language = WQL, query = SELECT * FROM Win32_VideoController True 1
Fn
File (35)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config type = file_attributes True 2
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config type = file_type True 2
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config type = size, size_out = 0 True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1.exe.config type = file_attributes False 2
Fn
Get Info C:\WINDOWS\system32\drivers\VBoxMouse.sys type = file_attributes False 1
Fn
Get Info C:\WINDOWS\system32\drivers\vmmouse.sys type = file_attributes False 1
Fn
Get Info C:\WINDOWS\system32\drivers\vmhgfs.sys type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\java.exe type = file_attributes False 1
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe type = file_attributes True 1
Fn
Open Mapping - desired_access = 12 True 1
Fn
Open Mapping - desired_access = 12 True 1
Fn
Open Mapping - desired_access = 12 True 1
Fn
Open Mapping - desired_access = 12 True 1
Fn
Open Mapping - desired_access = 12 True 1
Fn
Open Mapping - desired_access = 12 True 1
Fn
Open Mapping - desired_access = 12 True 1
Fn
Open Mapping - desired_access = 12 True 1
Fn
Open Mapping - desired_access = 12 True 1
Fn
Open Mapping - desired_access = 12 True 1
Fn
Copy C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\java.exe source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1.exe True 1
Fn
Read C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config size = 4096, size_out = 4096 True 8
Fn
Data
Read C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config size = 4096, size_out = 3215 True 1
Fn
Data
Read C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config size = 4096, size_out = 0 True 1
Fn
Delete C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\\java.exe:Zone.Identifier - False 1
Fn
Registry (40)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 - False 3
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\Description\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\Description\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools - False 2
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0 - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0 - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\Settings - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\Description\System - True 1
Fn
Open Key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\Description\System value_name = SystemBiosVersion, data = 0, type = REG_MULTI_SZ True 7
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\Description\System value_name = SystemBiosVersion, data = 42351148, type = REG_MULTI_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\Description\System value_name = VideoBiosVersion, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum value_name = 0, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum value_name = 0, data = IDE\DiskHD502HI_________________________________OF90____\5&37d1a386&0&0.0.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 value_name = DriverDesc, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 value_name = DriverDesc, data = Standard VGA Graphics Adapter, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\Settings value_name = Device Description, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\Settings value_name = Device Description, data = Standard VGA Graphics Adapter, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\Description\System value_name = SystemBiosVersion, data = 0, type = REG_MULTI_SZ True 7
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\Description\System value_name = SystemBiosVersion, data = 42369148, type = REG_MULTI_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value_name = java, type = REG_NONE False 1
Fn
Write Value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value_name = java, data = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\\java.exe, size = 118, type = REG_SZ True 1
Fn
Process (5)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe os_pid = 0xb14, creation_flags = CREATE_SUSPENDED, CREATE_DETACHED_PROCESS, CREATE_NO_WINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe os_pid = 0xb48, creation_flags = CREATE_SUSPENDED, CREATE_DETACHED_PROCESS, CREATE_NO_WINDOW, show_window = SW_HIDE True 1
Fn
Create cmd.exe show_window = SW_HIDE True 1
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Thread (6)
»
Operation Process Additional Information Success Count Logfile
Get Context c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe os_tid = 0xa4c True 1
Fn
Get Context c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe os_tid = 0xa4c True 1
Fn
Set Context c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe os_tid = 0xa4c True 1
Fn
Set Context c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe os_tid = 0xa4c True 1
Fn
Resume c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe os_tid = 0xa4c True 1
Fn
Resume c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe os_tid = 0xa4c True 1
Fn
Memory (4)
»
Operation Process Additional Information Success Count Logfile
Read C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe address = 2130567176, size = 4 True 1
Fn
Data
Read C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe address = 2130567176, size = 4 True 1
Fn
Data
Write C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe address = 0x7efde008, size = 4 True 1
Fn
Data
Write C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe address = 0x7efde008, size = 4 True 1
Fn
Data
Module (79)
»
Operation Module Additional Information Success Count Logfile
Load C:\Windows\Microsoft.NET\Framework\v4.0.30319\\webengine4.dll base_address = 0x74720000 True 1
Fn
Load C:\Windows\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll base_address = 0x73da0000 True 1
Fn
Load Ole32.dll base_address = 0x755e0000 True 2
Fn
Load advapi32.dll base_address = 0x74d40000 True 16
Fn
Load user32.dll base_address = 0x74f40000 True 10
Fn
Load kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Handle webengine4.dll base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = wine_get_unix_file_name, address_out = 0x0 False 1
Fn
Get Address c:\windows\microsoft.net\framework\v4.0.30319\wminet_utils.dll function = ResetSecurity, address_out = 0x73da24de True 1
Fn
Get Address c:\windows\microsoft.net\framework\v4.0.30319\wminet_utils.dll function = SetSecurity, address_out = 0x73da2520 True 1
Fn
Get Address c:\windows\microsoft.net\framework\v4.0.30319\wminet_utils.dll function = BlessIWbemServices, address_out = 0x73da1c69 True 1
Fn
Get Address c:\windows\microsoft.net\framework\v4.0.30319\wminet_utils.dll function = BlessIWbemServicesObject, address_out = 0x73da1cbb True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptAcquireContextW, address_out = 0x74d4df14 True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptCreateHash, address_out = 0x74d4df4e True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDecrypt, address_out = 0x74d83178 True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDeriveKey, address_out = 0x74d83188 True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDestroyHash, address_out = 0x74d4df66 True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDestroyKey, address_out = 0x74d4c51a True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptHashData, address_out = 0x74d4df36 True 2
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptReleaseContext, address_out = 0x74d4e124 True 2
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxA, address_out = 0x74fafd1e True 2
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitializeEx, address_out = 0x756209ad True 2
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoCreateInstance, address_out = 0x75629d0b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexW, address_out = 0x76c3424c True 2
Fn
Create Mapping - protection = PAGE_EXECUTE_READWRITE, maximum_size = 84470360 True 1
Fn
Create Mapping - protection = PAGE_EXECUTE_READWRITE, maximum_size = 84470360 True 1
Fn
Map - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe, protection = PAGE_READONLY, address_out = 0x52b0000 False 1
Fn
Map - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe, protection = PAGE_READONLY, address_out = 0x5350000 False 1
Fn
Map - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe, protection = PAGE_READONLY, address_out = 0x54d0000 False 1
Fn
Map - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe, protection = PAGE_READONLY, address_out = 0x55e0000 False 1
Fn
Map - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe, protection = PAGE_READONLY, address_out = 0x56e0000 False 1
Fn
Map - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0x5840000 True 1
Fn
Map - process_name = C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0x400000 True 1
Fn
Map - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe, protection = PAGE_READONLY, address_out = 0x58d0000 False 1
Fn
Map - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe, protection = PAGE_READONLY, address_out = 0x5970000 False 1
Fn
Map - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe, protection = PAGE_READONLY, address_out = 0x5af0000 False 1
Fn
Map - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe, protection = PAGE_READONLY, address_out = 0x5c00000 False 1
Fn
Map - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe, protection = PAGE_READONLY, address_out = 0x5d00000 False 1
Fn
Map - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0xce0000 True 1
Fn
Map - process_name = C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0x400000 True 1
Fn
User (1)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
System (326)
»
Operation Additional Information Success Count Logfile
Sleep duration = -1 (infinite) True 3
Fn
Sleep duration = 15000 milliseconds (15.000 seconds) True 3
Fn
Sleep duration = 10000 milliseconds (10.000 seconds) True 1
Fn
Sleep duration = 4985 milliseconds (4.985 seconds) True 2
Fn
Sleep duration = 0 milliseconds (0.000 seconds) True 125
Fn
Sleep duration = 600 milliseconds (0.600 seconds) True 8
Fn
Sleep duration = 4985 milliseconds (4.985 seconds) True 1
Fn
Get Info type = SYSTEM_PROCESS_INFORMATION True 183
Fn
Mutex (2)
»
Operation Additional Information Success Count Logfile
Create mutex_name = frenchy_shellcode_003 True 1
Fn
Create mutex_name = frenchy_shellcode_003 True 1
Fn
Process #5: regasm.exe
486 0
»
Information Value
ID #5
File Name c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
Command Line "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:41, Reason: Child Process
Unmonitor End Time: 00:01:25, Reason: Self Terminated
Monitor Duration 00:00:44
OS Process Information
»
Information Value
PID 0xb14
Parent PID 0xa20 (c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B18
0x B1C
0x B20
0x B24
0x B28
0x B2C
0x B30
0x B34
0x B38
0x B3C
0x B40
0x B44
0x 414
0x 494
0x 30C
0x 58C
0x 928
0x 930
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #1: c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe 0xa4c address = 0x400000, size = 581632 True 1
Fn
Data
Modify Memory #1: c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe 0xa4c address = 0x7efde008, size = 4 True 1
Fn
Data
Modify Control Flow #1: c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe 0xa4c os_tid = 0xb18, address = 0x771401c4 True 1
Fn
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\regedit.exe 62.65 KB MD5: 90bed11c0aa7151485d1212d35bd9c5d
SHA1: 283a86876a0616df8c30fd6874a53e7ae5624904
SHA256: 19218554f71c236f63119fb630c88fc3349b6f5762c28c957f2b3f717e827748
SSDeep: 768:ZK9zVizdXiTyRLQJan8dBhFJ606Iq8HYvYDKa248ivNdmJB:8izdiiaa8dBXMjODKa2v6XmJB 		False
...
Host Behavior
COM (6)
»
Operation Class Interface Additional Information Success Count Logfile
Create WbemDefaultPathParser IClassFactory cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER True 2
Fn
Create WBEMLocator IClassFactory cls_context = CLSCTX_INPROC_SERVER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER True 1
Fn
Create WBEMLocator IWbemLocator cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Execute WBEMLocator IWbemLocator method_name = ConnectServer, network_resource = \\.\ROOT\cimv2 True 1
Fn
Execute WBEMLocator IWbemServices method_name = ExecQuery, query_language = WQL, query = SELECT * FROM Win32_VideoController True 1
Fn
File (36)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe.Config desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config type = file_attributes True 2
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config type = file_type True 2
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config type = size, size_out = 0 True 1
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe.Config type = file_attributes True 2
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe.Config type = file_type True 2
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe.Config type = size, size_out = 0 True 1
Fn
Get Info C:\WINDOWS\system32\drivers\VBoxMouse.sys type = file_attributes False 1
Fn
Get Info C:\WINDOWS\system32\drivers\vmmouse.sys type = file_attributes False 1
Fn
Get Info C:\WINDOWS\system32\drivers\vmhgfs.sys type = file_attributes False 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\regedit.exe type = file_attributes False 1
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe type = file_attributes True 1
Fn
Open Mapping - desired_access = 12 True 1
Fn
Open Mapping - desired_access = 12 True 1
Fn
Open Mapping - desired_access = 12 True 1
Fn
Open Mapping - desired_access = 12 True 1
Fn
Open Mapping - desired_access = 12 True 1
Fn
Copy C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\regedit.exe source_filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe True 1
Fn
Read C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config size = 4096, size_out = 4096 True 8
Fn
Data
Read C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config size = 4096, size_out = 3215 True 1
Fn
Data
Read C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config size = 4096, size_out = 0 True 1
Fn
Read C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe.Config size = 4096, size_out = 281 True 1
Fn
Data
Read C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe.Config size = 4096, size_out = 0 True 1
Fn
Delete C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\\regedit.exe:Zone.Identifier - False 1
Fn
Registry (37)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 - False 3
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\Description\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\Description\System - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools - False 2
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0 - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0 - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\Settings - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\HARDWARE\Description\System - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\Description\System value_name = SystemBiosVersion, data = 0, type = REG_MULTI_SZ True 7
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\Description\System value_name = SystemBiosVersion, data = 39336748, type = REG_MULTI_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\Description\System value_name = VideoBiosVersion, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum value_name = 0, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum value_name = 0, data = IDE\DiskHD502HI_________________________________OF90____\5&37d1a386&0&0.0.0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 value_name = DriverDesc, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 value_name = DriverDesc, data = Standard VGA Graphics Adapter, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\Settings value_name = Device Description, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\Settings value_name = Device Description, data = Standard VGA Graphics Adapter, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\Description\System value_name = SystemBiosVersion, data = 0, type = REG_MULTI_SZ True 7
Fn
Read Value HKEY_LOCAL_MACHINE\HARDWARE\Description\System value_name = SystemBiosVersion, data = 39354748, type = REG_MULTI_SZ True 1
Fn
Process (3)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe os_pid = 0x8c4, creation_flags = CREATE_SUSPENDED, CREATE_DETACHED_PROCESS, CREATE_NO_WINDOW, show_window = SW_HIDE True 1
Fn
Create cmd.exe show_window = SW_HIDE True 1
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe type = PROCESS_BASIC_INFORMATION True 1
Fn
Thread (3)
»
Operation Process Additional Information Success Count Logfile
Get Context c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe os_tid = 0xb30 True 1
Fn
Set Context c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe os_tid = 0xb30 True 1
Fn
Resume c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe os_tid = 0xb30 True 1
Fn
Memory (2)
»
Operation Process Additional Information Success Count Logfile
Read C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe address = 2130567176, size = 4 True 1
Fn
Data
Write C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe address = 0x7efde008, size = 4 True 1
Fn
Data
Module (48)
»
Operation Module Additional Information Success Count Logfile
Load C:\Windows\Microsoft.NET\Framework\v4.0.30319\\webengine4.dll base_address = 0x74720000 True 1
Fn
Load C:\Windows\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll base_address = 0x73da0000 True 1
Fn
Load Ole32.dll base_address = 0x755e0000 True 1
Fn
Load advapi32.dll base_address = 0x74d40000 True 8
Fn
Load user32.dll base_address = 0x74f40000 True 5
Fn
Load kernel32.dll base_address = 0x76c20000 True 1
Fn
Get Handle webengine4.dll base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = wine_get_unix_file_name, address_out = 0x0 False 1
Fn
Get Address c:\windows\microsoft.net\framework\v4.0.30319\wminet_utils.dll function = ResetSecurity, address_out = 0x73da24de True 1
Fn
Get Address c:\windows\microsoft.net\framework\v4.0.30319\wminet_utils.dll function = SetSecurity, address_out = 0x73da2520 True 1
Fn
Get Address c:\windows\microsoft.net\framework\v4.0.30319\wminet_utils.dll function = BlessIWbemServices, address_out = 0x73da1c69 True 1
Fn
Get Address c:\windows\microsoft.net\framework\v4.0.30319\wminet_utils.dll function = BlessIWbemServicesObject, address_out = 0x73da1cbb True 1
Fn
Get Address c:\windows\microsoft.net\framework\v4.0.30319\wminet_utils.dll function = GetPropertyHandle, address_out = 0x73da21b4 True 1
Fn
Get Address c:\windows\microsoft.net\framework\v4.0.30319\wminet_utils.dll function = WritePropertyValue, address_out = 0x73da2617 True 1
Fn
Get Address c:\windows\microsoft.net\framework\v4.0.30319\wminet_utils.dll function = Clone, address_out = 0x73da1d0d True 1
Fn
Get Address c:\windows\microsoft.net\framework\v4.0.30319\wminet_utils.dll function = VerifyClientKey, address_out = 0x73da25b4 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptAcquireContextW, address_out = 0x74d4df14 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptCreateHash, address_out = 0x74d4df4e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDecrypt, address_out = 0x74d83178 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDeriveKey, address_out = 0x74d83188 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDestroyHash, address_out = 0x74d4df66 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDestroyKey, address_out = 0x74d4c51a True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptHashData, address_out = 0x74d4df36 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptReleaseContext, address_out = 0x74d4e124 True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = MessageBoxA, address_out = 0x74fafd1e True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitializeEx, address_out = 0x756209ad True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoCreateInstance, address_out = 0x75629d0b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateMutexW, address_out = 0x76c3424c True 1
Fn
Create Mapping - protection = PAGE_EXECUTE_READWRITE, maximum_size = 85125072 True 1
Fn
Map - process_name = c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe, protection = PAGE_READONLY, address_out = 0x52e0000 False 1
Fn
Map - process_name = c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe, protection = PAGE_READONLY, address_out = 0x5380000 False 1
Fn
Map - process_name = c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe, protection = PAGE_READONLY, address_out = 0x5500000 False 1
Fn
Map - process_name = c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe, protection = PAGE_READONLY, address_out = 0x5610000 False 1
Fn
Map - process_name = c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe, protection = PAGE_READONLY, address_out = 0x5710000 False 1
Fn
Map - process_name = c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0x4fc0000 True 1
Fn
Map - process_name = C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe, protection = PAGE_EXECUTE_READWRITE, address_out = 0x400000 True 1
Fn
User (1)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
System (332)
»
Operation Additional Information Success Count Logfile
Sleep duration = -1 (infinite) True 3
Fn
Sleep duration = 15000 milliseconds (15.000 seconds) True 2
Fn
Sleep duration = 240000 milliseconds (240.000 seconds) True 1
Fn
Sleep duration = 4985 milliseconds (4.985 seconds) True 2
Fn
Sleep duration = 600 milliseconds (0.600 seconds) True 4
Fn
Sleep duration = 0 milliseconds (0.000 seconds) True 125
Fn
Sleep duration = 15000 milliseconds (15.000 seconds) True 1
Fn
Get Info type = SYSTEM_PROCESS_INFORMATION True 194
Fn
Mutex (1)
»
Operation Additional Information Success Count Logfile
Create mutex_name = frenchy_shellcode_003 True 1
Fn
Process #6: regasm.exe
34 0
»
Information Value
ID #6
File Name c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
Command Line "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:51, Reason: Child Process
Unmonitor End Time: 00:01:00, Reason: Self Terminated
Monitor Duration 00:00:08
OS Process Information
»
Information Value
PID 0xb48
Parent PID 0xa20 (c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B4C
0x B54
0x B58
0x B5C
0x BE0
0x BE4
0x BE8
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #1: c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe 0xa4c address = 0x400000, size = 237568 True 1
Fn
Data
Modify Memory #1: c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe 0xa4c address = 0x7efde008, size = 4 True 1
Fn
Data
Modify Control Flow #1: c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe 0xa4c os_tid = 0xb4c, address = 0x771401c4 True 1
Fn
Host Behavior
Registry (20)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time value_name = TZI, type = REG_BINARY True 2
Fn
Data
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST value_name = FirstEntry, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST value_name = FirstEntry, data = 2007, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST value_name = LastEntry, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST value_name = LastEntry, data = 2008, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST value_name = 2007, type = REG_BINARY True 2
Fn
Data
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST value_name = 2008, type = REG_BINARY True 2
Fn
Data
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time value_name = MUI_Display, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time value_name = MUI_Display, data = @tzres.dll,-670, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time value_name = MUI_Std, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time value_name = MUI_Std, data = @tzres.dll,-672, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time value_name = MUI_Dlt, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time value_name = MUI_Dlt, data = @tzres.dll,-671, type = REG_SZ True 1
Fn
Delete Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - False 1
Fn
Process (2)
»
Operation Process Additional Information Success Count Logfile
Create schtasks os_pid = 0xbc8, creation_flags = CREATE_NO_WINDOW, show_window = SW_HIDE True 1
Fn
Create cmd.exe show_window = SW_HIDE True 1
Fn
Module (3)
»
Operation Module Additional Information Success Count Logfile
Load C:\Windows\system32\en-US\tzres.dll.mui base_address = 0x2f0001 True 3
Fn
System (1)
»
Operation Additional Information Success Count Logfile
Sleep duration = -1 (infinite) True 1
Fn
Mutex (2)
»
Operation Additional Information Success Count Logfile
Create mutex_name = 92d3ce18e22c4e57b8d53faf2f44156a_logger True 1
Fn
Open mutex_name = 92d3ce18e22c4e57b8d53faf2f44156a_logger, desired_access = MUTEX_MODIFY_STATE, SYNCHRONIZE False 1
Fn
Process #7: cmd.exe
76 0
»
Information Value
ID #7
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:56, Reason: Child Process
Unmonitor End Time: 00:01:02, Reason: Self Terminated
Monitor Duration 00:00:05
OS Process Information
»
Information Value
PID 0xb6c
Parent PID 0xa20 (c:\users\5p5nrgjn0js halpmcxz\desktop\1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B70
Host Behavior
File (26)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop type = file_attributes True 3
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1.exe type = file_attributes True 2
Fn
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 8
Fn
Open STD_INPUT_HANDLE - True 4
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_OUTPUT_HANDLE size = 45 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 19 True 1
Fn
Data
Delete C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1.exe - False 2
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\choice.exe os_pid = 0xb84, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a8c0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-03 15:13:33 (UTC) True 1
Fn
Get Time type = Ticks, time = 119730 True 1
Fn
Get Time type = Performance Ctr, time = 17794521748 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000001 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #8: choice.exe
0 0
»
Information Value
ID #8
File Name c:\windows\syswow64\choice.exe
Command Line choice /C Y /N /D Y /T 3
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:57, Reason: Child Process
Unmonitor End Time: 00:01:02, Reason: Self Terminated
Monitor Duration 00:00:04
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xb84
Parent PID 0xb6c (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B88
Process #9: schtasks.exe
238 0
»
Information Value
ID #9
File Name c:\windows\syswow64\schtasks.exe
Command Line "schtasks" /delete /tn "" /f
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:58, Reason: Child Process
Unmonitor End Time: 00:01:00, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xbc8
Parent PID 0xb48 (c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x BCC
0x BDC
Host Behavior
COM (3)
»
Operation Class Interface Additional Information Success Count Logfile
Create TaskScheduler ITaskService cls_context = CLSCTX_INPROC_SERVER, CLSCTX_INPROC_HANDLER, CLSCTX_LOCAL_SERVER, CLSCTX_REMOTE_SERVER True 1
Fn
Execute TaskScheduler ITaskService method_name = Connect, user = 2683856, domain = 2682960, password = 2682960 True 1
Fn
Execute TaskScheduler ITaskService method_name = GetFolder, new_interface = ITaskFolder True 1
Fn
File (5)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_ERROR_HANDLE size = 64 True 1
Fn
Data
Module (7)
»
Operation Module Additional Information Success Count Logfile
Load VERSION.dll base_address = 0x74a90000 True 1
Fn
Get Handle c:\windows\syswow64\schtasks.exe base_address = 0xe80000 True 1
Fn
Get Filename - process_name = c:\windows\syswow64\schtasks.exe, file_name_orig = C:\Windows\SysWOW64\schtasks.exe, size = 260 True 2
Fn
Get Address c:\windows\syswow64\version.dll function = GetFileVersionInfoSizeW, address_out = 0x74a919d9 True 1
Fn
Get Address c:\windows\syswow64\version.dll function = GetFileVersionInfoW, address_out = 0x74a919f4 True 1
Fn
Get Address c:\windows\syswow64\version.dll function = VerQueryValueW, address_out = 0x74a91b51 True 1
Fn
System (2)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-03 15:13:34 (UTC) True 1
Fn
Get Time type = Ticks, time = 120807 True 1
Fn
Process #10: cmd.exe
74 0
»
Information Value
ID #10
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" /a
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:59, Reason: Child Process
Unmonitor End Time: 00:01:03, Reason: Self Terminated
Monitor Duration 00:00:04
OS Process Information
»
Information Value
PID 0xbec
Parent PID 0xb48 (c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x BF0
Host Behavior
File (24)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop type = file_attributes True 2
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe type = file_attributes True 1
Fn
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 8
Fn
Open STD_INPUT_HANDLE - True 4
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_OUTPUT_HANDLE size = 58 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 19 True 1
Fn
Data
Delete C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe - False 2
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\choice.exe os_pid = 0x56c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a8c0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-03 15:13:34 (UTC) True 1
Fn
Get Time type = Ticks, time = 121353 True 1
Fn
Get Time type = Performance Ctr, time = 17986058813 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000001 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #11: choice.exe
0 0
»
Information Value
ID #11
File Name c:\windows\syswow64\choice.exe
Command Line choice /C Y /N /D Y /T 3
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:59, Reason: Child Process
Unmonitor End Time: 00:01:03, Reason: Self Terminated
Monitor Duration 00:00:04
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x56c
Parent PID 0xbec (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 588
Process #12: vbc.exe
2709 0
»
Information Value
ID #12
File Name c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
Command Line "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:00, Reason: Child Process
Unmonitor End Time: 00:01:25, Reason: Self Terminated
Monitor Duration 00:00:25
OS Process Information
»
Information Value
PID 0x8c4
Parent PID 0xb14 (c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 40C
0x 408
Injection Information
»
Injection Type Source Process Source Os Thread ID Information Success Count Logfile
Modify Memory #5: c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe 0xb30 address = 0x400000, size = 421888 True 1
Fn
Data
Modify Memory #5: c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe 0xb30 address = 0x7efde008, size = 4 True 1
Fn
Data
Modify Control Flow #5: c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe 0xb30 os_tid = 0x40c, address = 0x771401c4 True 1
Fn
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.isolated 2.24 KB MD5: 4ed71acf48a1bc69e774dad325f0be06
SHA1: 687dce5e71bede553530ac131f7091661553de24
SHA256: 85dc4759cf932c7e627e1cea13896c79be227ecad15531a31e03e302d9dba144
SSDeep: 48:XclNWdgUhDDJgUhSkH9eR/KF76PUP7NJ6kg49Mac2UL:XeWdgGDJgDAwKFWPUDehL 		False
...
C:\\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.isolated 1.42 KB MD5: 74889077acf2bcfb5378a1b4fd212264
SHA1: 18a75764418bc91703ba5ece3a434a8a0823944d
SHA256: d41353fb0c688a3b8243e0c85776296a9f0ff32caf38d2e2f2260643de291379
SSDeep: 24:Ucaswgwxrtvl+3Kt8VyDzu3tMnQRhgqdI+nK9AFpTiRBgvwBQnvcaGRA:XTwgwxrt9+3KhDzctMnQcqdRnYYpTMc/ 		False
...
C:\\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.isolated 1.76 KB MD5: c990d54682dfb5b8e7184674223866c1
SHA1: 6813e05cb9e9063f80d5c8887f2f6062f99f7480
SHA256: 84c4bb885df3ee69c95133d59898a4c611e38559d9b09b880c6157b746fb931f
SSDeep: 48:X8D8BaiwMNjVBKQjVB4u/FF51MEEQlVOD3E:XG8Bamjf7jfv/75Wyt 		False
...
C:\\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.isolated 1.32 KB MD5: f841c70c5c3d664fd4acabaab147c4fc
SHA1: ea32e8986769666776a6298911ff99b376fd62d9
SHA256: 76eaee17d6d6983f581e08f9b271539a8843205a146925d074f0b11f97ea7690
SSDeep: 24:Uca1+jr3s/GJQ5AdabQ9Ioo4TXooMGVyXSE1MEdSDWSP3FxXR/L5o/aVrox:XQ/GghTX4TXXMGgX51MEEXdRR/LiSdox 		False
...
C:\\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.isolated 811 bytes MD5: 042c5db3e2d2fa07309967059fd8aae5
SHA1: 04ce1fb857cb103b5ecdbe5f4903aa7c9f8137f1
SHA256: 28b09311b69a3b4a94a81661c0ca233a74013faba62fc33624f112ad7b3d71df
SSDeep: 12:Uwfa7oHpR6I7/KRI3BfEcZ8jELR0oWR26Q29m+8+zGtD9CVyDz/UmhvI7lmQ7a1g:Uca7ozj7Kpcfw7I+3Kt8VyDzEwQm1QV 		False
...
C:\\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.isolated 1.35 KB MD5: 00b80b7c0ccd6552ec0b40aa2ff66fb5
SHA1: 2e9e40c7b58413239ce7da433cf3a4f1ffa2e39d
SHA256: 8588d9fa167342fe92f538038655f63bb50f576b6b3114ee53b23b5f313603ee
SSDeep: 24:Ucagu7rihHLCDygGiwKS//YbDhqKZC8jFeBK3WE2AunwQm1Q5YM5o/5v:Xzu2isO1CwF/WE9Gm1gYMip 		False
...
C:\\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.isolated 2.31 KB MD5: 57664317fa5fafe91085151ed15a2c32
SHA1: 997513568d647093f1dc2762bcd730bdc376b918
SHA256: ede5d41b8264bff8b31f5d85e901ac6393f179327a0db9df29fe998992788975
SSDeep: 48:X7flY13Y88w1XgHBWkgkShnfD0ol1I7UazWjVIAyWD/Q5:X7+3RvEBWkgk84cazwny 		False
...
C:\\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.isolated 1.81 KB MD5: 6c800721b7a25ada6bbe9eee1a9a24f1
SHA1: a689fa01442d54ba5a48ffdcc130acf142cb9882
SHA256: c15b75114a75f90894235ea51f59af1a6b171901404649abef0793c488826d36
SSDeep: 24:UcaYhfhioOx09ny5tq1t/iyPtYiLUxpl3AXV1ULbqNj50thqQXm4LhtT3cVa5Oow:X7Sx13Y/PtF+9eU3qBe5XRL3cuOF 		False
...
C:\\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.isolated 6.09 KB MD5: 0de76c12fb6e2ad57c3ae8f279aa46c3
SHA1: 06f5f08dece8dbfdaad40eb74a96d0708f8008e0
SHA256: 3dcc2630827c7e4b602cd08fb96025751ecf021f4e4c63b62503d719cbb2ae3c
SSDeep: 192:e8LJiV1Z4oepfRqoKCprYoxCrKXnBTbT6HNfEPJMYk:etRK1XllCrKRTfyNofk 		False
...
C:\\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.isolated 1.57 KB MD5: b9302b914a2b87af50792e7138308305
SHA1: 142e4a0978611f8068e9215068b9cce0701a6792
SHA256: 885a3d870ef084301a7a7159b86f8b0a1ee7866fe1a0eb170119873807c73661
SSDeep: 24:Ucan3SOHFomQ+WnQs2JbhzIJnIoo4TXoo3BPnkHff2bW2xDTwXccmPdTnpo11kv7:XKiOHSmtWnj+/X4TXX3o8W2xosHlbBv7 		False
...
C:\\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.isolated 1.42 KB MD5: 4413086afb4ec1188b4cbfb82e98a2ac
SHA1: f295b35f8a143f01bd7906dd8a920af9d711a8f0
SHA256: ec5fab5a67e5f079c502abfa2fd7419e3190d7507ea8bc4fbbf5d801eb7c5a19
SSDeep: 24:UcaDpdtXYaDY/hgFWlyAewrEnQ8GA9sCBvYHOnOysHsCEDdmrOsc:XU1k6Wlswr/815esOysODdKOV 		False
...
C:\\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.isolated 913 bytes MD5: 221d4c89665691f8fa12e2312b9f1d06
SHA1: 1f9f5efa9f2ad206933ebc03ade2126ebf9918b2
SHA256: 27aa7fd55f2a2b2db41f53e3c702aa027a2f899caf67113821803c3006041efa
SSDeep: 24:UcapPaWZuI7vwIAGThynqR1/qDMWA9ss3I:X8PhZTtbTqDsr3I 		False
...
C:\\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.isolated 819 bytes MD5: 1706ae5dcaa1dce76fd9e98154d9580e
SHA1: 94b07beca721e056a7d63d36d2628ad9a081419f
SHA256: cf64ca20fe934b2c0ee0c6ceaf638d0877de8bb3c75822c48a59f79ec75afee0
SSDeep: 12:UwfaiM2drA3139Vn4qEbBYVUP7xmwvR26Fgm+8+zGtD9CVyDz/UmhvI7lmQ7a1W5:UcaSY9V4qEb6ab/+3Kt8VyDzEwQm1QV 		False
...
C:\\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.isolated 1.32 KB MD5: a766a44dc6192eb29f2024e7bc9f7582
SHA1: 1bb4c022f9564bfffb92de7f848009fb647a7fac
SHA256: 0912de4f7b13ad894e7a4919f16e20a0421f4fa186c93e90a4b8baad4214f5d3
SSDeep: 24:UcaQakXJQOAr9hds3qgUM3xFFWlyADI0z/LezZ7n9vcQ2sC29c:X5aSCOgAUM3JWl9IkL8hL79c 		False
...
C:\\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.isolated 819 bytes MD5: 31b4baea013d85e1a77b87911478fa95
SHA1: 1c35bc8479ec79f979930e647050ec81c80f1765
SHA256: 8512962e31644fc541c2b222ed218618cf7a3b5e4f749b6f288c54a7ca65be6b
SSDeep: 12:UwfaIfxAb6U9Xo1f2m5zwhZR26LMm+8+zGtD9CVyDz/UmhvI7lmQ7a1WzE8De2v:Uca2xAb6U9X+6ZR+3Kt8VyDzEwQm1QV 		False
...
C:\\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.isolated 16.29 KB MD5: 3ecb43cc19002906b51651e2cb1fd2e8
SHA1: 8d480fcfeb66f9ca83e6ac136c15f43a13e71ea7
SHA256: 913ea35da07c13573a67df1f99ba865931f2f7e981b1c80e44f10610c2a97c3d
SSDeep: 192:nIo2KSKDLhNXRZmBVR5iZhqscApnoW5bxZbZSk6ASMVczXBvAefJUqoni/n4nsnZ:IQJiIIseySBJALqId3AEU5iW 		False
...
C:\\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.isolated 20.09 KB MD5: 529a24348a4f4e338903f0b71aa8e5ec
SHA1: 9f528a21237db29b15f34ee0e35e9eb066d9fa73
SHA256: e86cdfe97d58959c67b60aa5deafd45cbc3d3f2457ec556a2ef89b794c5a84fc
SSDeep: 192:FWlaYs9syZGqfZhqscApnoW5bxZbZxp0lEWyyBqgqamdZrY84BYLajs6JLxCnCJ6:FWM6qRIsX0lqSqQm4x6a462K6 		False
...
C:\\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.isolated 716 bytes MD5: 11076f57e4a41972b3c937d9d8d8da3d
SHA1: 9c10710373c11746585ca5682ec9891b8072bada
SHA256: dfe07314c0230b7d115abf08731b0cd73789b15dcf2e3c6586795e27fa4ccb12
SSDeep: 12:UwzVtAYcRKWYcR4TMcUj5rUgBt/Vhe40lYbEqs7xA13v7ksrq5fNceu9D0ydkRwl:UkVtAYcJYcqTMcJgBt/T1bRzreN5uzS0 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Adjacency.xml.isolated 928 bytes MD5: 43b0f35d4d2d9bc6e35b543e66fe4841
SHA1: 714f004e060d126ee4df8a1e3282ce54411444e1
SHA256: 3e8c2dfc2c6ec727ad34c25d90e33b1a00d3be6c67d3d473040f3096fbd21e62
SSDeep: 24:UqFuBvvDQmXGvRqEK7TX/FyHkOiP1H5Wmq:bF4vDQR8EKvFyHkLW3 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Apothecary.xml.isolated 965 bytes MD5: ccb8091fca211e7848eb7908f79751e7
SHA1: ee7495beacad21ab56a6ae7473defd049b2fb911
SHA256: 778f052fcdb5e4e8138e2deec2217aa8ad9e312398a92e9358e54e1529048868
SSDeep: 24:UqFuBh1GdWBfHH6H+0KUFxEZE696zP1wcV7rn7yDoXZ:bFucufRjexaEE6zuorn7yDoJ 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Concourse.xml.isolated 964 bytes MD5: 8f0ec4343e072c435d567adbf59dff12
SHA1: 42bf628b633dc47f3b48a6c53bddab5b2946103c
SHA256: 6ddf983183e5439d36dd0accfa909f876905e73ed8ee73f810bfbad35bbdc60f
SSDeep: 24:UqFuB4vDQhHJr070VpG8mZMfm+9P27imn78/f:bFjvDQQupGn1iP6nI/f 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Executive.xml.isolated 964 bytes MD5: 7d4c18ff237e6901d443522490e26776
SHA1: 9dd9a0ee36117359dde78be875030516d8b026d3
SHA256: 1a3aa3360bc6ab56948ce5cff1dbbd05a3cc1d8c58e1b836d09dec8634de307e
SSDeep: 24:UqFuBE/vDQhHJr070FwG8mmyDYzm+9g29InO/oYGE:bFr/vDQQ2wGKCig0IO/FGE 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Horizon.xml.isolated 926 bytes MD5: d26841e3f0612c9b2856d6e94f162699
SHA1: 401756a77bb04a99abf6f3269b83b65c283ee413
SHA256: f43b966d7cadaf1bdb60e0822a6f8cf4a1ad2851d601ad5df9aa04cb8a19c7fa
SSDeep: 24:UqFuBWn6cRZpqyfDnnsN3KcdfRCDXr8wTb8gEm/B7MMhRFf0c:bF5hZJosc5RCxShaD 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Opulent.xml.isolated 962 bytes MD5: c58fc2c98ba09c72e30a89954b01b9c7
SHA1: ec54c7a6d8b0ca91733581fa317cf67a14626425
SHA256: cfaed583516e3849fd9d63d0dce54a649e20ee7a351073cc4e5b5a489097f9b6
SSDeep: 24:UqFuBan6cRsLM5SHjPg6QM+r6l0qfzQBzxvvWvSdGATJfy5E:bFxhsLM5oP4MkQMBzxvNAATBF 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Technic.xml.isolated 962 bytes MD5: 05df70eca6ab1401e52f7b1817637193
SHA1: 7e208b96fa6384af01cad8e968931a10667ac9ae
SHA256: 91bba57c0d09fff6880d3fdbe87983e7c77895e6dcca797dfbd7bb5e4d0912fe
SSDeep: 24:UqFuBCpn6cRsLM5SHjegfQVzl0KN92tztbvaSd3xTJfwK5E:bFZhsLM5oeRVH9kz1B1xTBwt 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Urban.xml.isolated 960 bytes MD5: 6d13aed3296facc9717feae0718bf73e
SHA1: b8ac71f95ed09b3b1b2b884483f386638db977a0
SHA256: 23f98d2187b69638ef69bc6ab87559c8a7b0e06531c9d3473a9feab3fcc6302a
SSDeep: 24:UqFuB0/pDe6EvSqWK57sBtMRHQ6IOiP1V5Wmq:bF59F87H5KMRHDILI3 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Verve.xml.isolated 960 bytes MD5: f6d5a947546f304182449adc50772692
SHA1: a8a108646f42a5fdd05d712529275cd6c13dff76
SHA256: 420f4e38ddc17cbfc51fd237c9436396147714e10e0336125b0b6b2b503ef68a
SSDeep: 24:UqFuBKpDeGvlqxsto7N6oHXrOiP1q5Wmq:bFt9RwxsiwoHXrLL3 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Adjacency.xml.isolated 3.52 KB MD5: 03c76c9a8c0e33c40a08c9e4e654acca
SHA1: 7dca190075dc09520638eadaa8495a5332e616f4
SHA256: b276a54511c5c0f7f19b388ded583d8e8ed897b7056db9b33dd2d53beee953af
SSDeep: 96:5XmKXcf+Asdjy2BJRczCvmgyLI40q1sSY9d6E292Nq92BJkCVYVTeb+axRsTSfDF:5DJOGHmvk40n5d6E292Nq9GkCKHRADF 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Aspect.xml.isolated 3.51 KB MD5: 127f32892c8a1cd76b5e5505386fae5f
SHA1: fe5c740ca4feb0ff95ef71c5800066ea31e57bd0
SHA256: 33fd03fa33f7909ced2d4da3eefdf69990f4c6eb8aa3c2fbc4bdf5eabb0e713c
SSDeep: 96:5tmKUeU9ItPYSzMSuJnCBxFRagZV2BJkCVYVTeb+axRsTSfYaJOl:PIjaMSuJ8PRpZVGkCKHRAYaJOl 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Austin.xml.isolated 3.52 KB MD5: fcd7ecb3d7044e7ecfbaa6f0b111065d
SHA1: b3e66a095dec7568020a3b5bb9013e364b62f303
SHA256: 85254ea8fd1a790ff7109c3b3cd47e8f1a7463d30802b52edf8b7c27c92c1a36
SSDeep: 96:56KBKUxgxpqouNjkWaH42KSKmmG8eyMpEV8cNqd16R9D3WG:YKBKlGN0H4F37ReyMpEOcNqOR13WG 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Black Tie.xml.isolated 3.75 KB MD5: 8868e0ea413066d857f952d342237584
SHA1: 6c82bee7b79d0ef72a6f8f7dcd4bff9ae2334cf9
SHA256: 28027cb9db5937ff6b11b2a54b963c8f2e9dfa92386b0efc8719f2d8288d132c
SSDeep: 96:5/wiI4GnCF9sdjy2BJkCVYVTeb+axRsTSfSEJgI4GnCF9sdjy2BJkCVYVTeb+ax4:pwiI4GnCFaOGkCKHRA5JgI4GnCFaOGkl 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Composite.xml.isolated 3.51 KB MD5: f5536c2fb4cc5f9579ed1cc48514be13
SHA1: 397bbf61d84986943c5dba98f784023f96f8352c
SHA256: 913e688c9168f1a80ce1ebfd215e7cce9cf7ef437feb613db0a11749d4ac1efc
SSDeep: 96:5nAd6zxMh14miYZBow5pXQdYix35RpIery8gxpqouNjkWaH42KSKm+WG:5Ad6dQ4mPBoUuuitHUGN0H4F3TWG 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Couture.xml.isolated 3.75 KB MD5: 7a0600d3e05d1c2abbd789b246ec708d
SHA1: a4df9a52515e17c32845ef4384d5c0d7bb0de322
SHA256: aaca422ff4cecce28385f4d6be7f1945056a30d0ebb7b167c405872ecb67b78d
SSDeep: 96:5BAXC7wDmIslNLlfczCvmgyLI40q1sSY9XC7wDmIslNLlfczCvmgyLI40q1sSYpa:vAzq3fLllmvk40n5zq3fLllmvk40nNa 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Equity.xml.isolated 3.74 KB MD5: 959d5e01ee81b588cf56d75739087fca
SHA1: 00a8b2fd2869c72ede76958ec3c1b0ecc4d83695
SHA256: c5c3279a0ce62e6a2b18b06b4096964da0cd85502489939924378616d9f532bd
SSDeep: 96:5D8+KuFZd/ItPYSzMSuJnCBZVIBKF1h0NLlrrxwWc/ku4YixB:eOFZddaMSuJ8Z0KvhYLlrNFLiij 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Essential.xml.isolated 3.52 KB MD5: c5c27d187c02fffcdb95cd9698c5416d
SHA1: cef66a94b2c8b3a5ad907c266690b897568b1678
SHA256: 7a302951b421940832c5accf4098d385d62d167a4e86ec88bf4eea713a8f3135
SSDeep: 96:58AOAVkctKOU3odQqd16R9WWPuery8gxpqouNjkWaH42KSKm+WG:WAOAVZKH3odQqORUWPEGN0H4F3TWG 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Executive.xml.isolated 3.55 KB MD5: 2386075559532cd6406dc9c666a8af1b
SHA1: 0fa8d76ca83fdf3e60f49c5ed8c43593ee35ddfb
SHA256: f86fd895b2fa3c6e1f27df1117542209dc2b4878b814f4299e51222f8b682ad2
SSDeep: 96:5aACwjRN3uexItPYSzMSuJnCBZVIBdjRi18sEV8cua4miYZBow5pXQA:sAFVtlaMSuJ8Z0dVuTEOcua4mPBoUuA 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Flow.xml.isolated 3.43 KB MD5: 7b56adefb15ecd5d96be345bf6d8c718
SHA1: b3c90ae2c88ee51bb22c281608a3a92e0a1da03b
SHA256: 02f6391dae6ed7f81d4b5b8d5127eb272a18afd310b4847083647dcf242d56d4
SSDeep: 96:5q2j09veO3oYrxwWc/kuCiclRf+A0OEV8cua4miYZBow5pXQE:bUX3oYNFLnic+fOEOcua4mPBoUuE 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Hardcover.xml.isolated 3.76 KB MD5: 7b2f9996c521db81e2c4d5d53884925e
SHA1: 9e8c2110b6384ae2cbd6238cfa8875cca374e034
SHA256: da65e08331d278daf09a00d5b5069418ea47ff9569770bc052d3ba777c096604
SSDeep: 96:5NAUMTGKF4Snh14miYZBow5pXQy4YUUgOgxNsqH3Wjyas7cvbiMrdsVIm:/AUMTGKF4Y4mPBoUuy4RiqHGjtQ2iUmF 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Horizon.xml.isolated 3.54 KB MD5: 0450bdecdacb11ab139e41c693d7ce76
SHA1: 6376ef6ecc58e694c0869b16dffaf8d3b23a0783
SHA256: 346af4f2a6486ad6b8ebdb78d7f827e67efc3eb45bb23d080c2601e73106c2c2
SSDeep: 96:5aFTNZFXPUWRV2BJkCVYVTeb+axRsTSfuFRaZFXPUWRV2BJkCVYVTeb+axRsTSfN:UFJfLVGkCKHRAsRQfLVGkCKHRAsg 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Median.xml.isolated 3.73 KB MD5: eaf65177222102e7da043b5f3440d6c9
SHA1: 4b3200ce0103276b9107036d4243af337df49359
SHA256: db6f8a89cc6f2be02d620a3d7d972e87b5bfcb4f700d3d94063d09469e110a92
SSDeep: 96:5Xj1KuAqPRNLlfczCvmgyLI40q1CJgIGu7Kw6AjrEV8cNqd16R9fYixB:FJKwPjLllmvk407Jgla0OcNqORCij 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Module.xml.isolated 3.50 KB MD5: 58cc901c2d4e7bda9f98d1cce49d813c
SHA1: 3e1169a19205f0cd66e6857d6b3e86aa6ace3dd5
SHA256: 56d80f43db47726f67d4b22ddbd4a4e58181b3a0168d4ab8046c99ed59d6b303
SSDeep: 96:5yWYclQSPuVSqH3Wjyas7cvbiMr78JbP47EJh14miYZBow5pXQdYixB:cW6bSqHGjtQ2iU4dGk4mPBoUuuij 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Newsprint.xml.isolated 3.56 KB MD5: 21c8aa95ca30b3a5a408b9e89da08cd8
SHA1: fa7bd4625995eaadb6e51ddc6a04f95219da6085
SHA256: 1afb0446e04fbd14b8f132567431efe24945a34060b4374032001562bac3d922
SSDeep: 96:5LAXjR1VK6lFh9qouNjkWaH42KSKmmm8stqv920d8gxNsqH3Wjyas7cvbiMrdsVr:BAXVPK6ldGN0H4F3ZLyqv92DqHGjtQ2o 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic 2.xml.isolated 3.50 KB MD5: 0749b16c17c548f843cda28eb66fd0f7
SHA1: 0b314237a304b1550c659ddec36031ad76e0ab66
SHA256: 5af9fd109d332791707f2e3891cdc2035e50433ffc5121ecad6378354919b71c
SSDeep: 96:5QiQJNiAX3oYrxwWc/kuCJgQJNiAX3oYrxwWc/kuCJOo:miQJNiAX3oYNFLnJgQJNiAX3oYNFLnJT 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Oriel.xml.isolated 3.59 KB MD5: 31e789ba2955048aaad5642ef83c86f5
SHA1: c497482d729e3bb77c6ba5353d42bbdd76cb14bc
SHA256: 3211031c7f9c00a31e453ba1642183cf90f942c005452fc5df1f0b223079ec3b
SSDeep: 96:52nyjR1jskJ2BJRczCvmgyLI40q1sSY90w/920haQSPuVdPYSzMSuJnCB+Fg:MyVCmGHmvk40n5x/92mfbCaMSuJ8cg 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Origin.xml.isolated 3.73 KB MD5: eba2d8373f1d5df8e9624b66b3d3d2ac
SHA1: abd417f6fb7716a50e6b0084825e2661b75b8c16
SHA256: 85a854354fdd3970c2e049cce7941856199abc8fb09729f6c001ae5fee3eaf05
SSDeep: 96:5kj1/St9WFHh9qouNjkWaH42KSKmmmVGutqpIbh14miYZBow5pXQdYixB:qJKt9WJGN0H4F3ZB3If4mPBoUuuij 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Technic.xml.isolated 3.52 KB MD5: aa50d74695feab50a5309322f14742ff
SHA1: 61f8966b0b397b9fa65653914cdd17dcc5b4d422
SHA256: 2fed8eab8f4f4fe31e2c1e97a98bed62eeca1c0679358cdc33e4c150979ac885
SSDeep: 96:5KTNZPeUkQSPuVSqH3Wjyas7cvbiMruaFZV3oYrxwWc/kuCJOl:EdNbSqHGjtQ2iUhFZV3oYNFLnJOl 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Thatch.xml.isolated 3.75 KB MD5: daf4f531cc4e744adcbd3b7077167c9f
SHA1: e35ffe18c749757686f7c19bc14d4228eb4071a7
SHA256: 29ffd6557ab6563ed3edb5b55e83c686251e7b19a0e8b5b195d98e0d50963b70
SSDeep: 96:5Xj1KuZLgoerf3oYrxwWc/kuhY91xA8UgqNZgxpqouNjkWaH42KSKms:FJKMw3oYNFLh1xbUDNEGN0H4F3/ 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Trek.xml.isolated 3.53 KB MD5: 0dc584d6ad1590f6e13a82c61d578fb4
SHA1: c56452f2063f0f4ef8c26b4f2e5dca693fe9ee62
SHA256: beb0069f6696169e792a30bdca1c544ad2a7b3ba20005da5c6bf48fe105ed253
SSDeep: 96:56/2w8Kve+ogxpqouNjkWaH42KSKm+WdyjRpaSQSPuVSqH3Wjyas7cvbiMrYmR:VrKJ3GN0H4F3TWMV8HbSqHGjtQ2iUYw 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\DataServices\+Connect to New Data Source.odc.isolated 190 bytes MD5: 80cdc961c365d9dadd6cba2a68312f30
SHA1: d5a7b5426b11666b9b7716b211d1d38c4e9f7843
SHA256: 872a61d978ecd25593d30ed8ca0759a2deec249734840e48dfd4782dedfc1d35
SSDeep: 3:KbSVVu3qD5sCS8DI0Lywe6MpbURWY++ol630kB8DQBPN1Rx0AaErtmztGAeiAT5s:KmVVO49u6MpbwBol3kB5Pv5aErt60mAS 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\DataServices\+NewSQLServerConnection.odc.isolated 196 bytes MD5: 68ea4fa21d68a7db9e4aa1cc8a0c1446
SHA1: c9598d399962456705aa5d944a16f253564123e6
SHA256: 50cca0b3f89ae7adf011ba726e49694fb21e4f48c74bc931993e486027ebf636
SSDeep: 3:KbSVVu3qD5sCS8DI0Lywe6MpbURWY++ol630kB8DQBPN1Rx0AaRbz1rNrUJuV8nm:KmVVO49u6MpbwBol3kB5Pv5aRLzkvy 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Casual.gif.isolated 5.53 KB MD5: 23702774bf16ca8338dc06eeea5c674d
SHA1: 5a62a40b896269723f38b6783b7ebd20d635cdbd
SHA256: 343e49c47c312c6409cede252fc7f13272b596b41b82dd7706ee9e882764821f
SSDeep: 96:0YM7jz73yRGIwndHVSFS+WJezf7beTGjkqThFABMtfljdISJISWn:0YM7jni4Iw9D+WQ/Qc5hFAStd59Iv 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Country.gif.isolated 31.46 KB MD5: 89d3064e548a0a480e495321014b5b48
SHA1: 42f6419af70976877d6e2b253fe8581dbe72a8c7
SHA256: 48c96fe96086e474c54d93e9f7028d81c3a2a4ca04c41ad7c751bf84b2fbc7a6
SSDeep: 768:x+PY/UNBQ+3PtsyuU7qr49Hr1kxwp/XBrae/zSj5ECx:x+wM31syNGrkpvBbSl5x 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Earthy.gif.isolated 4.79 KB MD5: 7580404b21e4e05a07e585e417b48bb4
SHA1: 1abfd2768279abaaaca6781b1fdf170e72d1457d
SHA256: b77a00f1efc069af36bb3daad0cb8aa798e59b52a7cb7ea9e43db4e36db0efa0
SSDeep: 96:Xu3Hh6QXv/V9ps2RFOU/93KpM5ZKykbrnDatMQ7sRw0:X86KHV9BRM+5KG+3rOWukp 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_GreenTea.gif.isolated 21.64 KB MD5: 104c06b81249853d6159160996a28cee
SHA1: 4c7681592e1ab29a05409947dca9bdbe4c52dfda
SHA256: 5e10a33db23f98a0035b34b78b68b7a0ce19b669e6c90958b49f150345466990
SSDeep: 384:rCS+QdggrOqRUfOBja6QBC7ji6Q9NkabZcPRV920OIO:r8QnOqRRlOCmNkmZcPte 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_VelvetRose.gif.isolated 15.10 KB MD5: 8e09c32110c280c4a199ebf96ff2a260
SHA1: 659b6090bbed39dfa39e9d31673d1aeaff416374
SHA256: 7fd504a715e6cf5d3fa1e164f0df60ff88ad14b229a2777a1a9d5a52274eaf4e
SSDeep: 384:4ovzsvLL+l4q6JTgLT1OQ2tmh58anLXZs7hmu:4ovmf+l49gLT1OnA7LX4hb 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Adobe.css.isolated 1.84 KB MD5: c8ef05a95afb18e92cefab4c1e5bebbb
SHA1: b4cc521ae10d66574cf88109a6c88dcbe7f453b1
SHA256: bef2967871d761dc1c26e8241f73faf681eeb0bd0ba89bc2b1511baa33efa3f0
SSDeep: 24:8+nDSTQDEe/Tx6mwyHtsgoP8BxZUVHljgXVqD5y+yCEg6m0kq7QAkwbty78ijuT:8+STQDvx6wNsgoP8iljgFDgf0k2ljobG 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana.css.isolated 2.90 KB MD5: 36a2cb9c80b2c2fe9ee49d639d4b8813
SHA1: 1bd15f1afc8f55821f1382f4ea0730ec9b0f3440
SHA256: 16c7a4ba63359f27c35e4fbc5ad76c9863d4f9bc38a0e5a6478683a356f8247c
SSDeep: 48:AeF32f1IQ1iOUa4s5LwJ5OR/OBeAXlFXkhDXAm428hfaKkZIoyMhm7ljgg84pvSZ:AeFmJisFwJ5OR/Sey/khASCyw5jggPBk 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue.css.isolated 3.17 KB MD5: 659437d8dcb1ded746be8e0988667dd5
SHA1: a946fec9a01502a5bde2677c16b4735c0b5dcbaf
SHA256: 367afa6668cb5b7b3e24f1f277e1f895ee5f3069e08a45e0d557ab7407e459e0
SSDeep: 96:i2E00OdFrEvwWIGMRKCE+ka7+uAIrQIvQoi:i2DRddVWcRztka7L/i 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\background.gif.isolated 323 bytes MD5: 119e9f073aa0338d70a5bda86006cfaa
SHA1: f859472382e501620f36666a481b41b53b351c8b
SHA256: b5ed1d950a9af611a0b70ea1420d67790b0d68cf5d1cedc44a55c3b109c1d0b6
SSDeep: 6:RC1afGiEwiDYZ60BP5kLAFDr6MFtAn7KdvDxAErQdA3TkMLWj9EE:E1afGY5BP5gAFDr6M87eDxAErR3oMy9f 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow.css.isolated 3.25 KB MD5: 8489d00b386575b53575fdc703304e0d
SHA1: 1dd175198d04ee14f84ace9ba3268693dd1d2054
SHA256: 1031f699ae902d03d4e527ecde9679af97fd6d11f53857152596340ee938a992
SSDeep: 96:LNWG87Drr0szWk8uQ0fFQnTwgv4L8a2Arb:LbCwo8hRv4L8mb 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Casual.css.isolated 1.85 KB MD5: 7d90ab21def2bed2be411502d09f014b
SHA1: eec4f6646c6084b85f7a8f53774af1df9a0b11fb
SHA256: ab9ff8d672bebcf2a8e9238618efe14a6a21bfad5b4b2f1cb55076b704fceb84
SSDeep: 48:2avR82Tdn0X1DJzWOmH9C2Q84pvSVZ3mwT5R5Uw8c:1hu1DJfmqPBu5Rz8c 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\LightSpirit.css.isolated 1.94 KB MD5: 74e8b14bfb28d844db8b29b17504a071
SHA1: d9a0a9312054d019868fca9930bf626b01a059da
SHA256: c3b8d34a9faac1fd88318d8ee87d1ec94d508c9783d61d48b1f60eb05368b68a
SSDeep: 48:dgRJOUzsufROgZPCZ3FQIoENQmh3BRSvbG:dsIufROgkrQIvQooy 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime.css.isolated 3.37 KB MD5: feb554cfaaa5488e0f699ce0ec3c8560
SHA1: bc0b1721b3d3afc2e886e505bb48dcd8c8a35c7f
SHA256: d87f25313c37b43630a234cd031fe42297de93c6aadc9b740919d0decb6b1b22
SSDeep: 96:3/1YdF/nzPTHk0KqzFkiSvARL8a2AeZ0d:3Cdl77tFSvARL8hQ 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis.css.isolated 3.38 KB MD5: d1a7c2931c104cf49105054614d875cd
SHA1: b481d7fa5ffee48dd4123bc42457dafb7830168e
SHA256: 46b3c9b476f37d442600b99d71a3c8397a9b20f0b9a2f0ff50803addc61c9b28
SSDeep: 96:XSWFzYHuk0sQUOT4FiOsn+kanqlujcahpXxp:XzzKuk0qVFiOlkaqluQixxp 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_choosefont.gif.isolated 890 bytes MD5: cf9eff759b5b11026a18633dab3f170e
SHA1: 505d1a24a32d835514ab8b8fa19cc1f05e4d96c4
SHA256: 3588a0bee8bc3a9b525c4cbe8eea7ecf548a20fc3c9e56f17d22d63a375682fd
SSDeep: 24:LyK54bkTybznR6Q3FALxybxCwDPQvnjj8b0ZJneVKe:L/TEhVIxRwDPQvjj8b0Jnxe 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_underline.gif.isolated 860 bytes MD5: b3307599549e8c676ae545ac919cbf06
SHA1: d32fcc4468446e0229086f757ade35a3943c9f3c
SHA256: 30d9b8ec64f92e2ed7d502b458070e3149d96e242ec80b93fdaed8494420005a
SSDeep: 24:LyK54bkTybznR6Q3FALxybxCwDPQvnjj8b0Z4Cv:L/TEhVIxRwDPQvjj8b0d 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate.css.isolated 3.44 KB MD5: fd48b3d39e060914c531a26cba261eec
SHA1: 6ca2fd0c0a52f8873276a7af782f2c217cc34b74
SHA256: 5e82391df62c02ecffe035e76c343e0557f844d1822f24b51f1b1f1c7c098116
SSDeep: 96:aSvf7oc3O8HTlYIoMR2hkCNugwJnLdYXNj6uwA5W+0d:F37BTlYYRs9KhLedGuwA5pQ 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\background.gif.isolated 6.74 KB MD5: 82ca382a6d4fd5797c1171dab20ffab9
SHA1: c7d0df4fef1748521e1d848b10324e7368c9f642
SHA256: 058796cc63fae49fafc2434800ec53ab54f30da907c76e3dff3a4f10dbafe27e
SSDeep: 192:OLD9zeZpssNFDsjDFl/dQ75yBIFQcFvw4Ft92Krx:OBezTsjDTZ8QcCzKrx 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue.css.isolated 3.69 KB MD5: e803f605ec2ceb71d09cb7d43b5b3f2a
SHA1: 263d379b2a84dbe386b5d41c79fefab3606172b0
SHA256: af8ecb0befb4303105bdc23e3ab72a7f159065a8f69d339c8004a5354a23eea7
SSDeep: 48:B81WP6OJyw6zy1Q58O1u/P8NR4c+9q4YgsBI4yU7PW1vnu0bldCZ3FQIoENQmh3l:Bgo8z21YUPoN+44YyULGvnuZrQIvQooy 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\arrow.png.isolated 229 bytes MD5: 6ab7fd99d0de01ba7a490bf8a0676712
SHA1: 2425fa200a1c64e0301d28ff2df060c4a7939188
SHA256: 8e112877bc3931e8b5ca989f958b03e68b053c1cf241090940068312676e1cba
SSDeep: 6:GDFVolmwlOhnZYlEBzZKYkIwrFYqApBib/2eoU0ulP:G5VimwIhnZSEB1zeJ4quNU0w 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Main.gif.isolated 1.55 KB MD5: abf8bb12b8c8f61081475be2449e086d
SHA1: 30471bb01044da4713c3c5aa73755f9cb858bbad
SHA256: 432bd6c8dd1bf1dd7bfa6b37076d9966ef73080a9697ad162abdbf06b1af6da0
SSDeep: 48:EvDaYCviimojZWMW5eMYxsrIsn6eCXxzwXbS9UxbYs+:EmM4jc/YS0snUybVxbYr 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions.css.isolated 6.45 KB MD5: 98c200b49eacf05ee8b1532a2b68f349
SHA1: ecd2aa02cd1585a8a3f1a18a8e4aeea3dfe3dfee
SHA256: e4e1a31ab85c736afa95368289819a4b2353bfd8759ea61a87501d8bad24ed4e
SSDeep: 192:nN8U3AYnC5RkU0pBcPhyg+PELTQHEvk+H2WQjBNrn:nN8VYnC5yrXRhP8TQHkaNr 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Person.css.isolated 167 bytes MD5: 192b4fba20fff736c4b627732355d404
SHA1: 8f301579d23aa5e61d941aee19dbc38b1d2c7465
SHA256: f447ed532b4a27cc37874a4235fab64fa86bd2052acbbaec5792a89a8146fda1
SSDeep: 3:o7P1YPEBHqLAJiWW0F5sbxgQ876rZ7vTw0ERsiRRphXt/ENXJ3eyY:oLHHq0JiWxbsbOx6rtTwvmin/ZW5uL 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Sts.css.isolated 2.50 KB MD5: b2cd7608672c54794acb4a35060b1ad6
SHA1: a55a5cc1ee7097557cf57a71459e7cdc139022c2
SHA256: f355b27646321f92e4378d1ebd9c15d8359f0f7f5445d24d06e20f23b956ded8
SSDeep: 48:dnZvTyeg0Oc7587ZIRZ+jZp79slgeF2GoC2Q84pvSVZ3mwT5R5Uw8c:dnZrywNoZIRZWZp79ygecKPBu5Rz8c 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\background.gif.isolated 233 bytes MD5: 4724cf5bf7e005785acb6516bec31ca1
SHA1: 06354a624b06a69b06e5777fd82df4e7100b890d
SHA256: 587d47df5968e8b850a0c25027e1b09b210da89a9285ea599112c31e622a2a26
SSDeep: 6:4ACfu+W188ajKpzzOXnFcD4VOsjsvGCsBZ4RPuSX:yu78ZCqnOE/RmX 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Sts2.css.isolated 3.35 KB MD5: 5463ed2d13a8326ed56eb6746ece2c8b
SHA1: fea48219fa5aabbe9e7b03d65f9860e668086088
SHA256: cbb5bdba06371a8c412115feb638833d4c604adbb02d591732917a1da31ea20f
SSDeep: 48:zbg7sUfzjtAVK7hvDXIupInsRzOjU5Mo9M+kJdVGtC5NJY8PSSkX4Q7OGk7zNpkC:3qdzwivDX4b7jotCLJY8KZoQql7l 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\background.gif.isolated 815 bytes MD5: 0b20321223bcaf1357f8ff6e350f1bc6
SHA1: 6ed8f265ca71347ce4e6eb71a274d827bf2a2265
SHA256: c7ccaa9960d7bb2b97531171d682d9299ef071b0e08c1c10448c34a46e4c3741
SSDeep: 24:sUKlWW/N0A0VPDCjoSgKmAFgvwlV9bbGQS:2pWA+A0KmAvi 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl.css.isolated 3.25 KB MD5: 83ec14c18a2551cfa3a30d1014f0f9ed
SHA1: d47b76034a7fd852348f230199339f47fd386875
SHA256: 9d7456eceabd1cb61b8e88dcd6bc109859ad2e0d92967e9c9f41b60ec01953d7
SSDeep: 48:Wlsm7qqZeAE7n27bjsNm7yHrxBCVRUV9FPj9CZ3FQIoENQmh3BRSvbG:WPNeALM/22V3rArQIvQooy 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\VelvetRose.css.isolated 1.80 KB MD5: 1261cb7fb88857c0501e532b835f28a2
SHA1: ab88a8d74fdd2bf17615221740dbe4a1866e0a0c
SHA256: a685f50c41147412e6f2d7c1c5b4ceab7112801e85b8294e6a94f46dcf205619
SSDeep: 48:Cb0AOqRFjIP+zGX8PSSkX4Q7OGk7zNpkKl:YUqIP9X8KZoQql7l 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Default.dotx.isolated 8.97 KB MD5: 7017831695a18400a18afdc7df93148a
SHA1: 13bea0f7482dec249273d42b293b63852efc69ea
SHA256: db1dac6dd5cd0c75b613ee8958af4cb86517d46e938ff27295959610785d3922
SSDeep: 192:ZHs4ygDEqhj2SQwK+/N0xcfhkrvFTRb3tmpZ1Cr9YJv28jehpwdG7a+XPhaML2K:ZH9yElgSD/NXfmrvDb3tmoCJvRMwdcQK 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\DefaultBlackAndWhite.dotx.isolated 8.24 KB MD5: 88ab81e6d8a351a4790bfddbccee8db6
SHA1: 2b3ac804bc2c1fd3ba2ba8fc9c3b1b1cdf1b3244
SHA256: 633206e5b41f8156f6cb9d0ea38478b5c2096a8552c19c91ce2ea55bf1b082cb
SSDeep: 192:ZHrQqu4iHpXq6J3cjSNiFpYihROCiOJGqg:ZH44WpXq65NDi37JGqg 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Distinctive.dotx.isolated 8.35 KB MD5: b4e59c7fe46564583f406ef55c63eac9
SHA1: 51bbb7e4ff5c2695d345fb266955805934bd6c1d
SHA256: 7d87aed287f751c079dad4b222a4077c9e7f4f44c73d17e9e20ade49460658a3
SSDeep: 192:eH7/kaLdWeqI+75Mj/2Ph3jpS5EOlSEM5qwzWc7CIrCvXnZL0QQE:a3wG/b2Pp1SfldM0wFmUCBLdQE 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Newsprint.dotx.isolated 563.60 KB MD5: 6d757a7bfcf3c61d4861ce417ad44cb2
SHA1: de0e5b555c9f53a0768f536a4cc9ce852818441d
SHA256: 059116b6024867e82413434dcc5a69fe75762ec1e73bf92c41df33ae6a57a5cd
SSDeep: 12288:r+XT05G01qJuk0ZDMY0prIJTQMIbirj5+E7Lh7qqpjqtWKd:SXT04ACB0BMY0ySMvrjVlhq7d 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Traditional.dotx.isolated 8.48 KB MD5: c2de85f09b0792e44cd413c3002d9e4d
SHA1: 0addad5a055594c35d2835f0d2a6e46af9235bee
SHA256: 85af9ddd869a26e784886407ac09324e354d69fae3c90b54b9cc9b953b237c87
SSDeep: 192:MZiU1HrQqASE4IfgoiDp+3pEuiSvUkrJ/eHRB16pBZS:MZPHWZfgoiQ20vU6J/QL6py 		False
...
C:\\Program Files\Microsoft Office\Office14\Document Parts\1033\14\Built-In Building Blocks.dotx.isolated 3.99 MB MD5: ee50ec23275da38aad518c9e3b935dab
SHA1: 2f322b5b335e678075f336b11129eb44ac168e77
SHA256: db5ba8d8b7f4cfba074847bdf761c2001bdf8e98c9d0514db4f9936d4a152005
SSDeep: 98304:rRwnrNwFP2Yg2W9ik1xKNG4RLNmVRb7Z49PUwAN+gXl2bo7h+QpRoQm8wFP2YmVs:uJ0P2YNW9ik1SG4VN2bCUwC+g1j7h+QC 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.isolated 942 bytes MD5: d22814aa50f384b519e2b4189f9eb935
SHA1: f8da25da27df511cd6c875a217c118f827a92d6d
SHA256: c89998b49fa7a1683be95586fcfd8dffefd60ac6a7ba7e4e3ad3bcfbfb0ba084
SSDeep: 24:fPs6fAi40ywwUNht+AbZtgahCM44BD4I4:fE3QwUnMnsDD4 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Public_Primary_CA.cer.isolated 576 bytes MD5: a7761f1bf7159405a70b5298119172a0
SHA1: 03aefec98b9bd3f080c0a2abd6c4cf7032c5fccb
SHA256: f2d2b5dd39df15f6ba62eed80d7c5c6fca5ae864c0aa1f0013abc6ee8a3faefb
SSDeep: 12:7Kqwv3d8l10ahWaN0serMeTskjhWVSeMzIfJiX8mLvaitn:7Kqe3Gl1RhF0M/yWVScXm24n 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\Sounds\People\Whistling.wav.isolated 28.75 KB MD5: 41d0e6fb58d426e5df94780f11462a7f
SHA1: d1c4e7bca15d74223981244cbfcf420ea053df4d
SHA256: bedfec79c90a786e76feac87052cbb5e3a4a2c2fa2fc24ef1f92a9d54203f952
SSDeep: 768:7oCwr6ClmmYBbDc3sqXi7ohCd8coGBI73WjcZx1hR/:F+5Y1Dc3f1hC5oGc32ETR/ 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CalendarToolIconImages.jpg.isolated 5.20 KB MD5: 63fc3e0d1a7a6e2446038762ebca3436
SHA1: 4720ac6e49712cddf8fa861b16e20f281ae430e8
SHA256: 305d3d836a5f42ed7f0392b64ad6c67834e575bd6da2e8e438afda22746ada0f
SSDeep: 96:ns0tVBlM0VUSCxAizBfFz3xBEJl8tPMFRpjuQM/NOMsc:1V4QCzBNzBWV9LbMsc 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CalendarToolIconImagesMask.bmp.isolated 1.30 KB MD5: 627d5a74bb51f9932b15747153fbc600
SHA1: 8bd343b921aae403976d9f8d29992f8321439128
SHA256: e81613bd29ea68050b4af7372113d148be925c966ae1946f739e8e7cd62076dc
SSDeep: 24:Bgjrh3nGHCKkaH+Lnvlfeo8+MsRC6hRMlBZALveyedy5AD2ougr9:Bgx3n0sam5eh+1jsBZQm05AD2oL 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImages.bmp.isolated 3.80 KB MD5: cd61e36e02265e6519fed0bc5f7d62af
SHA1: 847146e952523d2b7ccb76b160a25c99262ae04e
SHA256: b7ed2fe957a402791a46aee1b2f66a3a4b10f4f0f7e3f8345148aa0f93fe6181
SSDeep: 96:mhzj4CtgfBGciI7s13P8g9XqKqzbvz1eSus:mBj4lB5BGUFKIBeq 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImageMask.bmp.isolated 3.87 KB MD5: 3536e187a74c803710336d9135a41bcd
SHA1: 4ce5abebef04b7c931c01a337ab6b2e3f60803f2
SHA256: 40a229a0e7ada2b72fe7da5a14a5ccfeaa6462c425f61ed2fce509cad2f45004
SSDeep: 96:meX0jSBm03NDtEg0po0PNIYk02ej/1hE9:PkeP/j0iYkRezLE9 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImagesMask.bmp.isolated 1.76 KB MD5: 8de5a9d69ea002bfe2d717726221d3b5
SHA1: de6a677e36800b90a1094731d1db5d4aa4754b09
SHA256: dce7f409b488b8d34446b7ece7d47b10a6834864a873a95e72e5e852e51f748b
SSDeep: 24:pICgjrh3nGHCKkaH+Lnvlfeo8+MsRC6hRMlBZALveyedy5AD2o79wBCQVks9:lgx3n0sam5eh+1jsBZQm05AD2o79wJye 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImages.jpg.isolated 11.67 KB MD5: 2b643b4c179a30cc2ef9e3f98596b65f
SHA1: 170f65e3acbaeefa151f9f030004c64ef3aa4735
SHA256: d26e41174a024ec3c2615d1ef3537eec34a71f27c728691fb5167a9ea2211fa9
SSDeep: 192:7/67ObGyc5LH7mVcOHoiFtMDoyg48Y2uM:jz6LHaVNtMSLuM 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\InformationIconMask.bmp.isolated 2.05 KB MD5: e8c7866306d6dc7441ad69386c2f3ec6
SHA1: cea02dba186612adc3bf16c20acf31d5c31f9556
SHA256: ce5352b36bf775addb412d9ef7ee09aca0a3afd90fc37b8ffee8547e4c3ef358
SSDeep: 48:rcgx3n0sam5eh+1jsBZQm05AD2oTnaEEFu:nX0jSBm0aaEEFu 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\LoginDialogBackground.jpg.isolated 51.73 KB MD5: 84ac737cde03782372a0625df29820a2
SHA1: df9bd687f7e1fbb2ee605025e64aab2860fb093b
SHA256: a4dd9154e282f80d1c557947e6a73ed1353a7826c37f403d675f85dd55f50dd2
SSDeep: 1536:bwUa1/kmo68meWO9dgJ2drdrX/vnx5HCGU:UTeWuiMrF/vnnCx 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24Images.jpg.isolated 7.64 KB MD5: 4116328ca77a471fb022303ca0f0e5b7
SHA1: f49fec602fc3710f4d2c26fdd44ba688ab8b174c
SHA256: ae5dd49ecd429c08353c056f18d54dbc2d1d738a1e3d193524f6c83890911ff9
SSDeep: 192:PCbtMqoQ1sA4TYcOHoiFtMDoyg48Yrl4Rf10LjVQ:abtYQ15NtMSSj+ 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImages.jpg.isolated 9.47 KB MD5: aec542c15be27c46f970aedb6b31a436
SHA1: 574f3a70a5bcaf3613b1c20827627b75e840ba03
SHA256: a6e78ee5e550dde25b8dfaad1cc39dc0e10f74be584748bc3263c9a506784d4a
SSDeep: 96:LfY6qN6rlxtTN3D3xUmmyLRUsUfYNF7qWEtMEdQuIVFzAiRRL2Mpppp+JjdV79p:U6Q6rdTpymm6Lg/FcPS/LBb 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImagesMask.bmp.isolated 2.05 KB MD5: 6ed19eae9251cd5c0c065ca259239a13
SHA1: c720419ec8b4c09920c383a04d61d43626eb96ec
SHA256: 2f883efa3dfedb43937e2fce3efe4ca5344f8f20b96607dfbd17cce8e9a70c13
SSDeep: 48:ECgx3n0sam5eh+1jsBZQm05AD2oZYysSISz6u2G/lHPHglxN/PSZ:ERX0jSBm0/SXRdHvgDJ4 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageHistoryIconImages.jpg.isolated 8.74 KB MD5: 008deb8e07dac60b861d7fb571001d60
SHA1: 10bf9ca633374fd73c573dbe5e6e1538409be6eb
SHA256: eff9b28f397d1dd11ff716fca9f3bb9fa33888df35b25ed3ae83a76b5662e2d8
SSDeep: 96:1lgrlxtifRkVBSwfk1omqppppkYDfnPdezGoZxB6QLibQH/fS3XfZ:jgrdifRkH7fAomQheSnKfKnfZ 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageHistoryIconImagesMask.bmp.isolated 320 bytes MD5: d1a40dead8fec61afcbc233ec0c68c51
SHA1: 8fe5244aebcc5680004e603de9cb022c92af588a
SHA256: 08890313dfa4b6d84f9a8394584ec70665486e330849bb455c0a02a4caa8b7dd
SSDeep: 6:jXHFjgVtgzwcDjHj9E0Mj9E0Mj9E0KLgUXneHDhZxA/jtggJsOuSmN:jXHtgVt3uNMNMNaXneHbxCOgJsz 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackground.jpg.isolated 15.75 KB MD5: 29b09ff3d5e5f2c5d2191b0f7f4b9d55
SHA1: 7355c3b55adadd59f262c8d3ba3a8a0f364ba7a4
SHA256: ee97d228ac0c532cbfef9f39aae2e69269f437d13fb99d447ef1ce2a5cac8b49
SSDeep: 96:RSW1KbBkvpppppppppppppps3eUf9lU5mf5t+vaIffyQOZiwBYiVb:RS6KZX9gmDWyQO4+ 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierCloseButton.jpg.isolated 754 bytes MD5: 613a1cb8e9db065318b8a1d8c49da26c
SHA1: af638d21757ca8d3fefb5c13e76c6afc3e17c45f
SHA256: cf7e080b8d56baac17349fde605ff2a16e654c7f0912228f871b84e6c6c687f6
SSDeep: 12:QhUdl1FT1TrRAGllsshkYN8NIpbFfzutmpLN9Jjl2M379+NHVCI/:uyl1L5AGjNky8NIBFfzutmpLN9JsMLU/ 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierUpArrow.jpg.isolated 960 bytes MD5: 16229a8d3f90ec3067ef6e51d522440b
SHA1: 8a7a9588351928b08a59d37fb168c8529088d5d9
SHA256: 157f188934fd0bd9f740bd98983d135ea725ebf3b8698869ad8fbfec2e2d7aaf
SSDeep: 24:uy3S40L7HiLpp1fg73S3fsM+FZNQrklB5jLu:uiyeRo3y14NqY8 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImagesMask.bmp.isolated 6.30 KB MD5: 069190d847dbfd572af73c3290359d79
SHA1: d564071c5515e8e3885f9a4a6798922548ee557c
SHA256: e6190b600a0690803074e36bd5aae90d59ea29da776a350350fcfa16b4e0de57
SSDeep: 48:Aw3n0sam5eh+1jsBZQm05AD2oaqIJF5OpXvgOcti+mP+lBVBrO2kWIRwrAYHpdB:xX0jSBm0nqBvgOctTXBVB6pWAYHJ 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImages.jpg.isolated 3.89 KB MD5: 39995c17b1023075450fbe4564e64df5
SHA1: 921907a265912a53f20461490c510d02d3a3a45c
SHA256: 8ed648be810fa50968de7a53b502045dd2840f017956dfa2dee5c49075622eab
SSDeep: 96:Gscbhoq+YZLrq757il+Ty9IEYGu9mWsSe:Tcaq+aqNelseUsSe 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImagesMask.bmp.isolated 192 bytes MD5: 1dc14bd6df66cbac99d12798001a3cb5
SHA1: f866eb88ead47ca2030cd783db00c429cf346582
SHA256: 0baa6bf73d55d854be56925f324b0b51642d179197c4934a25e29f282d664de1
SSDeep: 3:uWnjgVwpc6yVBF6222V7oqsYuYpDC7NOkaSITUF/w46qWlX1FzqaoiX:ZnjgVu8jv77vYOkReqWN32a1X 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImagesMask.bmp.isolated 4.55 KB MD5: 44123d67638b4d1da20eebbef40609e2
SHA1: a3f402cdffd8adb3ce3c8f8a48d7200a76998e7e
SHA256: 6cd420aeec22f8758d3d59e394ba3036f916ed7e2fd78284a2e339c1d2b2ffaa
SSDeep: 48:XX3n0sam5eh+1jsBZQm05AD2ojvZRwBWK+SpTRyc6X3jjz6lBWfRuA8PxO0WDXhF:nX0jSBm00vZyBf+T5njjmUc1zWDj 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16ImagesMask.bmp.isolated 3.80 KB MD5: a2c7a5bfd97520d44816ad6ae605de6b
SHA1: 7a33c12fd702c9182fd84c5ca30e4b12e0c51af0
SHA256: 31d81ba5640e7b5a6a4f199d08dfc1fff331256044704e66fb70856daf6c67ae
SSDeep: 48:Za3n0sam5eh+1jsBZQm05AD2orfkq06o/cntBgLDJQ1teXCNMVncewH2Y2YtvKG:ZaX0jSBm0Gfkq06oItByKDIcPr2wn 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Shared24x24Images.jpg.isolated 6.35 KB MD5: 215653f0366cf7dd3d49b7005cb24082
SHA1: b89dfc77fe018b6508ba2f7326359de98d8adc76
SHA256: c9c6419ef4c2b4f2576b9bab62c11ebb6b6cf0e8c58a042cb43581dcfafb161d
SSDeep: 192:/qZ6W6S0cHb+VHT+f5RL7xFnHmA/UKH3+bY:/qZkSXHqgf5F7LnGA/B3+bY 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\SketchIconImages.bmp.isolated 11.30 KB MD5: a51b877035689af4f25423c0c4a4f6d5
SHA1: e03f4694083972804914c2a7398dfa62e4408754
SHA256: dbc08b545b8ab36cf89f536b4e324a60299095e9d40cebf593225004f1953d89
SSDeep: 192:gmg2vrm0y/a2U64wLAVDKr+vDX/dBFXkU2odq52NhDR4m+6rrgnSRR:gmg2rm0ya2U64cUDK6vDXlB9kU2ZOhDj 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\spacebackupiconsmask.bmp.isolated 1.41 KB MD5: 599a87f9f8154fa09fe40194efe63a1e
SHA1: 8accec74efdad401b7f135281b8758d47199cc0a
SHA256: fbca4b94e23450626b3d0dd65e508441095d820bdfdef9542c22b5d0495b324f
SSDeep: 24:/gjrh3nGHCKkaH+Lnvlfeo8+MsRC6hRMlBZALveyedy5AD2oJ6/JL7MyaQmx:/gx3n0sam5eh+1jsBZQm05AD2oQJL71C 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TipsImageMask.bmp.isolated 2.05 KB MD5: c618961c5c4d9922a312c213e37ff179
SHA1: 4eae64edb7c958eab7ec388dbe9a1992e20447a7
SHA256: 9ca599b510dfa26152bdb6ebada8c393c9a588af8b4d6b0794605986675c23e0
SSDeep: 48:rqI3n0sam5eh+1jsBZQm05AD2oN/YzGxPPf4469lkRVA2vT:XX0jSBm0Y/WGv446wk2b 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolIconImagesMask.bmp.isolated 5.30 KB MD5: 052390580c51d911eaccfbff57e5660e
SHA1: de259284e0e57933f6b1fcaef17be425f4fce751
SHA256: cee732066605f24c69bb7a6594116421ff2a79349a0218dbd4bbbf0707dac681
SSDeep: 96:f4X0jSBm0r9wc9YBW4+dP4m+mQsCFjoriLizy:f4kej9wsQW4+94zrsC8By 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImages.jpg.isolated 8.76 KB MD5: 00ecc7fe4ba65731c1c59579aa89b405
SHA1: 7dba50e7f3ad667ab874c12a451574edf35cbc71
SHA256: 86f848a5d9be92f5234e5cb0e6ad4760db4214a681f464cde3fcd1038c0f474b
SSDeep: 96:Kp6Y6qH8cGUfXME4eA6dC8D0pppp9NQBYaNdnPe:I/6YLRdC82NQB1e 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarToolIconImagesMask.bmp.isolated 3.05 KB MD5: 2f5fc56d3586cf6a4ed37e2d4466a412
SHA1: faae1c21e620f29bf2931540d8c8a4866f8e8c6a
SHA256: 63d1bc5fee44cffb47cb64d7c107ac148c527eed412a1efa2167297fab8d9e03
SSDeep: 48:503n0sam5eh+1jsBZQm05AD2oj8XHKvUWcDVfQgTA9TcVz:50X0jSBm04c 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_AutoMask.bmp.isolated 7.11 KB MD5: f601fdf20e881f33a40eb530e128ef14
SHA1: b7fe3df85c6179e476900991136072acbf7de9a3
SHA256: 71df3cf51969325dbbcce971e95ee3e1d0715630ffff7b1bab07f82998580f70
SSDeep: 48:XtL6XL6taaaaaaaaaaaailV+lV+lV+lV+lV+lV+lV+lV+lVf:XtiQaaaaaaaaaaaaSOOOOOOOOf 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactHighMask.bmp.isolated 7.11 KB MD5: bbd606e81e421879ad8cb957e87600ab
SHA1: 28c922cb87a83dbd96c9006a2c3c3ae1a0b78df4
SHA256: 115a82004610160bfc9ac1e25b5b5a03f4a7441fd1ccee40e6edfeb12c17e9b0
SSDeep: 48:kI3n0sam5eh+1jsBZQm05AD2odiup//HZpCFEEEEEEEEEEEEEEEEEEEWaq:ZX0jSBm0Kg 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLowMask.bmp.isolated 7.11 KB MD5: 3f827e7ec26bcde6ebb93986aee0201b
SHA1: 886fd7d18d16ca97b53008de5ed9a22db049f4ab
SHA256: f12b173a4ddf9c891fb9752d3ddba6120ee87ad8b089d15d90535e23e3c0527c
SSDeep: 48:kI3n0sam5eh+1jsBZQm05AD2ojEEEEEEEEEEEEEEEEEEEEEEEEEEWaq:ZX0jSBm0j 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHigh.jpg.isolated 18.01 KB MD5: 4181df855698cab23d3d3dae941872e0
SHA1: 23da30a1c9fb959e4f4fbde9cabca84d46a07b9a
SHA256: 369f5b55dea48aa57752aee6856601462dfdd5ed179e7dafda884a8b22d8be99
SSDeep: 96:/SW1KKFkvppppppppppppppKvpuoUBt/E+oiX7G32wi3APWFX+2ekGuG3LRNs79N:/S6VXu3BdfzA+k2fXYLR+G4P 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHighMask.bmp.isolated 7.11 KB MD5: a4ad82673657a37be5a3d780778fcc3a
SHA1: bf2ff4482256631d07aa7279013642ef6f96962c
SHA256: 980e99207d11d1ba87fb168d0d02186780add6be471a56694dabcb84b0ac960b
SSDeep: 48:X48dPlV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lVi:XFZOOOOOOOOOOOOOOOOi 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileOff.jpg.isolated 17.72 KB MD5: c4fc3cf9ad698936eb599526ff632c98
SHA1: d9b2fc97bf40978f1f2273db6c4c874f19845008
SHA256: 19d92136bd89fee05f348b25c01ca65fd421fd1c11d678d974cf8e4c6f956d23
SSDeep: 192:/S6HKSpmtgl62TY4zp8rA0X7LAxoiZmxpOyxo:/pHKUmYTYXiRZmxpOyxo 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileOffMask.bmp.isolated 7.11 KB MD5: 764f4a7cc31b0457ef67e29238dff822
SHA1: 1f4900b6316dd9bf9053027365a360d34b7ff2f3
SHA256: d2cf11e828c339cd7526938dbfebff9db0d184c858336a885cf6984018f04249
SSDeep: 48:X/lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lV+lF:X3OOOOOOOOOOOOOOOOOOOOOOOOOOOi 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_HighMask.bmp.isolated 7.11 KB MD5: dde19f9bd2bb1828e82c042dc5f33c0a
SHA1: ccf49c2294ca7fb36affe7b1a0c89c76de2bf071
SHA256: 8938e99aff6f2271477a8842c7ed683625e7919ebf727c18fe78bf99d4cf5d40
SSDeep: 48:XtL6XL6TaaaaaaaaailV+lV+lV+lV+lV+lV+lV+lV+lVf:XtiqaaaaaaaaaSOOOOOOOOf 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_MediumMAsk.bmp.isolated 7.11 KB MD5: 9d82f362a906ac9c56cabb139772cf49
SHA1: 88988cdde8eab66136d7825b9f7c41da4a1d8435
SHA256: 844e6188fa03e5aa02c72c68566e89e6f7309d5efebd7a25ca62f60a1721116a
SSDeep: 192:Xt6aaaaaaaaaaaaaaaaaaaaSOOOOOOOOf:XF 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Off.jpg.isolated 15.62 KB MD5: 6839d2f3e8ffac69227ff965addd12d8
SHA1: e8a36a7dcf6a03e79998c180bd68b08c11e78411
SHA256: 23eb9b7040d9350a7b5c8131157ca97afc5e63722d51e181d4524821a34a1f1c
SSDeep: 96:/SW1KK6kvpppppppppppppp6sAze4rE5rOzXfW4mjFoc00EvUpMiM0txZ:/S6KLsAorGXfWdjFntMiXtr 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImage.jpg.isolated 8.58 KB MD5: 5e2783319f08c08626d8e360b3d91c6b
SHA1: f42f08416118a3623b58a0a8dccc6314d1ac8cdd
SHA256: f362af1da9d5758dd8a07fc695f73f55d9593220625f51ec801c8abb1b83a3b8
SSDeep: 192:WB6n0f7tPZ9q7bBJ8G/SUWSBL/ajHOfDcZi+z:WBnfBZyr6/7OfDc8o 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMaskSmall.bmp.isolated 1.55 KB MD5: bba710331768649332aaf8f1a145fe19
SHA1: 3359d53c7edffa4d7a3768e1bae811b87e144909
SHA256: d83fcc3330c9a7db8ea460d2c7ee92210340f93e9daae20b252f7a91af52c678
SSDeep: 48:bTI3n0sam5eh+1jsBZQm05AD2oAgOfLlE:wX0jSBm0+ 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImagesMask.bmp.isolated 1.41 KB MD5: 364830a3fad745311d0554463666aea3
SHA1: 85e9b06347ad13c33f745e49a84dc16a45febecc
SHA256: ebac32015161a9ef3e8ba269ced95cbd8cdf76be440b22c7bf423b1ed9e81246
SSDeep: 24:nrh3nGHCKkaH+Lnvlfeo8+MsRC6hRMlBZALveyedy5AD2oCmtIsa+:t3n0sam5eh+1jsBZQm05AD2oCyL 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericonMask.bmp.isolated 2.05 KB MD5: 458e92a8e92fdf33d0868a92f9868e11
SHA1: 0d141f104abade7228ff99a938f393e9d7894ebe
SHA256: a3c4ff11923cc0d2c9409d3bea0cc668fe351a549b135754c5e81d5803f13ad5
SSDeep: 48:ECgx3n0sam5eh+1jsBZQm05AD2o9DbUmra:ERX0jSBm0sDbs 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\DiscussionToolIconImagesMask.bmp.isolated 5.80 KB MD5: c632d89d3efc91dd92f9b49ebc5c4c8b
SHA1: 6a0f7de4ff04a5e68f151fd7675d6cf2be404404
SHA256: 27e0231154a2ee8b93f06b7a0e85282244424c2ea35ba845d5f7259516d9d2d9
SSDeep: 48:d3n0sam5eh+1jsBZQm05AD2od0C0E3e0W0Hc53b1lITlmAp0eEOz7CCW1YGsamaJ:dX0jSBm0yl+D5l0Bp07OUqpe 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\WSSFilesToolHomePageBackground.jpg.isolated 42.77 KB MD5: f1d5c55232d575ac01ea5361f1b7bdb9
SHA1: 6049787e9aa6e25bf6bc8317966d9a19e0b41453
SHA256: e007e4805be2c391833b2323fdb11dcbc38fcfaf70882984149de4649281483a
SSDeep: 768:AWnxLE3Y4Lcja8P26BA++Kq0jDqyCKQ64yb+v7WzVuQFR3n4mxpy:AWxLE3Y4Lc/26Be0jmy1v4CfRRomxQ 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\BodyPaneBackground.jpg.isolated 2.43 KB MD5: efd9b26db21594a10f778f74458feea6
SHA1: d8be82217c9a3942bcac8797eaa9caf06d51bc80
SHA256: f272765a9b5ff5331bd9b4e063fd45843e170c8fd105e56e0a11b798e44fa40d
SSDeep: 24:pyoPRfdeQddtUpA1sf1EMV8jiE9cQWJexe6ZYd9l3D73ypCfndywN6Cc1CAKG89s:dPFhLLGfBQiE9vY6qis8WGKeKD8Yq 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\InactiveTabImage.jpg.isolated 9.23 KB MD5: 0f8fe9be686f1c5463e25e177611ed33
SHA1: 513e382b209e2f45adeaa209534f8a9d99c7fd72
SHA256: 9c218f9dcba486c919ae8a407d058c4ae948c5918bc8b5719ee17d51ba37092b
SSDeep: 96:FY6qyK8F3KIXZsQb45mf6+WXedTGWTv0M9sVz0MbOpW1ppppZd5S5jWHSIXt5:W6FK3IpsQ3f6NKz5dtkfXt5 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left_over.gif.isolated 1.03 KB MD5: c8b13596492f649bc14489bf45be98fd
SHA1: 44047545954b54d63e4b316d8afaca34fd2eaeba
SHA256: d8b74c88044f21955dc6497d330c26fb226f924a57d5db0987ad65c020b812d4
SSDeep: 24:PVdjfUgqXvlZMfTYO4824wJBRYPpWqBzR/h/Y4pVo0:t5UhfQfMF40/k9/Sl0 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid_over.gif.isolated 187 bytes MD5: 96009e502537ebafbbbd46699774c82d
SHA1: 97c83969cc40c2f14275fd8cab0920195de0fd3d
SHA256: fa2c3dc9f62a6f86128f31dd37e179214c488f3d4a95d22e1598bd6643d8e0bc
SSDeep: 3:NajMPO1dQDHLJq8jPzqHCE/fa3uzqrmqrmr1gK3pdc46w0TmjG1ySkvO4aDrS+e:QO99qyrAfaWMmMmr1LLc3w0ySPkm9S 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right.gif.isolated 622 bytes MD5: 62a633d311e0f09f3d0297bb3006a5d1
SHA1: 9e3339526fdc6f18d79fd0c80bd3e591e58e335e
SHA256: 2780eba5c0103ad67e81c13aed1b11e0973b4ca6c5aaf201bc259728d3ff5516
SSDeep: 12:PEE3Bncb9WYrf/S3qXOfH1rMJN3WNMWe002uCQ6Z1pFVy2H0VQ:Pjncb9WYry3PfH1MJN3WCb2uT6ZvnoK 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\Attachments.jpg.isolated 13.64 KB MD5: 72bd0fb58c52997d962d61555616624b
SHA1: 5902460428d56db118565d2807db203e2a19af24
SHA256: dcfb2d520664a01a06d07eacd90f2156cce55a9cf211c4a2a1a7f79647b0c733
SSDeep: 192:tjg683A2QJJQgrd6pOhvkHFfZ683A2QJJQE6tmQhoQ/Ms7D/dDRs:OnQTQju0nQTQEjQhb/vn/du 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DigitalInk.jpg.isolated 15.50 KB MD5: 496d62ddf57dd879c1c8ae14f43c8ca7
SHA1: 36e6335f61959ff16aec6d56a69165e7f3359821
SHA256: c80405baddabc04f3531d371eca81fe5565749e37a3cbea60d30d36874ec1e90
SSDeep: 192:7+68eJx93eBMv5QMwxXiRYM0IB6l4PyeJ00ugvrW32z/jJk:6eJCRMZRYEslkye60ugvrW3+jS 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePageStyle.css.isolated 1.01 KB MD5: afb9f517e2ff336e936e53f7c7597c30
SHA1: a9ab9f4a2d52fe028575e14c0ec9dbb0ab061377
SHA256: 6ff1c0b165b96e19e4c9964b1c6eb59a0926ac019712be4900f1f3e76cd9eec4
SSDeep: 24:8V/65qOnCWdwfz/A+A/7P2/OYJ9DjdI6+pbHmwh+aV:8p6sOCWOlse/pJ9MpbHrh9V 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormToolImages.jpg.isolated 7.00 KB MD5: b40296d6f5a528b831f8100effc064f2
SHA1: 691e2bcefa1499e277127f5359ca960c4749acbd
SHA256: 8c7fc526adc107c4e8641430d4ea98d11be633db9022ea939778a5c519a7fc73
SSDeep: 192:OngMwZ0QrJNO9GBC8va54IA6x+OrbzInxkYAzAX:1v0s3QGBCKa54IA6rbzInxkZAX 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\utilityfunctions.js.isolated 4.06 KB MD5: e2a3398c878f344e013a3cd91e1545e7
SHA1: cc339e4d38b0fd89e043d29abcf63b3a27185d07
SHA256: f6fba60249eb1ee5cf4d7328476d4e7b9b3dcc06d03219accb8d61cabeb40d17
SSDeep: 96:/utI4E1NHB8A844l+12MSU8XkEFUB6QfpJFudQ:/uOVBfkls2Mf0kEQ6myi 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\ViewHeaderPreview.jpg.isolated 3.37 KB MD5: 5aa1a7946018319bf0edfb4556b7f7d9
SHA1: 1bb9dd9e5c63ba63f6eff7aee0118b9d64f06621
SHA256: be6abbc3eac8b80d434ca7ead3413c276b409fdeba501224a2c11004ebfd625f
SSDeep: 48:0t+Vcyghh6nxHFeQXjOw1EweA/GZ2IXC1z0B35ffWmibcCyV16JLnZ:EscbhOxcAqWEoyC1z0BJffWPJyVS 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\viewSelectionChanged.js.isolated 206 bytes MD5: 6b880de8bf93ccb97bd20ef8646da90e
SHA1: a644abe7438c108eaa943d27fbd2cd6939673e3f
SHA256: 89e5c6ddc712a7f1ade00706ed980074a3f2d2d91ad29b4e397f869f89d7045d
SSDeep: 3:ovoBbr3HlA9lIVTUaK8+Fxn40E8Ssj7o3PQjmEesDRKcehcjhbnFP2jwiXzxzLmY:oqP3HlA9u+FvsoxUcLPEwijVLv 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePageSlice.gif.isolated 1.01 KB MD5: f10fedccd861b787df8050428a345194
SHA1: ec860a41d8dc0b373ab3e6fbb7861735357b8d43
SHA256: 29ed65e0358a86f527fbed4cb6d921a0419955d391e42c84acb35ee2982e62aa
SSDeep: 24:NNNuYwMRZaO+dd1dG/4nczkF0AcfzBYuC5kpjZvp+Sy4TlI:rJwMRQ9r0wnPOAcftZC5kplhZy4TlI 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_right_over.gif.isolated 580 bytes MD5: 74127c9a42ea824396dcf496ae59a880
SHA1: b1c460a142e430a85555a42ef3b8f767e145d57e
SHA256: 5e9c5216bd3ceb8d09c17fe7222fe5c8b99bed4769de565a91ba5677e13f9e08
SSDeep: 6:PRyJ/vDhUDDJgv1NEZTBJE6ViI0H11O7CK0n9lwMmMmMmMmMmMmMmMmMmMmMmMmX:PZDDJQ1+lBJEoH0V1O7P72YpV2WAVN2F 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange.css.isolated 3.34 KB MD5: f26511f21efde3d12c4ab2cb3c57b869
SHA1: b749406cdda067f9c6b068396b59ff30254f3b85
SHA256: 9db2b591ecdcebc3c2f7578ff420c79cb34698bca00de3c9e01f58c0741a845f
SSDeep: 48:0EyilKBXwhb732Bpw4mA7EgbfDKVXwmt+r1Kd7mQA9ilvqdiTWQ9Vd+Wo9Pe2:0E7KBAN73Ee4mA7vbKVXDc6kYlVEpPR 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow.css.isolated 3.18 KB MD5: 3a65936d650c0db54860865cf16e512a
SHA1: 1e53e36258675263b827bb0a47075c2a573c6e9d
SHA256: 6fad9ba75f2ddd3b6ba4e4c6f97eb1170247208e4c4d4d794a9bbf1d667639bc
SSDeep: 96:EXtgcFeUjX1IbzyHXgO8RNCE+k0QVeMUY6WuAN:ileUjXy48R8tk0Qg9Yv 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\000000000.key 15 bytes MD5: 29184efbb200aa4f1dafce5a40b53afb
SHA1: fc1d87d17cb2e0928d7828fef4350f7f157e6db6
SHA256: 1ca1392b1ec466fc0ece3accab5de07794ed6b608768804c0c424732a7e1d0ee
SSDeep: 3:UjtaT:/T 		False
...
C:\\@@_README_@@.txt 1.35 KB MD5: 039d0ace415c1f3a889cc88c507f19a9
SHA1: a29983ac89233a1ae78f3cfd1310baf2b6eba510
SHA256: 29ce312ae86bb2ef597fd281733535df68c2d10322ec7c1ccb00e933e146fcc8
SSDeep: 24:WF30GyaC6fNf12fdIZDiHES4SBFKCGLd0+PZEwc9ged1uc+1PViR02H:k0GyanfNtO1kuW/v6wcSJsf 		False
...
C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.isolated 1.53 KB MD5: 8c9339b2effbcc3552ff0a412c70a8cd
SHA1: da9e461b68a39314541c502d7c9d4418791c191c
SHA256: d23d11175f73f63896bf0d57788d4608638903e4a09c4340b15709c1efc06229
SSDeep: 48:XNA0f+BYS+31gX4TXXPW4T32LywgfewER/YMiSJJ:Xy0fwu+4zPW4algf6t4Sj 		False
...
C:\\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.isolated 1.42 KB MD5: 0247eade44bef9ade6b9f7529d2c1948
SHA1: 7fe420029df7e1d57616d26dba03567c0a9f0b92
SHA256: b5f55511092dd32dd83b160bfa98e40cbbaa1c9e538fd1a9a18981fc398cb142
SSDeep: 24:Ucar3djgZdepL1JuhGsfMQ1q/SIhQMl9LkzU55o/axKJg3F7vcaGRA:Xy3djgZdSL1JYMGq/AMjozQiSxmg95GW 		False
...
C:\\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.isolated 1.84 KB MD5: 237d2902636c7bee8a745e308d999eeb
SHA1: 734843db9c7072fc92836a940dc6cab7066b1f42
SHA256: 0b57daaa5510c4b20cfd875132741dc0932becbe69cd49d8419e121024c7b79d
SSDeep: 48:XsaZTdUoe7K7yAi7K7PvN9dJPIPevDKm9yP5juDvS8ibjQyLlzI:XsaTVSK7sK7nN9dBIPehcP5jGKHQYW 		False
...
C:\\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.isolated 1.57 KB MD5: 22ac3e08be675a7fae0067c2cc5747da
SHA1: 9ae01b9c22859525846ebde40469c855acc47863
SHA256: aed8d66f1be082ca45ef46bf38503fc0d47e71a52cd29122dcf472336def1f8f
SSDeep: 48:XeCXCYgUhDDJgUhy67piiMC17qTjY3TimiB2UL:Xe4gGDJgn67Z7qTjUOmiBhL 		False
...
C:\\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.isolated 3.11 KB MD5: 7a1153f04b5854f62b86804a455029ac
SHA1: 8735839e47e0d61b8cf4b9de1f7e6086b980eb4f
SHA256: b53f9f133715f3caca68b0cfc610d4288b0f487ca7187c1691e86af36fc9e730
SSDeep: 48:X4OQEiVJDiZg9l80IjGWrxALxuJMCohLhDzSz0vrBofgl+GPE+:X1im8K0FWaLxYohLhzSz0vqzGV 		False
...
C:\\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.isolated 4.11 KB MD5: ff24c41994ddabe78e1dc691babc4c8e
SHA1: 2d9d9141f852947df8e211db9b25e74d288f1266
SHA256: 3f7fa7ff839fd135f2370a7c8c29a54200de351192018ff1321f25c2d80f22f6
SSDeep: 96:XoRIFsSZx5tZliegk8TL+zk0wHll6sOj8QSPKjhyxXgtDyl7z:Y3m5tyeoTLH0RERPShiX6Dyl7z 		False
...
C:\\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.isolated 2.37 KB MD5: 15a4a9b40479406574d44395f2af1fcf
SHA1: b66b9d56d2f2970c8dfe79de99fff7e830b90a89
SHA256: 6f3503387e98e347ddedf69308978c964b2b8f94d3b547ba06eeb47cbd9469f1
SSDeep: 48:XfcW13YX7L1+OyMzRLonc6RpXg4MtfvPlDY41B0aLtVzVYz2UL:Xh3KR+Oy4Cn5RpdifvPlDYIlLehL 		False
...
C:\\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.isolated 1.42 KB MD5: 077f771a9c3e4a8a8cd2fbf17055db87
SHA1: 9271e13a42deb938eacd7df2aacb30799b2906d9
SHA256: ce367db4b9080023ea2a28f87b6e8b21dc0dc2044646e8fde3c9460434783082
SSDeep: 24:UcafNYSczy7JMZojAKIs/czjpuczSRkgesxHSEpbdSR/L5o/aVroJV6YzPCPgWxU:XPSLjmBdYesxH5pbER/LiSdoeYjAgWxU 		False
...
C:\\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.isolated 1.42 KB MD5: 830fb3e2fc06e5116c0f67010190df14
SHA1: dc3c175e0a7f0428fa3f9af0d0f43957f3afd6a2
SHA256: f59f22164eaa3cc3895f7555d029ca2b8009f9ba24753058f4670ff48c14b72e
SSDeep: 24:Ucaef+BdDsMT5AWREjdSM/8vcuVZyIAnPrPWZSr5L5o/aaSr:XsYy5UjELTVvAnyZ+LiSaq 		False
...
C:\\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.isolated 5.75 KB MD5: 8979086e199f08ef20818f378e4fa04a
SHA1: ee5078377cbc285e7bf04076dbe0f35fc96ccd2a
SHA256: bc0e5e6f253d6b8b8813bdd2b9df8afbda406b60628fad24ebcd4167db75bf0a
SSDeep: 96:XVndI5k18u5L43JSb1LLMlwcrlDOiQigk8MUSpM9rIn5U0wx//RXViQnwF:ZdI+vpVrPioZZ0wx//jgF 		False
...
C:\\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.isolated 1.20 KB MD5: 810c4e847f295cc23fd1d80b96094b33
SHA1: 1d924ce548b9742d9a1d87e4cac5aef2ab3b9abc
SHA256: bd0a579ee4b783d898d1eb6f43b12712def27a6286d111b80eb9871b9f8e3105
SSDeep: 24:UcadzKFfXOtNiKEZiwK6XBMVRgM/fiaYOJdx1suJFpTiqS+s2wQm1Q5YM5o/5v:XkCv/KEi0xMVRBzsmpTdsgm1gYMip 		False
...
C:\\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.isolated 9.28 KB MD5: 4f51ba872243219c4d7070ae8ec979ef
SHA1: 405496c6e44d4bcf02cd423a2091e8a398f2cb0b
SHA256: fbcde499801b9a2047e276ae56fa42fd8fedab2c5697ab5e97be806422338e64
SSDeep: 96:XKpBinjKDP/N4ABMteU1YcwOKuNzr26AWwS7yjDSQ7NKt4SXfaxO7KxLSCRNao0U:mJDP/NmegZ6cRCMhkChTztU 		False
...
C:\\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.isolated 1.94 KB MD5: b192d9c544468d4637a6ccf2ac1152b6
SHA1: 50556addb5b9ebf081c4a16b0d02553a729d4b09
SHA256: a5f44a8ff849fbd7cd0714e07a22974908b86063261e6ee7132871c588c09014
SSDeep: 48:XlhmMx/+4wGUsEXZ8g5+sF7lT6w1XgrKzkQlCV3yOF:XVW4wsSZT5+sFL9kQcpF 		False
...
C:\\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.isolated 1.83 KB MD5: eba55439b2310ae92d9e9c8da06e2312
SHA1: a175e21a7376279906a9b4db752e3669c5039ba8
SHA256: adbffd800ec4ff053a10cfef0d3f2d6e2ad101dfe74a513967fb4a3c7bd5e8d3
SSDeep: 48:X+rhmi9dDQcUsEXZms3sFGJBqE9lGKi01/MhYeG42UL:XIZQfsSZmpFcBqE9lG1gn4hL 		False
...
C:\\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.isolated 1.42 KB MD5: f68f19432d8191bf7e148b4e41d82165
SHA1: fb487e96bb910a398365ad107926a8c377db37e6
SHA256: 980c5d303e61c8df244ec365a077de4bf1a7557a753544b868b43b91cd384038
SSDeep: 24:UcaJAPncpNGU2e7K7y3wmXV7K7PpqILkHw3v6m8OdzamypMeCZXO4PTZh2VpOow:XBfQNoe7K7yAi7K7PIgk8v6m8Szam6MF 		False
...
C:\\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.isolated 582.36 KB MD5: e07358ce4d8369ef26b90065409d73fd
SHA1: 09c13840b3465c009784a7f2dd20d989151205ed
SHA256: 485f25205fb4c69b7a1a89b6f77e367dcbe7ffea1e37e22ce61f69e00cac88ef
SSDeep: 12288:ociNlZDgzFq1Mwj0GibKiZDOOg/Q+Lr1Mwj0GibKyVZDOOgIWkOLlCXl7U3YsjdZ:CNlZDWq1Mwj0GibKiZDQYSr1Mwj0Gibk 		False
...
C:\\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.isolated 5.43 KB MD5: e0419b015e480cec5403215af6e37f4f
SHA1: d7ec2e38fdf822dca1bcbbb36ba21500ff7424a1
SHA256: 2872a0bf41db8e328b8ab768a1dd9c5aa90146eb5cef60f35b9f0b29cedfacf1
SSDeep: 96:X2ph/7dwSx5t3VlghqFYFH8F3tOaTP4BoJON+0QuNfy+ikl9bnQh:mpR/hohUIaglb5Qh 		False
...
C:\\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.isolated 9.13 KB MD5: abc4a9a9f65d71d6046c5930fe33f7cb
SHA1: 2d909e0e868752a6304e568dbc8ff43751e57a81
SHA256: 078d858364b7727620711d703b85f7d117299baf020ff78f66e482d075c6498f
SSDeep: 192:movSKIKGDo2cOD7ZAoCOaqQrLdp5Nqogw4iGc5HrHukVe4dbljueL:movAsjrLHzqonxukTjueL 		False
...
C:\\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.isolated 2.56 KB MD5: 25953b154b7625bdfa73618a08bdf52c
SHA1: 968ba7228f8cdf16e0d5010b4f2b49c1af4524fb
SHA256: cbb45e6f46642ed5fdddf68cac61b043722832edae0eecfd146cb5dbfdfc477e
SSDeep: 48:Xio3bY6zffe7K7yAi7K7Pzgk8z1MEy/rfPGkkezviqbP6Y5G1DJ4aMB2UL:XDSK7sK77gk85ML/rfPGkZvNvk4BBhL 		False
...
C:\\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.isolated 4.17 KB MD5: 7cd35d26aedd0d6b42cef03f8baa460d
SHA1: 28034b50d0d3bb2eb8eb2f637b9680fb042fe7c0
SHA256: a1109b79d9477b0949b87bda7be50afc98563edda76f306a0521f5e72d0cf5b5
SSDeep: 96:XTYzKxXuSeQgdqfQAVo9mLvASUd/1Tl97ZOle67Zmyf4grGNEBi/:jb3ikLuhZl97Zcm04Lao/ 		False
...
C:\\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.isolated 16.46 KB MD5: ce16cd1af6211c4e8b10363392f9f2ed
SHA1: 1b97aaa8dc832d29e0b24b35907173c96441931d
SHA256: d67fa6ce0a80e58605b81f99547089115f6184c4cd50052e7e9d546bc7905f25
SSDeep: 192:US3/FXE4270JRb2ToZrrZUaowKQ3le56b7J23HiNLWo3aIVKUapyn:US3/V928Rb2TkrHowRh3sYLV3a3UVn 		False
...
C:\\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.isolated 30.37 KB MD5: 25ef849a0c5cab4a2fed5ea547e09f13
SHA1: 9c340679e1194d17acd8cdcffc1691375676036f
SHA256: 00e8070fefb70f87644e021b5a8d0c76181fb501b247ae0606774ee648578823
SSDeep: 384:zcDkE+vMWPvvAygoh1NefplhLhFK5RAmank4BbLw6JSgf1mW:rH3Pvv+M01g8pS61B 		False
...
C:\\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.isolated 6.27 KB MD5: 4a62c2c056c6b2d4ff7cee568ec2e12d
SHA1: 0fa87fc5f39c08c78b64b28e70578d7255edd5b2
SHA256: cf32b7379ed0cc31086cd60b2290e198874c30a0735d7073bb0305c728e78ee0
SSDeep: 96:XduuKCbUAI80e9DPOQqgVhBwT2rKpUZ7l2h4ZMRhzkzmNrEFdDSlR6M3HDLfYee1:tubvoJ3HiGgVwmiuCM3XwlX 		False
...
C:\\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.isolated 8.52 KB MD5: f09923e817d76d37bac36d789202e5a0
SHA1: 061381aa45f672c99865cd38f0dab3d45fd4b0db
SHA256: a2166d9c60e8939bb7b183cbb215cfe5654cd8989530cfd8428c344f9d73e7e0
SSDeep: 192:6kbwLwZF91rBauMbsUQsqwKb22iq4/RmK:JdF9jX7FW3 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Angles.xml.isolated 925 bytes MD5: 374492ed37535491488b78898fcc5893
SHA1: f5ca69d7d366ad5a40c40a3071e2e628455dcdf1
SHA256: a78363f1f1951f6acda05cac6ca92cea9cfb97ccee0415357bde3c06115fb889
SSDeep: 24:UqFuBSWQUBwfHiP1WmoK44b69DTaSzP1GVEHNWbmZ:bFTYaCTH44bEnaSzzHgbo 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Apex.xml.isolated 959 bytes MD5: dd3917cb64d1d7dad773209bef447251
SHA1: 5d5c178992f9235af3eba28d1ff9badac5bd2b5a
SHA256: d59a2130bdae459a5d6606df80c47c8d03b2f95e3ccf8ed045892a115c75f4e0
SSDeep: 24:UqFuBrQmkS0ZEuwwBwySm2P16NmUJoYI3cT7:bFkQmkdwTZAmOoYI3O7 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Aspect.xml.isolated 961 bytes MD5: e8e8637f638a64f5aab5ec854582309a
SHA1: e13f5fe8fd0b0243b0d940b6a198d46fce98daf6
SHA256: 3a3665f331a57cf0f05fbb299cad78154169995e0a0bf964c83c7533491575d0
SSDeep: 24:UqFuB1dzU4dTbrmUPuxiP1UcP1qZ60H8YVkwP117WlP1auTS:bFUd4KOeuICcOLH5kw3k06S 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Austin.xml.isolated 961 bytes MD5: 2811ac457fe6cb2911c490e61b7f249c
SHA1: 1a17c2a38c390b834a3a7a19217a69817f8e3903
SHA256: 0a6524e64c50a35428ae6dcf76381066319915df6b97f853bfecaa2c6bc8dc6b
SSDeep: 24:UqFuBV1GtU4dTbrmUCiP1MdKcP1FZGZ+50MP9xte6wP1vWlP19Zur:bFs9KOiFcvZM+CMHwivZa 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Black Tie.xml.isolated 927 bytes MD5: 394070a65b903b23c56914b40016d2c4
SHA1: bf25fb02d6472a7416d467d875f64d71f2d57809
SHA256: fa4019778e24dc4900f03eda132eacf046c13d447becbaa95dfa03f2e5889d58
SSDeep: 24:UqFuBQ7T2P1ncFwyCBLIeLoy2P1HVtmmlFiztStT7:bFBT2lcwyo9LoPtXmmCztc7 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Civic.xml.isolated 960 bytes MD5: 3495cf31b898016712cc2337cf04430b
SHA1: 2e703c1490613f4afc98fb3ed583fb6ee4255f5f
SHA256: e456a3f335cf9ed4bb4f3b0f4b5f10dced21ac8313d2a367f63dc4db7fb55bf3
SSDeep: 24:UqFuBYUpDeZv3zqNSo67jfefHL8OiP1q5Wmq:bFC9WGNSo6HefHoLn3 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Clarity.xml.isolated 926 bytes MD5: 232c4da0cdca050390835a765b23680f
SHA1: d24f3f8a25c913899a0d9e137ac305a16d10e0d4
SHA256: 80f3f74fd9731c0491f7dbb5fd217965fcc383aa1ae3851c7b23aabe1f9773d4
SSDeep: 24:UqFuBo+gn6cRZNyqyff26f9N3KydfRkHXr8wWv8gEm42S8MhRvPgB0c:bFPhZ2Dsy5RrvSj/8aXg/ 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Composite.xml.isolated 964 bytes MD5: 099d30cc2e1824fadc0cc79137f9d011
SHA1: 82780ae05037019b2a82d929366724cebfba8b58
SHA256: 282a311e2c5e390f561996cec08a88894989b65c7dfb553b2fb2c3176b1055d5
SSDeep: 24:UqFuBX1NNvDQhHJr070EbpG8mpYY0m+9N02E10bu/5:bFs1zvDQQDbpG7TiOd1Eu/5 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Couture.xml.isolated 962 bytes MD5: da384e68048f544106905e1de357c19c
SHA1: 19028bfb4f0f463281da6e04ef70329b4185b78e
SHA256: 7bcae94aeb188c4d7f76be6b05b5ebe0926a261fc5d20790ff5061172da59d82
SSDeep: 24:UqFuBH+EIn6cRsLM5SHjTkg9QTr6l03CVCzXvZSdpfpuTJfzcXe5E:bF9EIhsLM5oTkHHztzXkjfMTBoR 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Elemental.xml.isolated 964 bytes MD5: 6c221bb3113a2d1ff372d70c4f93be8c
SHA1: bde381a0c9accd3f2b989f366b32c0ad68eaca54
SHA256: 061577a398d9296a7d61c09f67363e68d19859cc31ff98f1f0fa6ea4298e6e35
SSDeep: 24:UqFuBnvDQhHJr070UQHG8mlUfnXm+9A2UB/lr:bFovDQQOHGHUPWiANB/lr 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Equity.xml.isolated 961 bytes MD5: 946beba503e1e4fc5432ab72e129f844
SHA1: a551bccf0c8aaf3ce623c0a2bc22a22e6df8e083
SHA256: e95a8b4472e99d35b0be68c8b6be70f4818a3108b636834a7a25d95657f86a74
SSDeep: 24:UqFuBvLxZU4dTbrmUIZiP1iwcP1fZ50O8tBewP1udlP1Rdguq:bFKKKOtw8wc/CZ/ewIvbdgf 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Essential.xml.isolated 928 bytes MD5: f692d67ba9af7da57897b68d635cf791
SHA1: 87ad7253bab35f92261200ae43476cd8b78bd858
SHA256: 16755c259904e495a9426e065ce5ff7dc934629377c9c7cfc9096eee4eb67dc2
SSDeep: 24:UqFuBIvDQmxkwUvXyqDLW7JIFAOXxH4sOiP1J5Wmq:bFzvDQMMLnWtI9XxHrLo3 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Flow.xml.isolated 959 bytes MD5: cfe6a9cd39493d02558609952111b4fc
SHA1: b8ed13a5ea4d3dbb0879c80c76f9e0426f00603c
SHA256: d250be4ff453886b70939d6bc5813a9941d2edf8a9f99265982ea0953692e75c
SSDeep: 24:UqFuBSS0ZEuw66ayB7RH7q2P1Lv5PmvJodt15NT7:bF9dwiCRbfPmhodt15p7 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Foundry.xml.isolated 962 bytes MD5: 44976b23bbcc7d250be5d8d5731c9ee8
SHA1: 0718ae4b7ba88380462494b87a65965a8ff758eb
SHA256: 47efc610c1916f2268be7beeb4767e941b4a5d72a3456eb759edb196358b3e5c
SSDeep: 24:UqFuBBn6cRsLM5SHjPg3dFQMl0JZ5z8vwSdwTJfWRi5E:bFChsLM5oPqw7z8veTBWRV 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Grayscale.xml.isolated 928 bytes MD5: 3956251110e69065ad674aa06b4ec765
SHA1: 8a902e369a9878517674178526320c6ec7e6f546
SHA256: c28ef2a0a3cbb944e87ef686f0ec262393d9cd617e7d301a44f4acacc76e82ce
SSDeep: 24:UB37TrU/cjm+wj7g6QYl0Bo9gzjv0SdVTJf2PH5N:CTwEjm57MzzjD3TB+ 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Grid.xml.isolated 959 bytes MD5: 041648859d4d3427254fa13493ad4f8d
SHA1: 18b9fac4c85e49d72017ab1f65b353b260189751
SHA256: 7d7d4441c7697a4a97ae0cc60f57e667244519281f54c6d99c8dfea7b6c2bca9
SSDeep: 24:UqFuBkCS0ZEuw1BS9BqK2P1YrFDPm3aI9JeT7:bFXCdw1X3SNPmKI9JA7 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Hardcover.xml.isolated 964 bytes MD5: c51ab38e53b017ee2130f75238a30476
SHA1: f0e67dbeacd0d3f0da5d477e1eacc4467fc3037b
SHA256: b29023258083e9b56ce0bced357498a93a528a1c8b7e91701da319e69ad73f6a
SSDeep: 24:UqFuBiPsvDQhHJr070xrSG8mGKWKSm+9HI27fpKo/oYGE:bFvsvDQQKOGEKDioep//FGE 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Median.xml.isolated 961 bytes MD5: 49bc01a407f2579b75ded71522696837
SHA1: 46735834051981a80794d432dae7b08072fe9f35
SHA256: 44c34c95813538b1a1ce7cd7a07cd42391309d33ccb420fd7542766e2060d03f
SSDeep: 24:UqFuBuU4dTbrmUyyiP1nRcP1mZ1g0jjOIwP1glP1Bguv:bF4KOFXbc61ljjzwgUu 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Metro.xml.isolated 960 bytes MD5: 2af431b6781ed38c69002f11ee2e9b6d
SHA1: 4d266554e56b7113de22a5bb4a93f548f2baf006
SHA256: d157c86d9a32875468272d1c25665d677956c8afbffeccd92f5632738e249c43
SSDeep: 24:UqFuBsupDeJvaySqxdR7gXxAfCvHIOiP1Ea5Wmq:bFs9SjxdREUsHILiN3 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Module.xml.isolated 961 bytes MD5: 37ffff9d0fe525d2268de6577855debb
SHA1: b644025743d8e5be952368e52c21588b14018e08
SHA256: c8a4a92095ff1067925895053eeaf55ee63b7feebed4507de9891ab9bb932548
SSDeep: 24:UqFuBkU4dTbrmU5iP13MkcP1JZoT06xSIwP1dWlP1qMuE:bFSKOplPc9o4BIwQrN 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Newsprint.xml.isolated 964 bytes MD5: f20a1712c4cf0c7edb3d92821c9344df
SHA1: ab09a9bf31a09c02556223371d66bb59cc7f129e
SHA256: 5a76dc3b36d4fd6346b84c408cd6b338d213a752ad649f9174804ad294f3b373
SSDeep: 24:UqFuBD2vDQhHJr0704FG8m/t/6m+992dQ7/ZcO:bFFvDQQxFGL1i9kw/ZcO 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Oriel.xml.isolated 960 bytes MD5: 3aef6a5b52c65f8f26012ddb995a2b97
SHA1: ddab6c94d91eca8ea569d5e64a87d540a1b512a2
SHA256: be7a314bf5fba12d2f05d1b69a000b065b53aba73d0f4a7c76abb7981d6c063c
SSDeep: 24:UqFuB6/VpDe4vNqUPX71vWV9SHchOiP11w25Wmq:bFN9bY0XRuV9SHyLc3 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Origin.xml.isolated 961 bytes MD5: b2f9816616ec830341f8908d2ce9ab1e
SHA1: 55ff6acafd4288b4ee003c69a248a69a34551b8e
SHA256: bc7476e6af02c93bf3baf2bf72a54002e17bd75fc4cdec8234e65258b9f0deb1
SSDeep: 24:UqFuBsU4dTbrmUDbiP1Vt7KcP1M1Zt/0PSwP1NlP12uA:bFGKOOOntKcotM6whA5 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Paper.xml.isolated 960 bytes MD5: 105bdb96cc6b74b40916b4a5fc02dc08
SHA1: 434d8abb270bcefaa61573d3cbfd990d182ed6d0
SHA256: 367a6312a04a58175fa270fde1435f28a5f3d0c60f556532caec213ee634c939
SSDeep: 24:UqFuBTpDeSfvnqXi7UDRyq+HeOiP1k5Wmq:bFc9HnqXiAoq+HeLp3 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Perspective.xml.isolated 966 bytes MD5: 19d5158ad6e80d7b35b75260dc6ccf8a
SHA1: 84ca901e5ba65739788b68146f5a667928cf9f65
SHA256: c29b9e19880cd5d5c2495ceeb72441d159f955594ca5474296242b4cfbc8a898
SSDeep: 24:UqFuBVBwRvvNfRDmyN3KfDdfRHXH8wW8gEmjcuFMhRRC0c:bF2mR5RSysb5RUSBGaR2 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Pushpin.xml.isolated 962 bytes MD5: b99014da66f3f6ddaa9667a5dd451b1f
SHA1: 22b8c5ac1186037795dc804a5e86aedd5a6ae4c3
SHA256: 5a61d5a61ce689524d3053ca069d4082fe1bec5bbb704d55768e12b074c76553
SSDeep: 24:UqFuBFn6cRsLM5SHjKguFQsTl0jfF3zPMvW45SdjTJfIi5E:bF6hsLM5oKmbzke5TBI 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Slipstream.xml.isolated 965 bytes MD5: 4035dc2e10615a1dbee3c425c77f141b
SHA1: bf8027a6ace5bb9bd690a013040c82e27820c94c
SHA256: f0c22a5ac3fc9cfbc24303afe5c29dd4bdb201100418869236e556e3d1ae12f4
SSDeep: 24:UqFuBndWBfHH6HAkKJ+69woB0azP1TICVUwscwUQvZ:bFauf7J+EwoCazKHwscwUQx 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Solstice.xml.isolated 963 bytes MD5: 0ec1c1001d7b3be41b7eb0293c95f77f
SHA1: 73271556588ba8277ddf6ef5d908ffce6a2f5dab
SHA256: 09439076331d7286f081f616edc4996b5064d19c99e3950a2d95ab752aef2137
SSDeep: 24:UqFuBn7Tr7fjJP8P1In4JP1+2bEBz+iP1VbvowXhe:bFUT3jh8yqs2YJ+i/oD 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Thatch.xml.isolated 961 bytes MD5: 2e4974721616828ac73f9bf5ab2f5232
SHA1: 2f84d85e324b2c8a72787282b8528b8b44cce935
SHA256: 43476754120303fa6e61f6d7fc435206831995e4a038299e34ecf77be76f2685
SSDeep: 24:UqFuBL6wU4dTbrmUIkiP14rcP1gwZZ0Y3wP1E5lP1wuG:bFm6BKOVurcamiAweWf 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Trek.xml.isolated 959 bytes MD5: 90f9627752aedb2dfedea254c29ed7ce
SHA1: 18777d990df6fd54baf2abf21d91a68deb20e735
SHA256: 2415849f2f5be2783b91714a5e406bb6a5a76abca9471bdbc51a8e1e68055914
SSDeep: 24:UqFuB8S0ZEuwLFjBu4BgoB2P1fRwmeHN+JmoYsT7:bFDdwLy2gosEmU+JmoY+7 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Waveform.xml.isolated 963 bytes MD5: 9c7c0543e0f86eb66c700ed2aa5e7f40
SHA1: 2e046f3aa526627ad6a94477aa54695002d29c57
SHA256: fd3fc63cac2f26d7521ea19cad01a40a07711ab5dd99f2750e3d702af79341b9
SSDeep: 24:UqFuBq7Tr7fjJP8P1LxudP1g+tFz4o9iP1FAsOiYhe:bFXT3jh8J4m+tF4o9issOiP 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Angles.xml.isolated 3.54 KB MD5: eb52e338d037a4a46f98e837d0cd5796
SHA1: 8b3ad7bf55131229d920c1175958bdefc03b2127
SHA256: 445ea22d0dd69dc9bb0c5068827adbc09c6792efc297ca6f77cb8f8f929c7fdf
SSDeep: 96:5ilKge+ogxpqouNjkWaH42KSKm+WdyjRt2M2Nq92BJRczCvmgyLI40q1WFg:od3GN0H4F3TWMVt2M2Nq9GHmvk40Vg 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Apex.xml.isolated 3.73 KB MD5: c95e41cf6bf13ba7f35f41d1c88d3680
SHA1: f32053aefb5e73f50a8510f0fbfa929cf62155f1
SHA256: e8170023f0a5f7bf65ec7f4613cb44c21b5c5d5df552b9e979f8538794bd7ef1
SSDeep: 96:5x2Hj1QTQT1K1eDjrEV8cNqd16R9fYix35KasUPGKFRJ3odQqd16R9WWG:+HJQTQT50OcNqORCit2oGKFRJ3odQqOq 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Apothecary.xml.isolated 3.53 KB MD5: 8032f711902001e6032746192f73f46b
SHA1: 7c2d3c82a31a9e42ebf6b8f4a54bca13b7474e72
SHA256: e5bc8dac107af6eebe72dde388984f777910b19269472cc6a209af101f4ad41c
SSDeep: 96:5YiKZK8OSGdF5h9qouNjkWaH42KSKmmm+IkoApSdJh14miYZBow5pXQky:ptTGN0H4F3Z4koApk4mPBoUuky 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Civic.xml.isolated 3.53 KB MD5: 9f2c9fa6dec4a43b1addcbeaaacd278c
SHA1: 91cbb8e2aab373758c1e9225cb61280c65e4677a
SHA256: d179009c9b5976106b72b3450abe354061fa6fbbce1a119f8c0286ce110031d2
SSDeep: 96:5HsV8wFQDQKsItPYSzMSuJnCBQEmMstqvOVs1HV8cua4miYZBow5pXQA:ZsV8wFQDQKMaMSuJ8QEPyqvOO5Ocua4O 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Clarity.xml.isolated 3.51 KB MD5: cd95d456d7de044ecc96f4104aba76cc
SHA1: 549c4197671dd7f0acab483bd3b38e2cdfac80fd
SHA256: edbca7ff88681501a2edb7dca49f164a8f63a623ec72cc6cae6cb978a886599d
SSDeep: 96:5QiQJmXqNq92BJkCVYVTeb+axRsTSfDVIBpxkQSPuVSqH3Wjyas7cvbiMr5:miQJmaNq9GkCKHRAD0bNbSqHGjtQ2iU5 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Concourse.xml.isolated 3.44 KB MD5: e22d3eaefb360a86400365aa6774499f
SHA1: 5669cc4435f28d1a9d03e130a4692cd2256045d7
SHA256: 662c9d4bc66b3b8323eaa94279bff86bda343fa10f78869d785b3da352712c38
SSDeep: 96:54A6VnqNq92BJkCVYVTeb+axRsTSfVIBcu/ery8gxpqouNjkWaH42KSKm7WG:OA6VqNq9GkCKHRA0c8GN0H4F3SWG 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Elemental.xml.isolated 3.57 KB MD5: 67f4b1c771517a39dded70ddfd271bea
SHA1: ced61f638a9b9637323201c16715591881dd767a
SHA256: 1ed72166fa7ea3ee76997e5cb39a07094601b541f73b9d1bbe732bf50d918765
SSDeep: 96:5MAzI8XCGKF4SjQSPuVdPYSzMSuJnCB+FRaPYFHh9qouNjkWaH42KSKmmmR:CAzTXCGKF4TbCaMSuJ8cRMYJGN0H4F3O 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Foundry.xml.isolated 3.71 KB MD5: 2ef00dcdcc96f4caf548d587432acf0c
SHA1: 10f54c832e31c06835832295f0b66cf53ee4687d
SHA256: 880c21e462b550156e02cbd50f3a8313383b1b64b396117ec152bbbb54ffa2b9
SSDeep: 96:51TN3Ij1/pOqv7oSG9V8cua4miYZBow5pXQdYix35N8+1znsO42BJRczCvmgyLI+:3RIJcqv7oNOcua4mPBoUuuito+eO4GHO 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Grid.xml.isolated 3.59 KB MD5: a2f601b836a6b66b7aa4af1a2a0467cb
SHA1: 20f00694256fb8e45993628d619717bb4cf54cb7
SHA256: b67f9d911d7ef6e0fb8b6031abc8129d8c144bdea0d10daf2de1748f2fccaefc
SSDeep: 96:5bC2w8P2sqIWq3oYrxwWc/kuFmWZf/McjV8cNqd16R9VVIm:d1rP2vIZ3oYNFLcZf/fOcNqORDF 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Metro.xml.isolated 3.52 KB MD5: 24534ea1d559863eab6bb285a0e41886
SHA1: 2364d80660c322022ef0fd6e5e08c1b75aaffb82
SHA256: 48d5950f185f9deaf47031bf6585238c9e0e959adc7c0460d1cad64b47d6f082
SSDeep: 96:5c9DbvJajJh14miYZBow5pXQ5Wf2qpzHL3/NLlfczCvmgyLI40q1CJOl:69DT8F4mPBoUu5W5zHLVLllmvk407JOl 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office 2.xml.isolated 3.52 KB MD5: 56e87cf39261dd3e6bc9448708758bfb
SHA1: 68e31706e57645c233ccbc367d882d190703bf26
SHA256: 5886691977f8eee5b25362024c40f141559fd2ada7a39fa166d913d3adf6b2c9
SSDeep: 96:5uiNjRV1bh14miYZBow5pXQ5Wa8eqpxVs1HV8cua4miYZBow5pXQR:IiNV/f4mPBoUu5W9pxO5Ocua4mPBoUuR 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic.xml.isolated 3.53 KB MD5: e7b9cdfa9a08512329d5ecf2ac380cc8
SHA1: 11dce759936f64fbc75c78ac319b4c2ed4464500
SHA256: 1ae9fd22885f159cc044bc0916d430893ae5efd2032bf1678bdae589256bb18b
SSDeep: 96:5vgbqNq92BJkCVYVTeb+axRsTSfDVIB62+JJOSpbQSPuVdPYSzMSuJnCB+Fx:3Nq9GkCKHRAD062+JwxbCaMSuJ8cx 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Opulent.xml.isolated 3.53 KB MD5: 2062d6d0c3ecf898dcaf8d10fbae38b8
SHA1: 7a1d84987b3cf87f0d3bfc596aa67b3ccc2b948c
SHA256: 741aa9422e3632b4e7e00593dc4a32a082f553fd50968848851e4e32bd0ac9f8
SSDeep: 96:5BGTNknRxsItPYSzMSuJnCBZVIB68D24qh14miYZBow5pXQdYixB:zGURxMaMSuJ8Z0dD24K4mPBoUuuij 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Paper.xml.isolated 3.54 KB MD5: d8824c29462ed682aed62df3196cb4cd
SHA1: 855abc3501ee8b6034b20fc78c1e47cee9ff10cd
SHA256: 489fd68c959feff60596ed85bd9b5ef9c5d9c249b19b17309d6372e70d262cc4
SSDeep: 96:5gHTjRlKaOhF4SjQSPuVdPYSzMSuJnCB+FRaFOFSpg2BJRczCvmgyLI40q1sSYpa:mHTVuF4TbCaMSuJ8cRfFHGHmvk40nNa 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Pushpin.xml.isolated 3.62 KB MD5: 55124db1dfa03250b5c86eb4a45090f5
SHA1: 5cc1ce8d0f6b4fa1d60b3922b968784310058d31
SHA256: a4f0921ee18b20812ac97e37d065ec260b2b92e3448ef9db36947b879223bc48
SSDeep: 96:58TNF/Uxoo/1Hh9qouNjkWaH42KSKmmmtYery8gxNsqH3Wjyas7cvbiMr5:irkoaZGN0H4F3ZsqHGjtQ2iU5 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Slipstream.xml.isolated 3.52 KB MD5: 66ae82e19586cc45f73a051b55e33cd8
SHA1: f334fd527450c4dcecdf399005182122f2e2a16c
SHA256: 14252775797f2fc25eaf81e45b61e9f9693e53c0048de6205b196e42e4a46f4d
SSDeep: 96:5iinKJPUzNLlfczCvmgyLI40q1CJgPW+7sItPYSzMSuJnCBQEmR:AwLllmvk407JgPW+7MaMSuJ8QEw 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Solstice.xml.isolated 3.73 KB MD5: 77ecf1ca1c9de171f8ed62a071c174db
SHA1: bf1581ec1479834346a6ab9657d826c9b26c82b0
SHA256: 286984731e8b7f6ab0c6c7ba1c797198a60fde9419a9d1ad2866632742b2c69c
SSDeep: 96:5tiJ6MKhGWfjV8cNqd16R9fYix35a1C0ADQKsItPYSzMSuJnCBZVIm:DiJ6POcNqORCits1C0ADQKMaMSuJ8ZF 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Urban.xml.isolated 3.52 KB MD5: 15591e80d1095dc19bbe5d5b39af2d07
SHA1: ce8dbf564a8009caa691d7a4dfe15f7427782800
SHA256: 17b1a8044fb8e87e9e78a6eadd1999b891bd5262796992c7a2647c663d523d07
SSDeep: 96:5BJY2qpWFZq92BJkCVYVTeb+axRsTSfuFRaFiH8gxNsqH3Wjyas7cvbiMrdsVIm:TQWFZq9GkCKHRAsRUVqHGjtQ2iUmF 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Verve.xml.isolated 3.52 KB MD5: afbd04059273191cdb07acda204f33c5
SHA1: e82ca1a9386acbcd8d45805e2942ed9576945b9b
SHA256: 318e85ceb4b58e1bb4d4be355ca71a65a62068ee89e883f7de780d4152012b35
SSDeep: 96:5IeFMpEV8cNqd16R9fYix35KeFZz/3/NLlfczCvmgyLI40q1tYpa:W4MpEOcNqORCitAeFZrVLllmvk40Za 		False
...
C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Waveform.xml.isolated 3.49 KB MD5: 8daf0265eed069ba0b220642804229e9
SHA1: 3d8a2d16b07eb510164f08fa9f9c333cbca181d4
SHA256: 1db567bd376fca89df8650fd19eaa064f45c8087a454a41bdc184997d8bd30cf
SSDeep: 96:5Ui9jRkp2BJkCVYVTeb+axRsTSfuFRabQKK4Z1ItPYSzMSuJnCBZVIm:Oi9V+GkCKHRAsRkQEbaMSuJ8ZF 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Groove.gif.isolated 106 bytes MD5: 8ffa97f744e85d7db7f4b38b273fb75e
SHA1: 9b37187b29e98a998bd553828cf09067c2e522f8
SHA256: 5b9590de5f22b4ecc53bc1167c31078dbf2f59ad5d8e8ba94003879eb8d5b67c
SSDeep: 3:PIRalSSGLzxkvcgKRJQ4fDvRDi0rgFZXi2BBen:PIRalIxmc9Q4VW0kFM2Bon 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_LightSpirit.gif.isolated 8.41 KB MD5: 18496c23952973411de059d5042f664d
SHA1: acf5f067c6c7923a0cc397d86660b155d56c8376
SHA256: b876c74cd69cb97e2b6fa8703c7734e5b8afe6f9471ff4cb90c8106292b83951
SSDeep: 192:G/QET8i5uULjaEtflZBi4yK1TmcEjc+JbQgp035CJIY2SyO6g4d:HEw0LjLplXyK1t+JbQgxJJ/yu4d 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_OliveGreen.gif.isolated 15.33 KB MD5: 0bbef3ed04079888a0e7cb7088404238
SHA1: c49ee2c518b942304aa1dfef31353c5f3a480fdc
SHA256: 65bddab81d95797f5940d42a6fe90de1d084046f91e2037de31a4a19385a217b
SSDeep: 384:dIt419Bwbiv1weOnKQg5BK2PqeXN9JGwm2R:dPLa0jyed9Jpm8 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Premium.gif.isolated 6.07 KB MD5: d552c6e90f0520297b72f57c74a611a9
SHA1: 996de849653e7c6e15d845720650f2febae91666
SHA256: 9ffe9d5f7650583649aed5c1bf68d5d7a905131280f5c62cf267d312b67bf25f
SSDeep: 96:8GbxxQA+sqAzWW3KWMvOrNgS2ORvoA37+HRXzEqIpf78E3rY+NU044BTFqKhQV:84xwbNW0up2G3yxCz7Y+NUjA8 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_SlateBlue.gif.isolated 20.31 KB MD5: 9ac6d5729945d989f5b563395b2c7405
SHA1: 72a53f5ed085597b3e37a2a5e488cc2c9550fe2f
SHA256: cd904c09540ea6ee2627022f7906d1accf51b03f4583f919927b14f391093bfe
SSDeep: 384:2e0xFM1bAEDLEaSfCIVg+Ca05BrvBNWmhmtvQDHv:2eQIt0a+APbF6vQ7 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_TexturedBlue.gif.isolated 6.31 KB MD5: cbe62a48f6ce7cb38329d9fd2ccaec6c
SHA1: 8d5ee72daf7d20e9bc13502df1d0587442db9f14
SHA256: b5b0e0f75fa5db11f56bdf04f22823c9cd8b6405c4dba16fee9fb9d86ddf92b8
SSDeep: 96:uZMAvoCUSFIjJ1qr/imChVWJ5IEnrb/8nZpIwhe4pDY1GMm09T6F2s6WKphqnNe/:uZMkoCUj/qrX2sb4bIqjHu+KpENV5Snx 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Beige.css.isolated 1.78 KB MD5: f5934e2a6f07b78ed80e49a1b28ff167
SHA1: 9abdab593ee1ab50f6062b34ef408b99c7ee46fa
SHA256: 48e968e3b6c10cb8067b93a4ccb1927d24c189b7c280b5117de49cfcf23a00f8
SSDeep: 48:ds6o0KX8fICw8N15vnDrLEna+LAlwP7Eo0d:W6e6Iy15vL8a2AeZ0d 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay.css.isolated 3.38 KB MD5: 2e7224161b51769299ecaea4bbeefb86
SHA1: 6c431de6a56c59bf7366cdf7c5498ea366db3887
SHA256: d36e3c2a398b49dc20f50cfbc406d9b6035b55b6d65a197e83d1349be58f6d9c
SSDeep: 96:9k2Et+5i7bHar8Zyx/eWfadshHjPhWuAIrQIvQoi:22seUS8YfJHj5/i 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange.css.isolated 3.06 KB MD5: 5cec7bf9e1e8a0717d56e677296edd4f
SHA1: 52c8825f13fc95f3b1609df9a73851b77bff5d90
SHA256: 77d2ca4f7fcb8c929e48390ca30480d0d9031253a4d707d29b838e1b3b578cad
SSDeep: 48:zbgmz2xhV53jsqSyY65SE9xp5wcgRiM9suo4yU7PW1jsTWP4W/pdQvfFIhpa+sxn:31zq35TRYcgRNxyULGjsiPn/cahpXxny 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert.css.isolated 2.76 KB MD5: d70ef70bec5e978d967eaf6fff12025a
SHA1: 3ca741c8b4e8d57e6775457eb88c6682a2d3d5b7
SHA256: 8be455465d5d106137265a6fe530f66e913953a07404c9ca30300ba0b1c7c7b9
SSDeep: 48:/35Arb0HzLleMRNOXtCzvMdMdNaJjsVaqvV9hv8PSSkX4QDc:vDFHRN4XOPadsA4VDv8KZoQDc 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Discussion.css.isolated 371 bytes MD5: bf9344e9f9d9a17e8b16101f3e4dbe41
SHA1: 1a6ececb1024c0c1f8738fb5ab9d317131f73a18
SHA256: a3dc731bf5bc5b82b8bdfc550414affedcf06974b7f2bbf8cf7450427a9f172d
SSDeep: 6:n68AXM8oOelP4Kg7chopt0zV14bE3NQctfsYPT9Li9fW:6xMw8PEioptKn3NQORPT929fW 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Earthy.css.isolated 1.78 KB MD5: 3b71b6759012542383d544a70f9e106f
SHA1: 5092d48ba112a85081915dd4873837df6b901cda
SHA256: 954087b77274f874942b6bd88bc588329b03adeabfa0690b34befa4bdb9423b0
SSDeep: 48:z6ZTvgDJtJzOuTC2Q84pvSVZ3mwT5R5Uw8c:zsTvgDEuMPBu5Rz8c 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck.css.isolated 2.98 KB MD5: e641c491dde29a7bd6821844e378abda
SHA1: 93aa508babd635633bad60b508372635046de2a4
SHA256: b5103aab9d1692f0f0022c0aa377aae166a4ae6adfab0b79f1b8ca22df1e9fb7
SSDeep: 48:cwZfpTijTIzF6NNYOGURPdU8o4yU7PW1jsTGRonh58PSSkX4Q7OGk7zNpkKl:xoGWLRlU8byULGjswK58KZoQql7l 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GreenTea.css.isolated 1.83 KB MD5: 3116f5d5747aff1ea46bc6ce4a32c6d7
SHA1: 1c0f231fa172543fa035b3136df323b2800c64ef
SHA256: 45f79cf6ce6006e0d3b5d94e19982696a70f421c061b5e7fff14c14eaf0ceda8
SSDeep: 48:8+3uSNmOgiJmXjhfG8PSSkX4Q7OGk7zNpkKl:8+8yoXQ8KZoQql7l 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Maroon.css.isolated 1.77 KB MD5: cee7fe2590e4e82283476d7b46b29c33
SHA1: e8e693b692e4170699b917b22c7211c18b7d5eb3
SHA256: f20c2e12ca72e9f043db7b7f8a1ae398651e9f5dd683ad65bcb782697eb5cdcb
SSDeep: 48:1NLoNfi4JbBWzK8NwiljgFDgf0k2lj6gFVd:rQa4Jk5njgdgMk2lJ7d 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\OliveGreen.css.isolated 1.83 KB MD5: 775aaf5f58f5bac1fb10b429a3658424
SHA1: 20c3f6b94a8dc7b868303732ac79d983bb3ec705
SHA256: 9a5eab031c1dc7b7d75ffbf57868c693b704b3ccc92268a97a81e5922402422b
SSDeep: 48:KreSS3zqh9LYVCkC9DrLEna+LAlwP7Eo0d:aCq/qO9L8a2AeZ0d 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Premium.css.isolated 1.75 KB MD5: 74ee71c907c6f3542773e0e309ae31b8
SHA1: 98e9f3656ac5fda34023f56ff6e93dab41991659
SHA256: 42c09f2f5a955aea758702201e9a30842401fe6fb0c1b7c15887dbd475bec517
SSDeep: 24:CbS51WL6Ur79ejustd4nDBNxx8G+0VrDEGmljgXVqD5y+yCEg6m0kq7QAkwbt6gp:Cb0A7v9Y6xxyGmljgFDgf0k2lj6gFVd 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_italic.gif.isolated 852 bytes MD5: a5ddc043aa159cb2f5f09ebb20688ce8
SHA1: af50dca8cb09d84668086c318ed46d6be5f880df
SHA256: 26b613f4a52bebae66764c5f92be1339aa74837a420a8d9dfb30ac7f8f0633ce
SSDeep: 24:LyK54bkTybznR6Q3FALxybxCwDPQvnjj8b0ZQN:L/TEhVIxRwDPQvjj8b04 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_spellcheck.gif.isolated 160 bytes MD5: a033be9a258ce5331ddfdb7a4340b60f
SHA1: c6a7a91a63256e5c6b970d97184bd59bb828c818
SHA256: 1d899905ee42078cdf05ceaee86117b691fdaf9c1a4c4877d0be6a4d7277e464
SSDeep: 3:cEeQYYCATj6vzm8lLvzdNcpU0C0KXMHvZ0S+Ju6DuWtUgLMj:cHvATmzZlPPYLsI0S+JuCukLMj 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SlateBlue.css.isolated 1.83 KB MD5: ad581bee6b88d577d215c3c6f9f89949
SHA1: c273edc4bb24354d9e1f4344656cba3a5f65bf98
SHA256: 25b4ffce56c08121e2e8c888944ff5695c19a262df83dbd2754f8fc8bd848d07
SSDeep: 48:KOcq054DJ8IfOnwC2Q84pvSVZ3mwT5R5Uw8c:tV054D6PxPBu5Rz8c 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Document.gif.isolated 2.30 KB MD5: 707ca69349f0fa7be512e7a8604bf021
SHA1: 98ee859a29739d2875543de2bf5dc818bf63b66c
SHA256: bb6af49607729f87e1a264e028183801a441990e329f68ab3f8d22e4fec1be82
SSDeep: 48:EvDaYCviimojZWMW5eMYxv0lVy6wp3TAbvom4fQAMqXhsFR:EmM4jc/YttvALoHXhsr 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Generic.gif.isolated 2.05 KB MD5: 7d1b9544211769e77f2fc9148746630b
SHA1: e21bc212f1465f0e06f27c7862ba8cb47a18199b
SHA256: 2e6050b8a1719b9ecc928dd6e6bac901292cc172702498dbb0f2731b4eb62595
SSDeep: 48:EvDaYCviimojZWMW5eMYxv0x8y6wp3DHGxEl/OcFtWS1rc:EmM4jc/YtGvmxy/OUy 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\gradient.png.isolated 226 bytes MD5: 42dcfc9f8b9f2e60f33949661a69c7d5
SHA1: f2d28437e378c7f33374b1c3a42fd4cfd180f8c4
SHA256: f2bd6e29e97ac22b08c4bda6a9acb18e308d9092b9ec4da1186efd7177c952e0
SSDeep: 6:GDFVyt1rV+/pKTcpbSDSVvV2rX4pKhTV3J5TmhWB:G5VKBrTc1SDSVviX/hr5TxB 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Person.gif.isolated 2.35 KB MD5: 092d8c64348fe42c31b7e492127a77f5
SHA1: 636801660f1d99a70b326d433b3f9ad61b810fbe
SHA256: 010c13736014c5c6a4eaf4b6acb28025cc1c3620db3747db244355d032475a16
SSDeep: 48:EvDaYCviimojZWMW5eMYxvDNny6MvBTKmpDgnRiQH4dH2041F4uRc1Pfhd:EmM4jc/YtDNy9BTZp8nkC4pS4uGhd 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Response.gif.isolated 1.64 KB MD5: e02803850c74676267e5c9e162641a9c
SHA1: 119eb2ecd68159e39470194a7f03d40027607f62
SHA256: 92acba164c2c7b2ea3b25ead90d30ce2452820ba1008a5bc4d952336e29f8a6b
SSDeep: 48:EvDaYCviimojZWMW5eMYxu/NYEa8N5vZOX4VfMSNIK+Q6fK:EmM4jc/YgrNHOX4OZK+xS 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Doc.css.isolated 247 bytes MD5: 04ecb2c16b066698d596635c456e793f
SHA1: 596600eb916f0aef6589fa4dc780acd243b66498
SHA256: b7167f689448759f8b6c5e20506255ebc4543af0aefc0b741cdbfde753f8fe1c
SSDeep: 6:oLubXlgvvJBh9uD+KInq61qtIdVUFjyQMTsZW5uL:oLuzoXh9Xnq61qtIvcvMTUTL 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Generic.css.isolated 1.34 KB MD5: 454d446c4be6016a899fa46e9ef32a1a
SHA1: 36c03a767cbd28d812732a3d4cec04c4afc2ea56
SHA256: 548c8603ffa849abb26704eb63859e91e7423b2ca0a6f9670f427009a3ee695f
SSDeep: 24:oLB/a0e+/IOnhZtFKIG3HIH6A1LwaBhk4pU50sbllgNS/qoTqR9PZhfPU5orcvJD:4BR/IUZtFtHjLwaBhkgLNhPZhEGcBXBh 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Response.css.isolated 171 bytes MD5: 4fc153d37e6f020636c70974032cde7f
SHA1: 752ad4d489962342ff25719cc1ee68a8be375bdb
SHA256: 0bbfa8c49cad5cb82ed6fd37acbb10d57e26b9935e7ba23801ea0a3ee4ca7a63
SSDeep: 3:o7P1YPE+NP8L/hKlbFVtToK3sUGNLwKomQ9giaEWHqwpXoValCAn:oLSO6NToUGNu9gfXTl5n 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen.css.isolated 3.25 KB MD5: 11a465c7332d2882bd84fc45ac7618d8
SHA1: 58532a1624ed3f43be761ffe911e92d6084476ea
SHA256: 24833f1d74140fe8ff6e4ab9fa8dac546270d512e398e2c5f02fe26bd386fc9b
SSDeep: 96:hM35isSJ6tNZuAhSDYr+adsTVJIrGqZkd/+Smbd:hMJinchhy3xJIrbw/+Sid 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Teal.css.isolated 1.81 KB MD5: 1d8ae437a1a2d7b4e98e9987b63df412
SHA1: 272aa9157f9e1a645d221cc675b73d3414c86767
SHA256: 41c5cc4f7b414b3f39e3bfdc8c1934a14f8dc38a763727129c02e478f282eb93
SSDeep: 48:H65/3CN7slgGRPjXCZ3FQIoENQmh3BRSvbG:a5/+glfRPGrQIvQooy 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\TexturedBlue.css.isolated 1.79 KB MD5: 27f56d66a7a484aaf4d58a1157326237
SHA1: 993d086997d7828c134d543b15ad1b5f6bbce523
SHA256: 53ebb40c4b2d10409867795c1ef86982c92d3e9580bb7381ef485cf80888d51e
SSDeep: 48:npe99Yr1WEmSYoquIf87EKtGo+V9rY5OGk7zNuF:npW5sgn9rYMlsF 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\Invite or Link.one.isolated 10.95 KB MD5: 916440f20d1cb6c89217b4cfb06bc7bf
SHA1: 523a54ebf27b6313de765a0686fa0c10c30f94cf
SHA256: 6694efcb1ec619a64de8b61743103202019f3043515e29809f6eee61d4a7d850
SSDeep: 192:HBcX4gIaPGsgGdRzU8VtzAVl8Vtz8VU/cX:HiX4/hUnzvAXX 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Classic.dotx.isolated 8.88 KB MD5: 829d319e48666be964ee956df9eaae9d
SHA1: 3d9a7e19fb2c4c4d15e59974d742078b8145eafd
SHA256: 2bcc04def8f5c4a2dd8747f0ffaae044e9cf0ff884f3fc6f272e277ad748a015
SSDeep: 192:eHNjkgIktWF70+Bu0NVwPTmyNNiFpYiCCmkMQZSyrnnsCU:kjkgqF70Wu0MNDitzMQsYsCU 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Elegant.dotx.isolated 8.54 KB MD5: e1dd477a6945aee0946d0bb382f6e274
SHA1: 38e9bacfd13c7da34d664405b780a574bcfe827b
SHA256: a41dd4048855d9892eb1aea29c19db2cd60024b6acdf39b280dad031f98432d5
SSDeep: 192:4k+7obZP0wCcfu7wLMnUCZuxQN/lEncoXvGLWWRBiDGw6lu:VpKsfiwLMUCZu22ZXv6RB0d6k 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Fancy.dotx.isolated 8.53 KB MD5: 4abf09ec370f6421210ea6a767f4bfe1
SHA1: f9a07fc9214b67adc2f07d80be120497ff6dbaa7
SHA256: 604dbd95ec10997432c839b5dd65de3878e35bfd6c7edb174ade81330706eb33
SSDeep: 192:4k+75vhZU1GAm0xtGS5Yk+cz9wpscHCOkxqp8Zos47TQ:VGvhcGAmh5Hqw8ZosIM 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Formal.dotx.isolated 8.35 KB MD5: d1a338f66a5fd821fb330a22bcb67a30
SHA1: 68fab41349229fdbcb601fead28f8983cf1f7de5
SHA256: d0813007139a3158b4d431e30bdb8fa45737c0911622938376a4221a841d6f2c
SSDeep: 192:mMfGJZqSHzclKmutjVvINM3P6Q3SjkkAVT:36ASHYlKXZVvIO3yQfkAVT 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Manuscript.dotx.isolated 8.26 KB MD5: 63108da8c69b09d1d0668381db141b12
SHA1: 455a97e30c431b6a374bbb46764b30f862cf4c6e
SHA256: b9e73b6fd5cc677822c1dc99c1382263e4e2672c7ded4f7f58b45a16039b8895
SSDeep: 192:DrOFkICOWMCZE6ZMGcwxN+cz9wppHTOkha+:DekI/WM4nZRFxA/H7ha+ 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Modern.dotx.isolated 8.42 KB MD5: 0e4be5ecc31d95bbbabd75ab098a7249
SHA1: 6738b8ea157ab7dc1a7a2df2fc899a3767c44c5a
SHA256: 882f43d6a052aa1962a9d1345a8d218bbcbfb4d6225d631dfe5a9fd3874c6162
SSDeep: 192:ZHrQqEAVq29h2h/X2QUd+cz9wpPHyOk5PH:ZHhQhXpH65PH 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Perspective.dotx.isolated 22.72 KB MD5: 45d4f6d23eeb64e88118a19ee052fa18
SHA1: f5e9e15b85c4e52f3653fc87339484fafd30161f
SHA256: a19fda56779c620928584adf51b6de10ea6c01308262fa7454e0ca07d87ab8b2
SSDeep: 384:01luJcBq9qrrELHPySbGB9ljLxa1ZId/7eSQ1RKX+3JncHoSqV95BJ2uzamwK0:YluP8rELdbGBfj8f2eJ193JcISuH/23z 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Simple.dotx.isolated 8.24 KB MD5: 1fbb0f3473b438312630cbe33e5f0c33
SHA1: 8af30eaa72d449626aeeab362c44fb658bf1db29
SHA256: dc7d2b107e213c9f7d403b913684bcacd8a8e5abb348f24fe4190763e3a18ebd
SSDeep: 192:v9Q28IVG/JAamGfScadexINMc+A6QNw/jkkufTh:VVPG/JApZJeIOcYQfkKTh 		False
...
C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Thatch.dotx.isolated 23.31 KB MD5: 0fd5410fbaff23c88a9a3b78fd90da2e
SHA1: 9ecf4394ab1b47bb3520035f93c7d65d628745bf
SHA256: b55c44f4a841f323c85374ae7754e1f4a42cec25e6a20854668a4a02b9bf6bf7
SSDeep: 384:vgGdZVa6eDUosTmvOeu2rKiIf1MlM62tRwK9JS8RJGlITwxnVka:vOYoYeDjU2exRJeI8xnVka 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\SignedComponents.cer.isolated 734 bytes MD5: 694a59c3eb07962f38ce6f06a361b702
SHA1: a772edabd119cb7f663910313621005e706bdeb4
SHA256: c61c682b342064d27ba973eb470b8c2c2c83b2b6442e1d4730218def36e4425e
SSDeep: 12:NLXQfaVRXEsVQcpcgRhDbHVpE93RU2PmldRyVf58cHD3DRviIn85a:NLgfoRUsG4hDb1pVbEf58cHDNvix4 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\SignedManagedObjects.cer.isolated 656 bytes MD5: 9f820051ead46c95130cc40495cc0a7a
SHA1: c31defb9a1f45693b522bf11527f693d588a104a
SHA256: 1fd2e6504109431013b381e386eaecfd480e0b7e0cf995af3af50ea690ee066f
SSDeep: 12:0uJJJfVLJIjllPVzFE1C52jF55Vrmn8dsBXaX3+bDcmGAr:0mHfVelldzr5udVrFdfX3VmXr 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\Management.cer.isolated 944 bytes MD5: 313ac08705c9ffc7353a5381e47bbf99
SHA1: e431ef7bbfefd321154cf5cd4542f515fed14a98
SHA256: 56e77f0b87d44fd3d5753997baf88b76ea885d599c2f952546df8cd7bfe0a62f
SSDeep: 12:bx2Wd7G17+ZyDgcsJpM3UEq5h5g1F6UUNzC2lFhbD6kN+yPnnYl9cIrHk2Vr0Ja/:ZRywAq5fgN/2DhfNhPnYrrr55AA 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VS_ComponentSigningIntermediate.cer.isolated 907 bytes MD5: 63dc0631c86b9ac6933df21cc55fc324
SHA1: 565e80b31e1c68c46b077b465e9348aa8c086d2b
SHA256: 4aa339da55a62842f3cbc39751024aac4eed75493b5afa316a8213258c1fdfa1
SSDeep: 24:hhPs6fAwyCzFMetwrjpa3ZRF64RWxMx//6:vE36ptwrjpiRFXhg 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImagesMask.bmp.isolated 2.30 KB MD5: b59a974e4a2cb191f6f80a3123780e85
SHA1: 0c836e5e8498485c9e781d79d6d24dd33beb420b
SHA256: da35e481515c08904f3183aa90c5f101c7a6b4767554bc8f9b07d25468826beb
SSDeep: 48:4PyI3n0sam5eh+1jsBZQm05AD2oSxBRWJxagAZ0lora:4PjX0jSBm0NrMJxX6Sora 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImage.jpg.isolated 10.35 KB MD5: 7b46277563e12d85e01ceee11937cc76
SHA1: 5926a318a3427bbd8cf49caa42e4721e404522dc
SHA256: b19be50e4f75e31d10a14060333eba06cfc2470d72e86689888187fd69fac481
SSDeep: 192:pN6X0JCTfFXne+izU08FdWknC6u8o2WAecTHB50:pNDOfFur+Wx6GW30 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImages.jpg.isolated 5.69 KB MD5: 401de225ebf395222c7e69017715097f
SHA1: d3c0f3695f9ddfa2091463de70c3da3da63d44b2
SHA256: 6066da70cc535f5929f08f7a55619691ea92ac66f6d4cee016701e884dfb6e46
SSDeep: 96:7s0tyT1/9qWEephrKBkQcEMgHbGHiFZGGhE/Doyg4/EYGxJCz8CBb:hW9gepUBkQcOHoiFtMDoyg48YyUYe 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImagesMask.bmp.isolated 1.55 KB MD5: 7a52b3ca61cff6befb8f7c3a1e9edc8c
SHA1: 5737b13e58febbd23bfa6ed7a5c3d3fd6e90d3f1
SHA256: 2c1ccdf35743dc0aa3ab25b7a0906cf5dfb37484ac53cd47aa3c2eaf9ace1423
SSDeep: 24:h+rh3nGHCKkaH+Lnvlfeo8+MsRC6hRMlBZALveyedy5AD2orwbIlULu/mAh:83n0sam5eh+1jsBZQm05AD2orhU6F 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Form_StatusImage.jpg.isolated 10.51 KB MD5: 06bdcf21b2ad38168b544a10a404acf1
SHA1: 5cc11391ea575091e7c02ef0ce30d6dd63013a56
SHA256: e188644640e5f433216f319bfe7958866d5fe76e9caef4389711040b829602bf
SSDeep: 96:d4SkY6qCWJ4sQ3HlMELh/a3wavTXAN0MbiZAppppWNDdHONSmZ2oreoFxWCsxv:au6eWsQ3lt/arXAdipDdHGPrLg 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Form_StatusImageMask.bmp.isolated 13.52 KB MD5: e6edeb08766cd552e1899cabdd09f95e
SHA1: dfd3247f96bd9325f7c7c164cdd83a2330af45b3
SHA256: 948520a1507a41ac44d7efd9930bd5538563f94105bea55791379a93ee9d8aa2
SSDeep: 96:RX0jSBm0GlWZonH0WZoq+ZunkyptvjzcUEPFEPSe:RkeelOonH0Ooq+ZQtPpEPFEPz 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\InformationIcon.jpg.isolated 2.97 KB MD5: 12696dc4f79357a1c2e37f9ba647f38e
SHA1: c4e4953cee4fc69cf17eee506210f51da03c7740
SHA256: f40c8190c9ed8cc5bb9bc70e2fda2bb3a6393c486a9cc834b887594b96769092
SSDeep: 48:nPFhLjfsQE9q26Y6qiQMCbWuQjpGFqKc2nZuyie0+Oh9r5Fpf:PFhL4S26Y6q7lIivZuyiyOh9Tpf 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24ImagesMask.bmp.isolated 2.74 KB MD5: abadd7b2aa00c4034b8d33df592a6e66
SHA1: 16876798e1ec5728334e81aeaee037d459be6075
SHA256: 64e1b4a416ac55802d6ed4bd20b8da93ab2d03944a5288e6422ef8b3c6ca641e
SSDeep: 48:R3n0sam5eh+1jsBZQm05AD2odBT8pqi7bsEANdUaJTgx7/MwOAaKT8gkJlY7w:RX0jSBm0vZtV0cNVkJy0 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackgroundRTL.jpg.isolated 16.17 KB MD5: 7a1851c7da5c51b7eba4d96d7f44cad5
SHA1: 9cba86f293246682f8a439bf91982b3ccb63ee8c
SHA256: 03917c404e5eed37b6be99a13dc9dd7d7fcda628e50e529f08e66a43011db6f8
SSDeep: 96:RSW1KbVkvppppppppppppppr2NhUtPxVNbuqMeci2IZYfhSIFkNuzDgXiJVHdaTy:RS6SrNOwpex2AIuAz/E/Ti 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableDownArrow.jpg.isolated 716 bytes MD5: c9734f998abd19e84e84dab237362ace
SHA1: 3e1a2e34221610183b33b2440b15a39b0b6280d2
SHA256: fd3128a6f0d5d71a02d03ad5d043a6255794886247f3858c17f72460b932ad2d
SSDeep: 12:QhUd3EHYWZN+wFSoOOa0x9wyrw/g0tXeyMzTkiILXcSWlull0Hl29:uy3E4Wz+GSoq0HG/g0Q9knL1vlN9 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableUpArrow.jpg.isolated 775 bytes MD5: 4544ad6dd727d9abdf6e57eb5fbaa019
SHA1: 4492512c0442fbd55d9ad04257f0fd22dd99418e
SHA256: 6bd1957bbd52482d23298bc9eacdfa331c58dbe4eff515a37dc0eaedf519a07d
SSDeep: 12:QhUd3EHYWB9meDcpE07JdDAi5Alt9qjfcla+sfOhs1YQJRY:uy3E4WB0EX07QlOQla+161j/Y 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDownArrow.jpg.isolated 872 bytes MD5: 74fb7b2b8ab23554daa77aa1ed7c5d8e
SHA1: 5e653abc9a09567f738467a59a396ded6ec22d2e
SHA256: 4d4de0ae5b97ebfcba6f7c500c13c176c9d5510825af6cf748ab84775f6902af
SSDeep: 12:QhUd3Su3AU1hAd2ZQimaM83amQrgO6r4ToV3zqN7YZ0tKqkcTejOP6sYeVDWe5BI:uy3S4NTEaQrgO6rqlJ5ejYY0fvB2d 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMask.bmp.isolated 4.81 KB MD5: 2e53d2c9db4fd6631cd3c0a0498d54df
SHA1: 62d1f6c077ce334ebc9378d50fe0e4ee1166ee8c
SHA256: a9b34c76d545d787f30da2a332a7ef4523cce4894de8adda1b0160b90b3040d9
SSDeep: 24:3H3PVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVH:3Xl 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMaskRTL.bmp.isolated 4.81 KB MD5: 1b512c98982cd0e5374b2c5fe1ab3a7b
SHA1: 589b026d235317ac652a4f722cf1bea018769aa0
SHA256: cf0eae32d802968e3c1eb1ca3a6948004fd9e639d3383e644285e1405619fba5
SSDeep: 96:M35555555555555555555555555555555555555555555555555555555555555n:K555555555555555555555555555555l 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImages.jpg.isolated 7.55 KB MD5: e1627a6a2234e933abbf18b0ca1fea4f
SHA1: 740dbb47cdb6c70a7c7ec02d6256234d5b37500c
SHA256: f8cf48a0e1208172132f94d0bd22ab41834166f1a62f9c55f24a6583e557c60e
SSDeep: 96:3wscbh21t7zcVDiCVLwHXN7+OuD2ppJNY7rfWUgOrU+0n5L6+tRnqb4g/LaNKYs/:3RcILAV4yEp8rfaQ+XqcgOlqa4Hzuvs 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImages.jpg.isolated 20.50 KB MD5: d64d9a8b6b68af50b6a6096d531cd0d1
SHA1: e19caf2bbf3527b29ba3703f0b43b1ad37430a95
SHA256: f477d45ed39b703153ef01d64b4cba7fa4957bdbf2e598c4bebfa16f0c31fbc2
SSDeep: 384:Rso0lmdc/RdV1LB7b0+ggBpT78ajWvGN8C5+NUSJYTu:Rso0lF/h1Lp0+z1ga4GOSMUa 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIcon.jpg.isolated 3.03 KB MD5: 0f112934459567b8c3c1161ec9592c52
SHA1: 1c2d062fc6951449c7dcd5af636b70431c47b97c
SHA256: fb99466445163c87012994610607ec330001f2c33eef68aef3f3a45551117a34
SSDeep: 48:yxPFhLFflQojOw1Ew9PX4IpJKwCd9AfgY/9OopfWmY5OLb6Te2MOSaF:kFhLFflfqWEg4GJed9LOjpfWbQb6i2My 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIconMask.bmp.isolated 2.05 KB MD5: 0dacfcc7201afedff8e810364c44e230
SHA1: fa8670f31ab08c0fbcc03351cd50d4d61f45ff64
SHA256: 38fb9fc2529666173fabe8b6ae5f539dc5981f16bc1b68ec514bf98e7cbc779e
SSDeep: 48:rcgx3n0sam5eh+1jsBZQm05AD2o4a9FsEEEkdK:nX0jSBm0yFsEEEkdK 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16Images.jpg.isolated 25.24 KB MD5: ccf3b11e50def85f8636c39aed1c1e14
SHA1: c307dfbc9b31254e4005552d1e4c942c7d5eacf8
SHA256: 63adaadca894d199a35f66b1ad3fd418dfb9f397feeb6fa35b4219ac94ca0d13
SSDeep: 384:v52Ji4udTBo2o2w3XB2n2Pds/3AWUHl6emiPf:v52aQVpePAWjemiPf 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Shared24x24ImagesMask.bmp.isolated 5.55 KB MD5: 6b6caaf58c559a3dcfc74359f9f8fa67
SHA1: 2be24e23e15bee726096548802c8bf2828216cfe
SHA256: bd409a92c3bde49172f7fb73c4bedd9295c6f55bf9a1f0f13791efe0c4ce91a1
SSDeep: 96:zX0jSBm0b44SYrxEV2YesoIDLPDGbPBJbK58wzdvm0VzcwH:zkeD440V2cjMATXzcg 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\spacebackupicons.jpg.isolated 3.40 KB MD5: f19523aec7e11ef985dafa105b06c1fa
SHA1: 16a1dc4640c8cbe0aa3132c5e2e640be8c217612
SHA256: 5f319e5e132d0240f727332717470371b146277b53f7948f11b6fdcad360594c
SSDeep: 48:pt+Vcyghh6huT7FAScC1tG9uYZaEENvtaIDjODRtJm10RJKxYhxk6RfF:zscbhZL9yZaEENv40jODzo0HKxYHkuF 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\StopIconMask.bmp.isolated 2.05 KB MD5: 66f846287b2210f1accb013a67cf9672
SHA1: 8877eaf7b331d3e72793e7219460094f088c0d18
SHA256: 777bb87341d8e4dc98808c9a288fbc30f21ffd623d71d56e3c09dc5f5f857135
SSDeep: 48:rcgx3n0sam5eh+1jsBZQm05AD2oMhlG8nF9KOwXL:nX0jSBm0RljnuDXL 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImages256Colors.bmp.isolated 3.80 KB MD5: 62be65f7b9044a77df022b3b281e0d0f
SHA1: cfbd8b237e44897ab519289d3887a17aefe01979
SHA256: f1cf6ddd191d501c768f8784fde2ca1b40c80cc149c7488c90581ad7ae9d853f
SSDeep: 48:5Aj2t1COspJkCb3ZeB758sOYbbUYfbg3k1G1P4gki03W6ydDQBMxGJKf5CLLU6yo:IjBpJko3sAAbUEbg3Vx4glsyB4LYRux 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImagesMask256Colors.bmp.isolated 1.31 KB MD5: fa1b6e876688acfec2327ca75a20f59d
SHA1: 7f0e74df4ef223d8e510bd544e9084a5d66b2877
SHA256: cdec2b669835de72a49d1332e178b8f0fd054abdea33e4af5525eb9efba61607
SSDeep: 24:LyKgrrttgggm++bt++bZiZiZiZi5vsvsvsvb:LyN++x++Nzvsvsvsvb 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TipsImage.jpg.isolated 9.50 KB MD5: b4e313a596c16fbba54fcac399f9f368
SHA1: dc4d882525d38db99374fa4a4f973f16398e01d3
SHA256: 7af0480b2eda7dcb55f5bdce89d86928ec23120ebf6bdd82198f1b276c33e956
SSDeep: 96:8mzA26Y6qxCaZdF2gqO9rMzFjeviOci7LaJ6u8SM6sppppzZH+D/Ql35+hxSw:8qA2/6barx8evai7a6u8R6Wj5+rn 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\VeriSignLogo.jpg.isolated 1.08 KB MD5: ea70f5c80ea419199b9cbaf728c04ace
SHA1: 0332d2ead18e5eca74d0f7910c19bd56dcea99bd
SHA256: 79c1ae076af34408471b0e5f5a23056d31a4a48ae35aeb48e011554974faf780
SSDeep: 24:uOqaGlfBEQ/Sc0KvoK6D/sp0FQSMKNTj2RP+ZeQKxzdD3Iwmyg8Y:uOLGlKcBwKYseFNrR2RmZt8t+5 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolIconImages.jpg.isolated 21.05 KB MD5: 84104134b76d765949a1882801683d99
SHA1: 614d3274f50a9ef2cedf7da8ad9c098650955f67
SHA256: 7f086fa1e6ec8d90877d42159c1914cdf1f1deb2f1f9757c78f78704c2bc5a91
SSDeep: 384:XiMh6Ze+7NHG8pyDBSLDhV5olg5diyWRM6PpWinKUu:XZH2A1Snee5WRlW0u 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImages16x16.jpg.isolated 6.40 KB MD5: 6e75fb2ea54380f1d620050e219e1d00
SHA1: 97e6d5779bc2bcac104be5845cb7984443ab2fe8
SHA256: ae78215d9ef1f51a856a3e5e881dd51fb510b90aa554899aafc816aae692ad94
SSDeep: 96:es0tRx8+VmABUCQDfHJW/JFidXcBq3g/K8YP6fQVTDZ75bs9X/ZfWqG7ZW1m4W:wvpTQDfpWxFidXcMj6oVTDZ75w9XRfc5 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImagesMask16x16.bmp.isolated 2.05 KB MD5: 1e329db827a9347fbfde4b175afa56f7
SHA1: 80da95ad225d212529df565532c4b80615064b63
SHA256: 017367f86ed8c91deb61ecccdf9860a5c8d7f58d387aeaa50dbdfb2e9a22352f
SSDeep: 48:ER3n0sam5eh+1jsBZQm05AD2o2JiBZdqJc28NaQUJTbn7:ERX0jSBm07Ji3dZNlK77 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImagesMask.bmp.isolated 1.55 KB MD5: 89612b1a9600bee6379b77971f61691f
SHA1: 2582c3e9983bf721d0a0316121adee7a5d181262
SHA256: 737d67c0816f644bc6399e707ba517b90086f529b1418eb52b945a87cae90544
SSDeep: 48:rgx3n0sam5eh+1jsBZQm05AD2owd5UG8UZt:wX0jSBm0z3pr 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarToolIconImages.jpg.isolated 13.04 KB MD5: b64efa9aefa3da6d381a9f8523eae5aa
SHA1: 3d308eda9bedb93a2cef960a1e875592c4c7f403
SHA256: b54676a57cf2972d0dbde305fb0951cc9c3feb6197cafd0d8ecbe3882ae2af33
SSDeep: 192:76cqvYLQ1ZoESTH+CfzE67e6zKIOrm4a4bFuhahCeY/uYonn:7LLQ3wKCbHK6ztgmcEGxXn 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarViewButtonImages.jpg.isolated 15.91 KB MD5: 4e81e006f714e88ce65adbf11ef5af8a
SHA1: ad152f0c7ba06655de3772297d4ca0023837c12b
SHA256: c7e18fbddf595d20a1103d696ac688b12ccddbec21ac65d9148c7f60c48d0635
SSDeep: 384:7QMkuWiTmVXtbNtMSv2WZ71+fbjqdeFs5Yx4bx7D:7nbTmVSgBknsoG 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImage.jpg.isolated 6.82 KB MD5: 102084a3bd2ed04e337b53115ed88446
SHA1: de6f7b9f0347d80419170f8d201dd5ad43b85574
SHA256: 15e655cbd59c805410baad6a8cf6da561eb93ebfd9ffa460f636268fc9e4b6fb
SSDeep: 96:/s0tZoVDkAb9J0VUSCxAizBfFz3xBEJl8tPMFRpfIDM/NOeoK3SsF89hWTe:dmLQCzBNzBWVyDbeoKpF894Te 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImageMask.bmp.isolated 1.87 KB MD5: a00a3c51836cffbde24073fbdfc59e9c
SHA1: fce541346549e0438dbd85bfb63046ed29124c8b
SHA256: c4e1ae4b00cdca2751dc15d92186ef9dc7365b36fa14926f465ac3741f65dcb2
SSDeep: 48:Egx3n0sam5eh+1jsBZQm05AD2oQTR2TR2TR2TRs:DX0jSBm0zTR2TR2TR2TRs 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Auto.jpg.isolated 17.20 KB MD5: 046c6c953f70bd5664781b9231f8be65
SHA1: 4ad271fbd8229e7318f2a5c7e75795c670b6bfba
SHA256: fb122032ded4406111d96f0c81aac87908601b90e493c6cad05341a4c2b41b35
SSDeep: 192:/S6CnlmtEuajl9Ywu51EAZkX9237TZ+58BoXtlgI:/pCnQtETe68p+5b 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactHigh.jpg.isolated 12.83 KB MD5: 2b5ad6e40f26b8cdb97aff8aeef3f5b8
SHA1: 89fff4f770cc93866efcff7a7419ce8655ee9d6a
SHA256: a276e7d83752dc0a7361892b92c1f6e13f8e9d452bcb344528c714802ae91f9f
SSDeep: 192:s20Z68mgbmv1de+WicymM1W/6u8JQWve02sq+Na7IXAnW:s20Z/bqQyB1E6RvQsq+N6IXAW 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLow.jpg.isolated 11.87 KB MD5: 76b698a7e59928c3305a341067e589f5
SHA1: b4e5fcb13d298200da6aa2775faa1119d22d9d0b
SHA256: d164f8b5ea44cea8f8868b1fb6ccbe7d74732a7cdd1db9f4d5b45753fe8756cd
SSDeep: 192:M4Z68mdkJZQHfrzjZPkPeQJtkB2PRJ/2oe:M4ZzKFsj5//2oe 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_High.jpg.isolated 4.95 KB MD5: 19355abc973ffcac980432d9c52b36f6
SHA1: 89a72d289a1b00275f95237b1df02f744d3208c8
SHA256: a4947ee677cb16c46d3de82aea0762c5a49ae807380a1068b3842c6ce5b09bf3
SSDeep: 96:h9LaKJjVYfQXfl7cUL6NCMq/WHu8K2ypjb48Z6Xi8vCrFo4oofqn:/ZYQtcULCJPHuu8cQSgBo/n 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Medium.jpg.isolated 16.47 KB MD5: ddcf6acdd8060ca14a40fb544ff62b9f
SHA1: 238612edf838518b419e70f514fc81572f13e73e
SHA256: be4b866a16fac3eceacc27e5c91fb114973a82d46ac10bf3f8c159bd6360be85
SSDeep: 96:/SW1KKfTkvppppppppppppppLhQibHgZfjE2NbXOTmCZq3M9+iw4/m1DWhtz9ANr:/S6vTeQiMZLE2NbXTCiKI4/kWJ8y5Q 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageMask.bmp.isolated 2.46 KB MD5: e8cd223f386528989c7011726a065b64
SHA1: d05444fca2626d0fa393a8f470ebe27f6324a913
SHA256: 90c3bdd3d94826db9a9cbc79efde5d0275a5376de9f904f2d270642f706d251c
SSDeep: 48:qBI3n0sam5eh+1jsBZQm05AD2o1YhR3vRTh8:/X0jSBm0dR3pTG 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageMaskSmall.bmp.isolated 1.55 KB MD5: 11db8437b504a025826119165a87a768
SHA1: c2fa7d47d53c9b3fd28bd03257f2d6c88518d945
SHA256: 19dd7a8ed8fb326a82d3b9e08b05dd2727251ff2b4e9173a32c0f8b2e93f51dd
SSDeep: 24:bwQ3Qrh3nGHCKkaH+Lnvlfeo8+MsRC6hRMlBZALveyedy5AD2oVT5NOnyAYh:bTI3n0sam5eh+1jsBZQm05AD2oFOYh 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageSmall.jpg.isolated 7.47 KB MD5: 23d18cf52392633b85b877bfc04d0551
SHA1: 7ee7edbcdfb5d114159d8bf8e78fd8e35ab44b59
SHA256: 8dbf35ba2258c7c98751cb89a3324c71596761bceb27ef9cf6ab7172c45878ed
SSDeep: 48:IsoyxB1P6wktZkNVBkhNxewfW0sgnmOYSQBUZdrJmqRMCRMCRMCRMCRM9lLc2ndV:cyxB5akVBlwfkxumqppppk7dRxSfeQ/8 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImage.jpg.isolated 8.69 KB MD5: bd28534cc97215c584c619613d2bd714
SHA1: 0dd9b217e31f1aaedaee9663d702dc296bb73f44
SHA256: 259bffb06b5553e9c434b9ed9da56d922f999560ba28fc346668c91cb0bb69ed
SSDeep: 192:Ba6pnn0f7tMZMJ8G/S8SVWSBLHRaj6OfMucu28/9:Ba8n0f6Zg6U+OfM4 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMask.bmp.isolated 2.46 KB MD5: 98c6cae154e5f35df5df401138535700
SHA1: f0f5878c71e6db588e96ff38578306c5690c643e
SHA256: cb9fd7fde922fbb537c1718ce147f6c9acc8b0782dcf0fc5f56596e73329c91b
SSDeep: 24:viN3Qrh3nGHCKkaH+Lnvlfeo8+MsRC6hRMlBZALveyedy5AD2oK9iiii4A9:qBI3n0sam5eh+1jsBZQm05AD2ofK 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageSmall.jpg.isolated 7.46 KB MD5: 2510a2be93d5187d48b3a5d5024e834d
SHA1: c05c4973b51d98d083296967b3deb0d0c62ba083
SHA256: 998082a545d61d2ecf2bcc1ff5df9d8ab5a6f9035bd32fe2a30062fb970f68d1
SSDeep: 48:ICyxB1a6wktZkNVBkhNxewfW0sgnPOYSQBULdrePmqRMCRMCRMCRMCRM9lLc2n3i:PyxBGakVBlwfkstPmqppppk7vM6DtGf 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\MessageBoxIconImages.jpg.isolated 9.90 KB MD5: 23ebddf698b1f0fd1eecfe5cd74d3128
SHA1: d5e344de35e3235cfa7942c9c9e50d3609892dda
SHA256: e813982270fc75d81bfc719961c54b24274ee8f5f2f716e53a3fe649264e7288
SSDeep: 96:uQNY6qAbJPrlxBpD3pUmmyDUsUfYsFhqWEA24tG8qFzA1RRnvMppppIJJkzZdsjQ:46t5rxpCmmswggzew3vVYzZdaE4y 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\MessageBoxIconImagesMask.bmp.isolated 192 bytes MD5: 0c0193408d87cf65bb49da59d4499846
SHA1: 3ccd5df09ee8ab86e37331a1b1f936ae57131ff6
SHA256: 5baabc01ca64752ddabd5f441cce3069feaac983bd6662d3664b7958229ed93b
SSDeep: 3:uWnjgVwzag6WA9yRdp4WTapy4yKA5J0nk2/OUsjLcHzCqUmQB:ZnjgVtg7AQR9a44yKAGOjATCqS 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIcon.jpg.isolated 7.98 KB MD5: d9f35cd5bf8baf4e0b716fba799bb30d
SHA1: 3f10b2b7ed80fec72904f9374f78392976b73390
SHA256: aad8b92eb69919736fa34e728091a57febd40b9cb46b5b79a94c1826a4bfc2af
SSDeep: 96:+81Y6q1+LhhvxdJfF58SA7kO62NgY4tlVLsbqYB95kkQC:w6pLn1UkOpP4twB92xC 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImages.jpg.isolated 8.00 KB MD5: 045bed66307e17c730fddc17e6a9ba76
SHA1: 8dd7c26f3ab131f32a7ccb030b6cd22c520e87e6
SHA256: cb72b3a6030ed80307ace57b0bdefd1ff0a1bcefa11cb3cdd146b6b09f618311
SSDeep: 96:W08s96Y6qIhkkKMEJB2Av0MT3v0MB0MzY3RMs/zb+ZBBq7DiXZTD/QlL7rc:59/6xV6eAPd/sbb+LBq78ms 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericon.jpg.isolated 3.53 KB MD5: 89c4b1c6c3967437962384c26d3e14b9
SHA1: f5b8bad8109ba3c94e5af28b61b15a2b95217eb2
SHA256: d0bb368422524eb4be32f892c240872ddd580981c442c824978e980d0436f295
SSDeep: 96:qFhLqgOk7qWEUivbphQd5M/NOcO0dY5u8xipn:6q3Ig/bEjbcVdYY2e 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\DiscussionToolIconImages.jpg.isolated 14.31 KB MD5: cc9abb6ace68e81aa9cb64a60e4289f1
SHA1: 5ac39dc94d1b114fe68ed3229c4bcfc9e5573d84
SHA256: 3a698fcb96087e1a91c151c4c30f93f4234da7545a9b4f64a77b18b0920e348b
SSDeep: 384:4To+RH6MV1uuEBqaC2dbtCrIfUcgaq6HPlc:4Tt6215aqCbsrIfUcgabHPa 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImage.jpg.isolated 9.27 KB MD5: 1bec6f85b58728a7c721f92b8ad246bb
SHA1: d208bdafdbe3d2affb91c19e5da3094ca608b3b7
SHA256: c6c2963f8d172938f248632666c810a788b6e4275ea1937674d8a1d7ea7ea158
SSDeep: 96:WeY6qzolHEUV4tEMENREenaJ6u8Shi2sppppzZ+/QlrKqkPwRY:G6/HvV4tQsD6u8YfWIRQY 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImageMask.bmp.isolated 3.16 KB MD5: e8e97c484d12e2e7ca75c7fa5bec12c7
SHA1: 2a435a0083741d63f5ee1e9c50c873977284b60a
SHA256: dee9d6d06ac3e4bdc22a7432672a8e870bbe3f829995743102a9cc0ba75d0ef0
SSDeep: 24:Vgjrh3nGHCKkaH+Lnvlfeo8+MsRC6hRMlBZALveyedy5AD2oSRFsdQjZvo7Yu:Vgx3n0sam5eh+1jsBZQm05AD2obmjZ3u 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\InactiveTabImageMask.bmp.isolated 3.16 KB MD5: 8b458fd6dd34a12637e53fd83e0a43b6
SHA1: e5f30e14877921bc271f3256697d129a2d93b969
SHA256: d1f5e16b42a0f64008d26e20f124d7551da47dde161daefc325cf85ec2cad1cc
SSDeep: 24:Vgjrh3nGHCKkaH+Lnvlfeo8+MsRC6hRMlBZALveyedy5AD2oSRRmsiN9:Vgx3n0sam5eh+1jsBZQm05AD2owmsiL 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImages.jpg.isolated 2.39 KB MD5: 1ddb4a8107445ce7f9c2e84986d55a86
SHA1: 7a64757ea481147ebb0d3fdd2122d3d1d7159920
SHA256: 78b15486ab7e038d9a6ed78daaf4c289e5e3e87e711c6bdc0ee84168b4dd1a9c
SSDeep: 48:QPFhLjC4WE9w6Y6qi7x6kZpfWm1CxLo6JvI:EFhLu76Y6qK6apfW7o6m 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImagesMask.bmp.isolated 116 bytes MD5: f0416e874466e43f15ec998c1a358d1a
SHA1: bccff166a31102fdadc5eb44cafa75395886fb7b
SHA256: 3e2d670e34508cccd4cd47771ff65797a7ce0627dd6aec9851206f04f8228342
SSDeep: 3:+Hz7nt/or/kjgVwomUFk5SfSfSfSQB624OgMn:+HVPjgV4V5UUUy240 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrow.jpg.isolated 2.98 KB MD5: d773b520f4a9089c4f02314f89810fb4
SHA1: 10a8d96a68569aa8685ced740b21a407c63ac2dc
SHA256: 04f7653c32946433b1f0780977bb3caadd55bd82c024660d6f3839758d879ccb
SSDeep: 48:HNt+Vcyghh4SrISJE99Y6qilv4beLjzEV7fWm3W5qsdxcE7hf:H3scbh4rS2Y6qwvW+zEV7fWIW5ZcIhf 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrowMask.bmp.isolated 2.29 KB MD5: 7621e005175df85e9e85c44d11eb0d4c
SHA1: 75ecfe7622e7f52e2db9d72728ded0760fcaaca8
SHA256: d70a77c83b3f60e21fb5887fbd4d41fcce4bcba35a0c2fc41c91e187ef721bc6
SSDeep: 48:lgx3n0sam5eh+1jsBZQm05AD2ojfsCd5YQq11RAsZL:qX0jSBm0MfsCd5pq11isZL 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\attention.gif.isolated 2.73 KB MD5: 6e2c6645974ed65807196593aead3505
SHA1: 9adf85665655588a06530d7846c266569dc5ee07
SHA256: a0493c3daecc66c7413b3478befe3f5661b1c2d76241d211f72541e305eebf92
SSDeep: 48:WLFt92cMAm96vvpqLSS+uYmr4PqC9s0cBobNgeIDyyV5Siru/Ae08HEJuOGlEnV:WBtEcMA8MILSPmr4ysOobeeWyy/SiSVw 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePage.gif.isolated 46.43 KB MD5: 809e7eba50ead2e7a13bdfe81aa5c13e
SHA1: 5e769f7857f814378ad43c248dd89ff396495a8b
SHA256: 2b14e66a39a64c37c4bde62ea96b198b187d122c9c28492dbe23736b716dbe67
SSDeep: 768:NEx2uaNZDSBXPeMbHA8rgzJDZtBVEIC3BaCUA6wctp4Mrp29NhccL/nICvhmjBOB:2EHZyXy8rkDZtBVEBBaDA6wcABhICvky 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePageBlank.gif.isolated 19.68 KB MD5: 06887b0469c7607028ebc92caf5922d4
SHA1: 8ebacfdd5ed5f43d96c82361e615db5c1b1125e7
SHA256: 909050a9dd8982aa16e60d20cbe0a882569a2c38f5a6ac1ba65e2cd3a3ef5e67
SSDeep: 384:DnmsW6cGKa9TorFH18fvpPai5OT0GT+ZVgV0kNdsfhtY7MWCgiSI7:TW67r0qpy1BTMVw0usZyTCgiSu 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left.gif.isolated 630 bytes MD5: a154d342c088a4fda278089633017719
SHA1: 762b7b203efdb56f541cdff1f01a12e2f8786914
SHA256: a71b0179fe5b55feb65f8ae58219a1b58e3687c70bcc267ec900bf46ea4dca07
SSDeep: 12:PPkGAhB4iaMWebLKrWce1AWNtTKztOv/w+JWW40vSzUgOLQuC3:PPSkiaMbLKi8PtkHWL0veUdL23 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left_disable.gif.isolated 230 bytes MD5: d5c9f907c8b1837cf963407ac18e507f
SHA1: 6ecdd48ebf6d421f6d00d0260133d4c595936094
SHA256: 8b99825a829912348956053cb9202b7f39c67d9c3b3a708b107a3ce8ff28ac46
SSDeep: 6:PRtwnKlTl9SpmMmr1iL+0NbJT2iT5DuB59gYTKb3:P3w297ozTvlihTm 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid.gif.isolated 185 bytes MD5: 2d4d6bf5c0956ed56dd6ea28e0987cb2
SHA1: b61cb5add2f29564d3ffaa31e02a4febada1d505
SHA256: 80191eb0b06bac70c1fef3d470b91b1d74043ce6e858c3dd655d20fa92abfb5f
SSDeep: 3:Na/NbVM53jwlRIHCC9ZOzrQMf0SKNprmqrmr1gK3pdc4x1IWoRgDrW5fsPXIkFzy:KI5m6iC9ZUtmxmMmr1LLcHWW2ZIizoV3 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid_disable.gif.isolated 53 bytes MD5: b1373757c1563c0aef08f072acc56014
SHA1: 2db757a23922c77a425f2057fafbb4bbf02b55f3
SHA256: aa638136ce94c9e2fad9fc374a051ca990f2120c7e1005414bb948c8ba73b8de
SSDeep: 3:Nal5IvWeyCpQI4NOmUe:QbOk 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_disable.gif.isolated 225 bytes MD5: 4a299f42056e949782e0849af9c037e5
SHA1: dbda0514da347052e5051a2ecdc4ecd9f9f79f92
SHA256: c44cc838341e287fea307d4d617a668878543331974ac747be09826f4efbb2c6
SSDeep: 6:PR3MMnByy5Gx/Ezmr10IVbpD7ESs4n3Jp27Cumwp7Ap/23:PukBg8MKSnEXqTECDwp7mE 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_over.gif.isolated 1.03 KB MD5: d7fb3cbaef0477db02856f9b06c3766b
SHA1: fc67a53a569409aacddb926d7bdac6ad97d58ef3
SHA256: babab77d1c2181acd4b0f6e759a47ea3d2283d2d936ee3bbf2ae4a525ce0b4f1
SSDeep: 24:PtiNj+iiaPkvVq6VAns8Ygg1IBw0wxLvfm2Bn:1GqiiaPkvVhUs8Y2BCTfv 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\EmbeddedView.jpg.isolated 8.23 KB MD5: aef640cfb5c5fa0f9b9c65eb3142f125
SHA1: c3bb227b0f604a17c50592359bf6f125ae56a104
SHA256: 6005afc05cfc0ad076c4adc101c619465efe5f701dfee6dc630eea71a1f64ca1
SSDeep: 192:FcxDXVVIbW64ytPvgXKGz9dmTAP5/ys5HS9stD5uLcMSekQ3c8P8:FSBcvgtpdmA5GMD5CcMc/8E 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\SectionHeading.jpg.isolated 14.71 KB MD5: 9049304d217d2203c01c2604e40a7024
SHA1: f1ba1313afb0031e6801cf3e0cc95b27661db81e
SHA256: a9466d1f2033d8d2cf35a927f644031c9a5cbaf3ece21bbb7b5679ac6fe9faeb
SSDeep: 192:/k68Uu8oG6B/vzCRBG08JPyeJqONbV5/AcqwEEjOxjJk:8Uu8oG64RBz81yeh6cxSxjS 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\StaticText.jpg.isolated 13.91 KB MD5: abbec243f2025f04a9f1836905f554f7
SHA1: 14a2d15cee64630f8bbd56845371914f184b5ce9
SHA256: 6e800a015cd5a7808adc5630f97bff6097ca484f4150f74e05d49afc39830c80
SSDeep: 192:sW68hI4axL0fpt8yZEFVXAViD6giMQEl9mms01oQS:Vibxwf/ZEFVXA844mV01bS 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\UnformattedNumeric.jpg.isolated 16.29 KB MD5: 4229f5da8f0f3e50c9d66a49807fa571
SHA1: 337ee67b3591b74318ad227f0a332cb5c57eb42f
SHA256: 529ff8dcc1de369e1a27cc5cd9dccf17982c6656ff916a3590e986f512d02b6c
SSDeep: 192:mH686Xf7W76nQdpSeMip4DX9XdC3/xByBDgL5Yo0K5oHSaE0OWSj2Sut01oQS:u6vqGQDOTCpBplv0K5gJ1R01bS 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePageScript.js.isolated 5.50 KB MD5: 33d1c70a3a9fbc99b7edcff74f8dc243
SHA1: b671cfb2b4134dcbbe88157b0092a83b25c7a983
SHA256: 896a63405e3f4161db5cf3591d7084b6f34bef1b2da8cf020cb62e17fda94cde
SSDeep: 96:/QOo53TI0Uu/ReiFMOMyBf+fZR/GjH3NCTpZreSk4D+/0OsUKUBaWWC2DWCN:/U5jnUugiwtZRsHmKDvsUzkWkDWCN 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewAttachmentIcons.jpg.isolated 5.15 KB MD5: 4e556a3b7a7de7d66bac11c0058d62a7
SHA1: 546eb2be096cd045c59e9ac0e5be77fbea1d0334
SHA256: 135c65a2c6082aae32a5573626dc09f6b56f2ed87fd836a5a24915e2285cd564
SSDeep: 96:8Ss0twbymABUCQDfHJW/JFidXcBq3g/K8YP6fQVTDZ75bs9X8fW3j9z:HjQDfpWxFidXcMj6oVTDZ75w9X8f+pz 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewAttachmentIconsMask.bmp.isolated 1.55 KB MD5: 67e674085019b761f9081e60c280afd7
SHA1: 7550ae05002295ea0cbb1e48012e271a4ff3e1d3
SHA256: 649775fa61baf3acf6e86c19f859e27cac0736caa37e51717ff7cd249957d300
SSDeep: 24:h+rh3nGHCKkaH+Lnvlfeo8+MsRC6hRMlBZALveyedy5AD2oJj9:83n0sam5eh+1jsBZQm05AD2oJR 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\GrooveFormsMetaData.xml.isolated 89.95 KB MD5: 7187e701152df05782819f4b750c11d0
SHA1: 947344256bcca42d92c4eb3d6e2194d28c8b88a5
SHA256: cb7ce4a58e936657363ff3911a931867a40bea864dbe57bc5585819f059036e2
SSDeep: 1536:A/MgHyl+rdDOUSlXWUxeRw08M8YhH78UvyuSwKo23UbxYxys5yLrG3BV0Onn5ZG8:2DOZkD/VAUu7o2z0Onn/GZHYNh 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\menu_arrow.gif.isolated 826 bytes MD5: 453c4d79c09d04f452920ae053e075b5
SHA1: b0f6376101ce037fbdbb6d7601ccaa6c9471cb9a
SHA256: 604140f19a104e4cc0ea8e4b320102fb601bf0b3af4a5058debb11665ad2615a
SSDeep: 24:VK54bkTybznR6Q3FALxybxCwDPQvnjj8bUp:+TEhVIxRwDPQvjj8bUp 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\validation.js.isolated 13.46 KB MD5: c66a38c5f8c179ddfc4c35db008fede6
SHA1: de9cfdfb18c62052baa8b282d4bf553a22dac366
SHA256: 9bc0fc7ea3a409aed8a6c0fb5c5d4f89f5f5855dc184e586ffecde501b84597f
SSDeep: 192:hEFjomsKdq+biNONABt3k0XIM1y0DFWeE0DJmqRP2UofRwwZNBmvccl8QHl:6fcDxXt1y0QizQL+wrBq/F 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\viewDblClick.js.isolated 84 bytes MD5: 6f1cf4e42ab12920ef4fcd92a04be133
SHA1: 13619b4cd5aed7e3804abc5b2e607a4a2af574a9
SHA256: 1c55fca340915a04ce5f48173b97b22fd043e792b31988151f2a05bf1cb53b09
SSDeep: 3:ovoBbr3HlA9lIVTU9BxQrvn/q20UY2owvn:oqP3HlA9dwjni2014v 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePage.gif.isolated 89.93 KB MD5: e575be98c5ed0e4b1b354c23aa764b47
SHA1: e5d426a10e588855984d045420d3475104db9959
SHA256: db208850b6ae1465d6cbc5b302ab5724d0740c5c6dafb6413704588c092fd5cf
SSDeep: 1536:VPbxGeINbEVcaErnXgOMyfb9SlGN/tnk/dyQx3vSFdYBaIMohh2HrTqOFnYqs:VPAg2bg6jNu9vSF+Bashh2Xqz 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_left.gif.isolated 369 bytes MD5: bd99a471a53f791c3e8ded4cb80bca2d
SHA1: 61d808e39ce3c4523686c2103700b80e9040c732
SHA256: b1b64176007b3c3048be66e30a5360f9c2b45a144d7d98525d2f54d152c18aa5
SSDeep: 6:PRPgNLK2VKvgKpyWh6DrqrhjmMmMmr16+uvgu5OA0cQEd+EqSYUKRwmIc7unXWPp:PmNLJVsDF6DrQh8bSgXAsEd+jSYle7cv 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_left_over.gif.isolated 374 bytes MD5: b8a50e8d6a78c252c0c51f30a4e9542e
SHA1: 9b1c5e3229364f1e0de87de309866d936f651004
SHA256: fb68360dbf77405a019fbf0bf9769e7d1c442be2a6a02ec4fdf5c4498f2fbc25
SSDeep: 6:PRMhB6eXPIOCKY34n2b31GR2lqJ7FzNFeqVwsT/HrX8uSw0W59CB/:PyB6eXPIFz3/bmtFFiw/HQuEe9CB/ 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid.gif.isolated 181 bytes MD5: 3013997f7ae0d13ae642f38adc234711
SHA1: 9c91d82a11cf7be15ea0a0cf054f335c5105b594
SHA256: 332db9c28efd246bca66a11509c04670a1db8e927fb58f9009c2575f6d777a9e
SSDeep: 3:crn0eG4c5ElA5i4F6KJspLySZmOzs466wqrmqrmr1RVcjimFflKU5+hLvCshn23O:cwevc/YcJkLjZmjMmMmr1TcjimdQgovZ 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid_over.gif.isolated 183 bytes MD5: abbc820f6c4b4ead7c0b7af2ebe56b8e
SHA1: ba06e202af22374eaff084996b9db57292540808
SHA256: d42015d699edb5bfe361fb22f57fdf50ad2613561327c47e918d2825230b3087
SSDeep: 3:crn0eGfQjBvPjSDQzyhTnP8+rmqrmr1iL+0Ymt94HM6MgZtR2zT3tIwtE:cwe82ZraF98omMmr1iL+0Ya94HJZtRUS 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_right.gif.isolated 369 bytes MD5: ad77363d7a8a9c836c99a5e6c7050aff
SHA1: b7694f94e5655b264366a9c24665a7446023c6b7
SHA256: 6b8b7b341b094f489ad821bcf5c2146fcbb128433f466a7cd6adc9fc80518829
SSDeep: 6:PRPsYcJh4DdWj5JhO5hdTZ7tmMmMmMmr1Wi3vgufPtjnltbuyKen1WORXAro8q2:PaYc34Dsj5TO5hdTZ7skgg6t73buI10D 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePageScript.js.isolated 7.46 KB MD5: 6b6534b86429f183e5ea6a45dcea34be
SHA1: 415d90e61d272474cddeb6ee39fe53508a105c10
SHA256: e28d03f773a5c935ad913c7b5f7086fc3853b71b6a99082bf54233863d2afec9
SSDeep: 192:6XciKvkq0dgnHp2+UEfgpi/37vGhOoaPtA:6yvkdgnn7fd6NaVA 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePageStyle.css.isolated 748 bytes MD5: d48eff45bf4d7acb26fc678ac773c060
SHA1: 118cc3e0012a26d78ef11b4d23e2f34305833d8c
SHA256: a43ab3c49830a970e743e51d33d7478c3596d89e575d01c78a51b838d19163d0
SSDeep: 12:6MM8Kx4IN47eJApdPAYRPBcpe61Oh15Pqfz7d++OwQRquYgUrCOFKFo4TRdJVi3A:DqUJcpeL5PqLAxjYbCOFKFDTV 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Adobe.css.isolated 929 bytes MD5: 5a182eb63dc58eb0b5d06805ead46053
SHA1: 971893ad6c154d9e4c511756ba815b09990ac3a5
SHA256: 8fccd7e108babfaa944a17a03c7ed882e7c5fc5b0e2bc7b1cdcb0d99a3f31fe8
SSDeep: 24:znWalXyGYoIgYU9sUyfUj4DNJYxpZDBrc:zWaMkIi4UjFHrc 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana.css.isolated 2.55 KB MD5: 1bc94c61c1012d77b7b2fa576dcced69
SHA1: 3e7ceb1a3e0f9657ca169e90d220c2436f2049d8
SHA256: f153799fb2a616eccfc05f889416d60961c00f8e7dc035b41b30452e37057fe2
SSDeep: 48:eS9Rc9orZktyTVaPngrOcfv8khstxf5DMzm1uBI4yanqVVu:hvZwiAnYhvoff5gq1+yaqVVu 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue.css.isolated 3.08 KB MD5: ae1ba8904a7e76ff23a4df3826034f8a
SHA1: fce8125830252b1d79598514815f7bf4eadbc5a1
SHA256: c74d404ac456c868bbe8bfafc807c4b5eeb0051dacbdddba4c70f36e5fc4e97a
SSDeep: 48:9X1fddnjvA/CfubjNHnsKZasxPyvlTqn1MkylrfFHwCI89PXgA+SS:9XTK/l9HDXohqn2kylrfFQWq5SS 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay.css.isolated 3.32 KB MD5: 51c80fa0f5e2ea5fb6c7c56f38d22f56
SHA1: 48b8dc63d65ac3268bcbed78277591f66e40f131
SHA256: c64bd1baad40804e202dbb7275fb907e040680bb6cbcf68b0b69ad0e2ca81673
SSDeep: 48:aX1fba6BCc7RGPPBtsIp7mLubu8iIqVMcZnmkmLVQA9ilvEJod4eX85Pwxj:aXtaQGnBjp7maCpdWSmkmLzLwOIxj 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\button.gif.isolated 185 bytes MD5: 1c00aac5ff2f4a73387a2e8c5036ff83
SHA1: 9472e89bd305879975072deca7608734425d0fff
SHA256: 0a8312b20d155e77edb49fc76e1d12c2b0560e37a380a657de8fadc0f8058721
SSDeep: 3:XBilf8APooh6Z529Dc2ulbE5IzHrprmqrmqrmqrmr1gK3ybUq/d9nuKgv7GXloqM:XIKdlQ5IzVmMmMmMmr1Lyb9F9uKgvKXa 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\tab_off.gif.isolated 341 bytes MD5: 96634b942abe1dfc61102614f453b8f0
SHA1: 115d721358a5556f5103cdc34deb04e1d21c832a
SHA256: 6b95a0a25103e1b0944610b544b2b309b4976033e922339372e03dab475fc0ba
SSDeep: 6:42T3hn2rodL5n1Mkf76FFZioF1paCFmz2F3ypFSKKy2UXC2:44QU71MM7K0o7wCFhF3ypP2Uy2 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\tab_on.gif.isolated 222 bytes MD5: 886d56e5f9cf23eb36e71207f9919489
SHA1: 47c27835b250161ccfeb31a887c502112b693d09
SHA256: baee8e210e7b8c392522b0383ebf3e0573aaa5ec3382bd3bec6068c228cd5044
SSDeep: 6:42rL3nzMmr1LodXGO4iO0hsEzVkWko2MlUOwaE:40L3nztOKijVDkTMlbwaE 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Casual.css.isolated 930 bytes MD5: ccd44da3037e19d9ef16026bc2c674ff
SHA1: 57ffd5b0caa7d74d3cfc0704a7743fd0df89da94
SHA256: 31f816424b458ae8c620e652f9af796c47b81f9a38fa41bc0e3d1b61bac2b48f
SSDeep: 24:nq5WSuAAfBsoP95tUJBH/qvs/fOc72IQ8:qoSr4jaJBHOs/fOlI 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Country.css.isolated 883 bytes MD5: 5effd1ec485e61f8a88525917be92e1b
SHA1: a760cc87a213725dbc1051b3b4107c50ca0533b6
SHA256: 7957176c54df08924e43a6fbe9896a566fe3d61cdc9a87f05a87999c9bb9c504
SSDeep: 24:WMr1OBhqogQlrtirl4c5uu9R38I8p5gEdL:WMIGHGgnjZ6BL 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert.css.isolated 2.37 KB MD5: 621876d720a6c5fa3258ecb823c50cf6
SHA1: 93ebdde177404b449a8da116da1f24af95bf1a2a
SHA256: 72d1d94db71f0fce06054af961f261572977e69fb3dbcc839d86f84a2d7ea81f
SSDeep: 48:gLPAMPfduzcmUBms2goOhbGWkM4RrtVyNMdNaJjsV53kQTxY0AnSn:gLnXwHRVgoOAWuRJM+PadsLtUSn 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Earthy.css.isolated 880 bytes MD5: 2086cb4da02e999c4dec85050e559e31
SHA1: 53b599bfcc1fc24d065682f458c332813265e99c
SHA256: bf81e93ccf54f82463c653c8136d2549f0888ddeb578766e03611d7f79ab2e43
SSDeep: 12:6TaNi1w5bLORRrGj23usA2ldzZhPXWDBcUvVfxqwDJhTIBLhtCOC1DwLoV5m8PfH:bNi65W3jNlxvgDNfPDJJIBmOIDwUoM 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck.css.isolated 2.74 KB MD5: d8d9736f3986d62cb36243900f125ff6
SHA1: 8ce70891e0744b7dea7de8e6e64f0f55a4946123
SHA256: f2fc9e47fe47c1201999200bcf92e7f833cf8de0bae78f0da775b4819e832ff7
SSDeep: 48:fn4wbhW+V3b85mJMWRy6m6AhUh6a4K/Z+OGaqODBCmr3kQTGto0K8WHg:fDhW+xJ9RuphUh6aNxh9Nrt0YvHg 		False
...
C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GreenTea.css.isolated 932 bytes MD5: 7d53790eef555c72eb0d467bc0abfcd0
SHA1: ac7b7c27770e3510b94b69217615269e4eb79d04
SHA256: 047a8ac0429a0270db2f0a1fee31b8af3ac3da81bd7a0a7733b19b02edd5264b
SSDeep: 24:qEGkHAfR46rB6NVqHFXTdDHVqmXZZqeE1CzPkmG0VJIY:1lHiaWUe8mXjhfIY 		False
...
Host Behavior
File (2124)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\000000000.key desired_access = FILE_READ_ATTRIBUTES, file_attributes = FILE_FLAG_BACKUP_SEMANTICS, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE False 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\000000000.key desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\$Recycle.Bin\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\$Recycle.Bin\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\$Recycle.Bin\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\cs-CZ\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\cs-CZ\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\cs-CZ\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\da-DK\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\da-DK\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\da-DK\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\de-DE\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\de-DE\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\de-DE\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\el-GR\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\el-GR\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\el-GR\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\en-US\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\en-US\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\en-US\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\es-ES\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\es-ES\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\es-ES\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\fi-FI\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\fi-FI\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\fi-FI\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\Fonts\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\Fonts\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\Fonts\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\fr-FR\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\fr-FR\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\fr-FR\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\hu-HU\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\hu-HU\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\hu-HU\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\it-IT\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\it-IT\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\it-IT\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\ja-JP\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\ja-JP\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\ja-JP\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\ko-KR\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\ko-KR\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\ko-KR\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\nb-NO\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\nb-NO\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\nb-NO\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\nl-NL\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\nl-NL\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\nl-NL\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\pl-PL\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\pl-PL\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\pl-PL\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\pt-BR\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\pt-BR\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\pt-BR\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\pt-PT\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\pt-PT\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\pt-PT\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\ru-RU\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\ru-RU\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\ru-RU\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\sv-SE\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\sv-SE\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\sv-SE\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\tr-TR\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\tr-TR\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\tr-TR\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\zh-CN\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\zh-CN\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\zh-CN\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\zh-HK\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\zh-HK\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\zh-HK\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\zh-TW\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\zh-TW\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Boot\zh-TW\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\BOOTSECT.BAK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE False 1
Fn
Create C:\\Config.Msi\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Config.Msi\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Config.Msi\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Documents and Settings\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Documents and Settings\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\Documents and Settings\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\@@_README_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\@@_ATTENTION_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\@@_HELPER_@@.txt desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\000000000.key type = file_type True 1
Fn
Get Info C:\\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\$Recycle.Bin\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\$Recycle.Bin\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\$Recycle.Bin\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\cs-CZ\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\cs-CZ\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\cs-CZ\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\da-DK\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\da-DK\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\da-DK\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\de-DE\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\de-DE\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\de-DE\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\el-GR\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\el-GR\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\el-GR\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\en-US\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\en-US\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\en-US\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\es-ES\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\es-ES\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\es-ES\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\fi-FI\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\fi-FI\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\fi-FI\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\Fonts\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\Fonts\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\Fonts\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\fr-FR\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\fr-FR\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\fr-FR\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\hu-HU\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\hu-HU\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\hu-HU\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\it-IT\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\it-IT\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\it-IT\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\ja-JP\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\ja-JP\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\ja-JP\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\ko-KR\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\ko-KR\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\ko-KR\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\nb-NO\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\nb-NO\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\nb-NO\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\nl-NL\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\nl-NL\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\nl-NL\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\pl-PL\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\pl-PL\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\pl-PL\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\pt-BR\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\pt-BR\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\pt-BR\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\pt-PT\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\pt-PT\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\pt-PT\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\ru-RU\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\ru-RU\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\ru-RU\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\sv-SE\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\sv-SE\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\sv-SE\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\tr-TR\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\tr-TR\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\tr-TR\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\zh-CN\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\zh-CN\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\zh-CN\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\zh-HK\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\zh-HK\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\zh-HK\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\zh-TW\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\zh-TW\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Boot\zh-TW\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Config.Msi\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Config.Msi\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Config.Msi\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\Documents and Settings\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\Documents and Settings\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\Documents and Settings\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\MSOCache\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\MSOCache\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\MSOCache\@@_HELPER_@@.txt type = file_type True 5
Fn
Get Info C:\\MSOCache\All Users\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\@@_HELPER_@@.txt type = file_type True 8
Fn
Get Info C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\@@_HELPER_@@.txt type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\@@_README_@@.txt type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\@@_ATTENTION_@@.txt type = file_type True 1
Fn
Get Info C:\\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\@@_HELPER_@@.txt type = file_type True 10
Fn
Get Info C:\\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml type = file_type True 26
Fn
Get Info - type = file_type True 147
Fn
Open STD_INPUT_HANDLE - True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.isolated source_filename = C:\\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.isolated source_filename = C:\\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.isolated source_filename = C:\\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.isolated source_filename = C:\\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.isolated source_filename = C:\\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.isolated source_filename = C:\\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.isolated source_filename = C:\\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.isolated source_filename = C:\\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Adjacency.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Adjacency.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Angles.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Angles.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Apex.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Apex.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Apothecary.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Apothecary.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Aspect.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Aspect.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Austin.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Austin.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Black Tie.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Black Tie.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Civic.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Civic.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Clarity.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Clarity.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Composite.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Composite.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Concourse.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Concourse.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Couture.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Couture.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Elemental.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Elemental.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Equity.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Equity.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Essential.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Essential.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Executive.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Executive.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Flow.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Flow.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Foundry.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Foundry.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Grayscale.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Grayscale.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Grid.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Grid.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Hardcover.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Hardcover.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Horizon.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Horizon.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Median.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Median.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Metro.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Metro.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Module.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Module.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Newsprint.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Newsprint.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Opulent.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Opulent.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Oriel.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Oriel.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Origin.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Origin.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Paper.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Paper.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Perspective.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Perspective.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Pushpin.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Pushpin.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Slipstream.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Slipstream.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Solstice.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Solstice.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Technic.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Technic.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Thatch.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Thatch.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Trek.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Trek.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Urban.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Urban.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Verve.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Verve.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Waveform.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Waveform.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Adjacency.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Adjacency.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Angles.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Angles.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Apex.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Apex.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Apothecary.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Apothecary.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Aspect.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Aspect.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Austin.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Austin.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Black Tie.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Black Tie.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Civic.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Civic.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Clarity.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Clarity.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Composite.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Composite.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Concourse.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Concourse.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Couture.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Couture.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Elemental.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Elemental.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Equity.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Equity.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Essential.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Essential.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Executive.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Executive.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Flow.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Flow.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Foundry.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Foundry.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Grid.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Grid.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Hardcover.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Hardcover.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Horizon.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Horizon.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Median.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Median.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Metro.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Metro.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Module.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Module.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Newsprint.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Newsprint.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office 2.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office 2.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic 2.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic 2.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Opulent.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Opulent.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Oriel.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Oriel.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Origin.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Origin.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Paper.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Paper.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Perspective.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Perspective.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Pushpin.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Pushpin.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Slipstream.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Slipstream.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Solstice.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Solstice.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Technic.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Technic.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Thatch.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Thatch.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Trek.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Trek.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Urban.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Urban.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Verve.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Verve.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Waveform.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Waveform.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\DataServices\+Connect to New Data Source.odc.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\DataServices\+Connect to New Data Source.odc, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\DataServices\+NewSQLServerConnection.odc.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\DataServices\+NewSQLServerConnection.odc, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Casual.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Casual.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Country.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Country.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Earthy.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Earthy.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_GreenTea.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_GreenTea.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Groove.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Groove.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_LightSpirit.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_LightSpirit.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_OliveGreen.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_OliveGreen.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Premium.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Premium.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_SlateBlue.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_SlateBlue.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_TexturedBlue.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_TexturedBlue.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_VelvetRose.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_VelvetRose.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Adobe.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Adobe.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Beige.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Beige.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\background.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\background.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Casual.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Casual.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Discussion.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Discussion.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Earthy.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Earthy.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GreenTea.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GreenTea.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\LightSpirit.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\LightSpirit.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Maroon.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Maroon.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\OliveGreen.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\OliveGreen.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Premium.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Premium.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_choosefont.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_choosefont.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_italic.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_italic.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_spellcheck.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_spellcheck.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_underline.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_underline.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SlateBlue.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SlateBlue.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\background.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\background.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\arrow.png.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\arrow.png, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Document.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Document.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Generic.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Generic.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\gradient.png.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\gradient.png, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Main.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Main.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Person.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Person.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Response.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Response.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Doc.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Doc.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Generic.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Generic.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Person.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Person.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Response.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Response.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Sts.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Sts.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\background.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\background.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Sts2.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Sts2.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\background.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\background.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Teal.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Teal.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\TexturedBlue.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\TexturedBlue.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\VelvetRose.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\VelvetRose.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\Invite or Link.one.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\Invite or Link.one, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Classic.dotx.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Classic.dotx, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Default.dotx.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Default.dotx, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\DefaultBlackAndWhite.dotx.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\DefaultBlackAndWhite.dotx, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Distinctive.dotx.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Distinctive.dotx, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Elegant.dotx.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Elegant.dotx, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Fancy.dotx.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Fancy.dotx, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Formal.dotx.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Formal.dotx, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Manuscript.dotx.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Manuscript.dotx, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Modern.dotx.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Modern.dotx, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Newsprint.dotx.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Newsprint.dotx, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Perspective.dotx.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Perspective.dotx, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Simple.dotx.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Simple.dotx, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Thatch.dotx.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Thatch.dotx, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Traditional.dotx.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\1033\QuickStyles\Traditional.dotx, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Document Parts\1033\14\Built-In Building Blocks.dotx.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Document Parts\1033\14\Built-In Building Blocks.dotx, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\SignedComponents.cer.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\SignedComponents.cer, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\SignedManagedObjects.cer.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\SignedManagedObjects.cer, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\Management.cer.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\Management.cer, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Code_Signing_2001-4_CA.cer, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Public_Primary_CA.cer.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Public_Primary_CA.cer, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VS_ComponentSigningIntermediate.cer.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VS_ComponentSigningIntermediate.cer, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\Sounds\People\Whistling.wav.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\Sounds\People\Whistling.wav, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CalendarToolIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CalendarToolIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CalendarToolIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CalendarToolIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImages.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImages.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImage.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImage.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImageMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImageMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DataViewIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DataViewIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DataViewIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DataViewIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Form_StatusImage.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Form_StatusImage.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Form_StatusImageMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Form_StatusImageMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\InformationIcon.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\InformationIcon.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\InformationIconMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\InformationIconMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\LoginDialogBackground.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\LoginDialogBackground.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24Images.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24Images.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24ImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24ImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageHistoryIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageHistoryIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageHistoryIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageHistoryIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackground.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackground.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackgroundRTL.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackgroundRTL.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierCloseButton.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierCloseButton.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableDownArrow.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableDownArrow.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableUpArrow.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableUpArrow.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDownArrow.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDownArrow.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierUpArrow.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierUpArrow.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMaskRTL.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMaskRTL.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIcon.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIcon.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIconMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIconMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16Images.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16Images.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16ImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16ImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Shared24x24Images.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Shared24x24Images.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Shared24x24ImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\Shared24x24ImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\SketchIconImages.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\SketchIconImages.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\spacebackupicons.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\spacebackupicons.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\spacebackupiconsmask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\spacebackupiconsmask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\StopIconMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\StopIconMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImages256Colors.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImages256Colors.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImagesMask256Colors.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImagesMask256Colors.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TipsImage.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TipsImage.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TipsImageMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TipsImageMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\VeriSignLogo.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\VeriSignLogo.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImages16x16.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImages16x16.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImagesMask16x16.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImagesMask16x16.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarToolIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarToolIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarToolIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarToolIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarViewButtonImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarViewButtonImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImage.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImage.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImageMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImageMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Auto.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Auto.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_AutoMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_AutoMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactHigh.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactHigh.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactHighMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactHighMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLow.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLow.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLowMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLowMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHigh.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHigh.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHighMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHighMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileOff.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileOff.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileOffMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileOffMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_High.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_High.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_HighMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_HighMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Medium.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Medium.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_MediumMAsk.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_MediumMAsk.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Off.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Off.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_OffMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_OffMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImage.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImage.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageMaskSmall.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageMaskSmall.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageSmall.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageSmall.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImage.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImage.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMaskSmall.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMaskSmall.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageSmall.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageSmall.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\MessageBoxIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\MessageBoxIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\MessageBoxIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\MessageBoxIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIcon.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIcon.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericon.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericon.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericonMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericonMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\DiscussionToolIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\DiscussionToolIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\DiscussionToolIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\DiscussionToolIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\WSSFilesToolHomePageBackground.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\WSSFilesToolHomePageBackground.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImage.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImage.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImageMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImageMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\BodyPaneBackground.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\BodyPaneBackground.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\InactiveTabImage.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\InactiveTabImage.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\InactiveTabImageMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\InactiveTabImageMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrow.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrow.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrowMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrowMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\attention.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\attention.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Casual.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Casual.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Country.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Country.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Earthy.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Earthy.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePage.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePage.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePageBlank.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePageBlank.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_GreenTea.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_GreenTea.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Groove.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Groove.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_LightSpirit.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_LightSpirit.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_OliveGreen.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_OliveGreen.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Premium.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Premium.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_SlateBlue.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_SlateBlue.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_TexturedBlue.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_TexturedBlue.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_VelvetRose.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_VelvetRose.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left_disable.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left_disable.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left_over.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left_over.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid_disable.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid_disable.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid_over.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid_over.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_disable.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_disable.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_over.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_over.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\Attachments.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\Attachments.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DigitalInk.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DigitalInk.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\EmbeddedView.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\EmbeddedView.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\SectionHeading.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\SectionHeading.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\StaticText.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\StaticText.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\UnformattedNumeric.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\UnformattedNumeric.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePageScript.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePageScript.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePageStyle.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePageStyle.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewAttachmentIcons.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewAttachmentIcons.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewAttachmentIconsMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewAttachmentIconsMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormToolImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormToolImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\GrooveFormsMetaData.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\GrooveFormsMetaData.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\menu_arrow.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\menu_arrow.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\utilityfunctions.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\utilityfunctions.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\validation.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\validation.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\viewDblClick.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\viewDblClick.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\ViewHeaderPreview.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\ViewHeaderPreview.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\viewSelectionChanged.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\viewSelectionChanged.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\AddToViewArrow.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\AddToViewArrow.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\AddToViewArrowMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\AddToViewArrowMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\attention.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\attention.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePage.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePage.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePageBlank.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePageBlank.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePageSlice.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePageSlice.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_left.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_left.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_left_over.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_left_over.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid_over.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid_over.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_right.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_right.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_right_over.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_right_over.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePageScript.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePageScript.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePageStyle.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePageStyle.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Adobe.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Adobe.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\background.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\background.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\button.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\button.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\tab_off.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\tab_off.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\tab_on.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\tab_on.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Casual.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Casual.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Country.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Country.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Earthy.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Earthy.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GreenTea.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GreenTea.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\LightSpirit.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\LightSpirit.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Maroon.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Maroon.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\OliveGreen.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\OliveGreen.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Premium.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Premium.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SlateBlue.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SlateBlue.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\background.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\background.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\tab_off.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\tab_off.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\tab_on.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\tab_on.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Sts.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Sts.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\background.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\background.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\header.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\header.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\tab_off.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\tab_off.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\tab_on.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\tab_on.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Sts2.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Sts2.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\background.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\background.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\header.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\header.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Teal.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Teal.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\TexturedBlue.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\TexturedBlue.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\VelvetRose.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\VelvetRose.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIcons.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIcons.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIconsMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIconsMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormToolImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormToolImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\form_edit.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\form_edit.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\macroprogress.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\macroprogress.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\PublicFunctions.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\PublicFunctions.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_alignleft.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_alignleft.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_alignright.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_alignright.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_bullets.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_bullets.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_center.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_center.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_choosecolor.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_choosecolor.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_choosefont.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_choosefont.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_decreaseindent.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_decreaseindent.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_increaseindent.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_increaseindent.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_italic.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_italic.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_justify.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_justify.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_pressed.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_pressed.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_underline.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_underline.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\utilityfunctions.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\utilityfunctions.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\validation.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\validation.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ViewHeaderPreview.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ViewHeaderPreview.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Casual.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Casual.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Country.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Country.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Earthy.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Earthy.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePage.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePage.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageSlice.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageSlice.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_GreenTea.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_GreenTea.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Groove.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Groove.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_LightSpirit.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_LightSpirit.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_OliveGreen.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_OliveGreen.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Premium.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Premium.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_SlateBlue.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_SlateBlue.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_TexturedBlue.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_TexturedBlue.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_VelvetRose.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_VelvetRose.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left_over.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left_over.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_mid.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_mid.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_mid_over.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_mid_over.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_right.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_right.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_right_over.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_right_over.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePageScript.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePageScript.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePageStyle.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePageStyle.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Adobe.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Adobe.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Casual.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Casual.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Country.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Country.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Earthy.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Earthy.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GreenTea.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GreenTea.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\LightSpirit.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\LightSpirit.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Maroon.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Maroon.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\OliveGreen.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\OliveGreen.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Premium.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Premium.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SlateBlue.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SlateBlue.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Sts.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Sts.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Sts2.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Sts2.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Teal.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Teal.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\TexturedBlue.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\TexturedBlue.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\VelvetRose.css.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\VelvetRose.css, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIcons.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIcons.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIconsMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIconsMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\form_edit.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\form_edit.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\macroprogress.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\macroprogress.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\PublicFunctions.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\PublicFunctions.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignleft.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignleft.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignright.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignright.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_bullets.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_bullets.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_center.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_center.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosecolor.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosecolor.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_decreaseindent.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_decreaseindent.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_hyperlink.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_hyperlink.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_increaseindent.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_increaseindent.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_justify.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_justify.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_pressed.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_pressed.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_spellcheck.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_spellcheck.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\utilityfunctions.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\utilityfunctions.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\validation.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\validation.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\attention.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\attention.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\form_edit.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\form_edit.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\InfoPathWelcomeImage.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\InfoPathWelcomeImage.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\macroprogress.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\macroprogress.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\PublicFunctions.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\PublicFunctions.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_choosecolor.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_choosecolor.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_hyperlink.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_hyperlink.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\utilityfunctions.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\utilityfunctions.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\validation.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\validation.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIcon.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIcon.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIconMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIconMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\CircleIcons.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\CircleIcons.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\CircleIconsMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\CircleIconsMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\MeetingIcon.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\MeetingIcon.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\MeetingIconMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\MeetingIconMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectStatusIcons.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectStatusIcons.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectStatusIconsMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectStatusIconsMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTaskIcon.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTaskIcon.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTaskIconMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTaskIconMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\Hierarchy.js.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\Hierarchy.js, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectToolsetIconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectToolsetIconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectToolsetIconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectToolsetIconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImage.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImage.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImageMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImageMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\WhiteboxMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\WhiteboxMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ZoomIcons.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ZoomIcons.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ZoomIconsMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ZoomIconsMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\IconImages.jpg.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\IconImages.jpg, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\IconImagesMask.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\IconImagesMask.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\XML Files\Messenger.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\XML Files\Messenger.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\XML Files\StarterApplicationDescriptors.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\XML Files\StarterApplicationDescriptors.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\XML Files\StarterNotificationDescriptors.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\XML Files\StarterNotificationDescriptors.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Groove\XML Files\StarterToolTemplates.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Groove\XML Files\StarterToolTemplates.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.InfoPath.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.InfoPath.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\Microsoft.Office.InfoPath.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\Microsoft.Office.InfoPath.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\InfoPathOM\Microsoft.Office.InfoPath.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\InfoPathOM\Microsoft.Office.InfoPath.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Microsoft.BusinessData.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Microsoft.BusinessData.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.Runtime.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.Runtime.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Microsoft.Office.BusinessData.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Microsoft.Office.BusinessData.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.SemiTrust.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.SemiTrust.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.Xml.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.Xml.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\Microsoft.SharePoint.BusinessData.Administration.Client.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\Microsoft.SharePoint.BusinessData.Administration.Client.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\OneNote\SendToOneNote-PipelineConfig.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\OneNote\SendToOneNote-PipelineConfig.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\SketchPadTestSchema.xml.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\SketchPadTestSchema.xml, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Office14\SplashScreen.bmp.isolated source_filename = C:\\Program Files\Microsoft Office\Office14\SplashScreen.bmp, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Assets.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Assets.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Charitable Contributions.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Charitable Contributions.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Contacts.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Contacts.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Events.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Events.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Faculty.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Faculty.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Issues.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Issues.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Marketing Projects.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Marketing Projects.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Northwind.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Northwind.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\1 Right.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\1 Right.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\1 Top.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\1 Top.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\2 Right.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\2 Right.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\2 Top.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\2 Top.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Comments.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Comments.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Contacts.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Contacts.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Details.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Details.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Dialog.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Dialog.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Issues.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Issues.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\List.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\List.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Media.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Media.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Msgbox.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Msgbox.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Tabs.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Tabs.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Tasks.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Tasks.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Users.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Part\Users.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Move C:\\Program Files\Microsoft Office\Templates\1033\Access\Projects.accdt.isolated source_filename = C:\\Program Files\Microsoft Office\Templates\1033\Access\Projects.accdt, flags = MOVEFILE_COPY_ALLOWED True 1
Fn
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1565 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1557 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1549 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1541 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1533 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1525 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1517 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1509 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1501 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1493 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1485 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1477 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1469 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1461 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1453 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1445 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1437 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1429 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1421 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1413 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1405 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1397 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1389 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1381 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1373 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1365 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1357 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1349 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1341 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1333 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1325 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1317 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1309 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1301 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1293 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1285 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1277 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1269 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1261 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1253 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1245 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1237 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1229 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1221 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1213 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1205 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1197 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1189 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1181 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1173 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1165 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1157 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1149 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1141 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1133 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1125 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1117 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1109 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1101 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1093 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1085 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1077 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1069 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1061 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1053 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1045 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1037 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1029 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1021 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1013 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 1005 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 997 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 989 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 981 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 973 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 965 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 957 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 949 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 941 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 933 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 925 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 917 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 909 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 901 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 893 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 885 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 877 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 869 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 861 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 853 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 845 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 837 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 829 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 821 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 813 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 805 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 797 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 789 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 781 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 773 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 765 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 757 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 749 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 741 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 733 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 725 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 717 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 709 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 701 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 693 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 685 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 677 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 669 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 661 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 653 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 645 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 637 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 629 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 621 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 613 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 605 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 597 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 589 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 581 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 573 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 565 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 557 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 549 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 541 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 533 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 525 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 517 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 509 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 501 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 493 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 485 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 477 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 469 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 461 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 453 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 445 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 437 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 429 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 421 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 413 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 405 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 397 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 389 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 381 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 373 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 365 True 1
Fn
Data
Read C:\\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml size = 4096, size_out = 357 True 1
Fn
Data
For performance reasons, the remaining 933 entries are omitted.
The remaining entries can be found in glog.xml.
Registry (2)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run value_name = MSFEEditor, data = "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" e, size = 116, type = REG_SZ True 1
Fn
Module (78)
»
Operation Module Additional Information Success Count Logfile
Load api-ms-win-core-synch-l1-2-0 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x76c20000 True 2
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x0 False 2
Fn
Load api-ms-win-core-localization-l1-2-1 base_address = 0x0 False 1
Fn
Load api-ms-win-core-string-l1-1-0 base_address = 0x0 False 1
Fn
Load api-ms-win-core-datetime-l1-1-1 base_address = 0x0 False 1
Fn
Load api-ms-win-core-localization-obsolete-l1-2-0 base_address = 0x0 False 1
Fn
Load api-ms-win-security-systemfunctions-l1-1-0 base_address = 0x0 False 1
Fn
Load advapi32 base_address = 0x0 False 1
Fn
Load advapi32 base_address = 0x74d40000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 1
Fn
Get Filename api-ms-win-core-localization-l1-2-1 process_name = c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe, file_name_orig = C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe, size = 260 True 1
Fn
Get Filename advapi32 process_name = c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe, file_name_orig = C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll address_out = 0x76c34d28 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeCriticalSectionEx, address_out = 0x76c34d28 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsFree, address_out = 0x76c3359f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitOnceExecuteOnce, address_out = 0x76c4d627 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateEventExW, address_out = 0x76cb410b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreW, address_out = 0x76c4ca5a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSemaphoreExW, address_out = 0x76cb4195 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolTimer, address_out = 0x76c4ee7e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolTimer, address_out = 0x7717441c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForThreadpoolTimerCallbacks, address_out = 0x7719c50e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolTimer, address_out = 0x7719c381 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWait, address_out = 0x76c4f088 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadpoolWait, address_out = 0x771805d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWait, address_out = 0x7719ca24 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlushProcessWriteBuffers, address_out = 0x77150b8c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibraryWhenCallbackReturns, address_out = 0x7720fde8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcessorNumber, address_out = 0x771a1e1d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateSymbolicLinkW, address_out = 0x76cacd11 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentPackageId, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount64, address_out = 0x76c4eee0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileInformationByHandleEx, address_out = 0x76c4c78f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileInformationByHandle, address_out = 0x76c5cbfc True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemTimePreciseAsFileTime, address_out = 0x0 False 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeConditionVariable, address_out = 0x77168456 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WakeConditionVariable, address_out = 0x771d7de4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WakeAllConditionVariable, address_out = 0x7719409d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SleepConditionVariableCS, address_out = 0x76cb4b32 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = InitializeSRWLock, address_out = 0x77168456 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = AcquireSRWLockExclusive, address_out = 0x771629f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = TryAcquireSRWLockExclusive, address_out = 0x77174892 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReleaseSRWLockExclusive, address_out = 0x771629ab True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SleepConditionVariableSRW, address_out = 0x76cb4b74 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThreadpoolWork, address_out = 0x76c4ee45 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SubmitThreadpoolWork, address_out = 0x771a8491 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseThreadpoolWork, address_out = 0x7719d8e2 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CompareStringEx, address_out = 0x76cb46b1 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLocaleInfoEx, address_out = 0x76cb4751 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = AreFileApisANSI, address_out = 0x76cb40d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = EnumSystemLocalesEx, address_out = 0x76cb424f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDateFormatEx, address_out = 0x76cc6676 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTimeFormatEx, address_out = 0x76cc65f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultLocaleName, address_out = 0x76cb47c1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsValidLocaleName, address_out = 0x76cb47e1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCIDToLocaleName, address_out = 0x76c5ced4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LocaleNameToLCID, address_out = 0x76cb4801 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = SystemFunction036, address_out = 0x74d41919 True 1
Fn
System (2)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-03 15:13:35 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 18062900572 True 1
Fn
Environment (1)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Process #13: cmd.exe
74 0
»
Information Value
ID #13
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:00, Reason: Child Process
Unmonitor End Time: 00:01:04, Reason: Self Terminated
Monitor Duration 00:00:04
OS Process Information
»
Information Value
PID 0x410
Parent PID 0xb14 (c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 7E8
Host Behavior
File (24)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop type = file_attributes True 2
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe type = file_attributes True 1
Fn
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 8
Fn
Open STD_INPUT_HANDLE - True 4
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_OUTPUT_HANDLE size = 58 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 19 True 1
Fn
Data
Delete C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe - False 2
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\choice.exe os_pid = 0x4f0, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a8c0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-03 15:13:36 (UTC) True 1
Fn
Get Time type = Ticks, time = 122538 True 1
Fn
Get Time type = Performance Ctr, time = 18124514651 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000001 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #14: choice.exe
0 0
»
Information Value
ID #14
File Name c:\windows\syswow64\choice.exe
Command Line choice /C Y /N /D Y /T 3
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:01, Reason: Child Process
Unmonitor End Time: 00:01:04, Reason: Self Terminated
Monitor Duration 00:00:03
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x4f0
Parent PID 0x410 (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 6A8
Process #16: vbc.exe
78 0
»
Information Value
ID #16
File Name c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
Command Line "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" e
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:50, Reason: Autostart
Unmonitor End Time: 00:01:58, Reason: Self Terminated
Monitor Duration 00:00:08
OS Process Information
»
Information Value
PID 0x540
Parent PID 0x458 (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 544
Host Behavior
File (36)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.rsp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.rsp type = size True 1
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v2.0.50727\1033\VBC7ui.dll type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 17
Fn
Write STD_OUTPUT_HANDLE size = 59 True 2
Fn
Data
Write STD_OUTPUT_HANDLE size = 56 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 1 True 3
Fn
Data
Write STD_OUTPUT_HANDLE size = 3 True 4
Fn
Data
Write STD_OUTPUT_HANDLE size = 18 True 2
Fn
Data
Write STD_OUTPUT_HANDLE size = 10 True 2
Fn
Data
Write STD_OUTPUT_HANDLE size = 27 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 26 True 1
Fn
Data
Module (31)
»
Operation Module Additional Information Success Count Logfile
Load kernel32.dll base_address = 0x767f0000 True 1
Fn
Load version.dll base_address = 0x72850000 True 1
Fn
Load Kernel32.dll base_address = 0x767f0000 True 1
Fn
Load C:\Windows\Microsoft.NET\Framework\v2.0.50727\1033\VBC7ui.dll base_address = 0x230001 True 1
Fn
Load user32.dll base_address = 0x74f60000 True 1
Fn
Load C:\Windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll base_address = 0xb20001 True 1
Fn
Get Handle c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe base_address = 0x400000 True 2
Fn
Get Handle c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll base_address = 0x72200000 True 1
Fn
Get Filename - process_name = c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe, file_name_orig = C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe, size = 260 True 2
Fn
Get Filename - process_name = c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe, file_name_orig = C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe, size = 259 True 1
Fn
Get Filename - process_name = c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe, file_name_orig = C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll, size = 259 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76804950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFullPathNameW, address_out = 0x768040d4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76803f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExpandEnvironmentStringsW, address_out = 0x76804173 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleW, address_out = 0x768034b0 True 1
Fn
Get Address c:\windows\syswow64\version.dll function = GetFileVersionInfoSizeW, address_out = 0x728519d9 True 1
Fn
Get Address c:\windows\syswow64\version.dll function = GetFileVersionInfoW, address_out = 0x728519f4 True 1
Fn
Get Address c:\windows\syswow64\version.dll function = VerQueryValueW, address_out = 0x72851b51 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryW, address_out = 0x7680492b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetUserDefaultUILanguage, address_out = 0x768044ab True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileAttributesW, address_out = 0x76801b18 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryExW, address_out = 0x7680495d True 1
Fn
Get Address c:\windows\syswow64\user32.dll function = LoadStringW, address_out = 0x74f78eb9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x76804435 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindResourceW, address_out = 0x76805971 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetEnvironmentVariableW, address_out = 0x76801b48 True 1
Fn
Create Mapping C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.rsp filename = C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.rsp, protection = PAGE_READONLY, maximum_size = 0 True 1
Fn
Map C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.rsp process_name = c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe, desired_access = FILE_MAP_READ True 1
Fn
System (7)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 1627-02-27 09:57:25 (UTC) True 1
Fn
Get Time type = Ticks, time = 17846 True 1
Fn
Get Time type = Performance Ctr, time = 6117317463 True 1
Fn
Get Info type = Operating System True 3
Fn
Get Info type = Hardware Information True 1
Fn
Environment (1)
»
Operation Additional Information Success Count Logfile
Get Environment String name = LIB False 1
Fn
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image