SpyHunter5.exe
Windows Exe (x86-32)
Created at 2019-04-17T09:51:00
Monitored Processes
Behavior Information - Grouped by Category
Process #1: spyhunter5.exe
3556
0
| Information | Value |
|---|---|
| ID | #1 |
| File Name | c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe |
| Command Line | "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SpyHunter5.exe" |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:54, Reason: Analysis Target |
| Unmonitor | End Time: 00:01:26, Reason: Self Terminated |
| Monitor Duration | 00:00:32 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xa44 |
| Parent PID | 0x45c (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
A48
0x
AA4
0x
AE4
0x
AF0
0x
AF4
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| buffer | 0x00210000 | 0x00215FFF | Marked Executable | - | 32-bit | - |
|
|
|
| spyhunter5.exe | 0x00400000 | 0x0041FFFF | Forced | - | 32-bit | - |
|
|
|
| buffer | 0x00210000 | 0x00219FFF | Marked Executable | - | 32-bit | - |
|
|
|
| spyhunter5.exe | 0x00400000 | 0x0041FFFF | Process Termination | - | 32-bit | - |
|
|
|
Host Behavior
File (10)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | STD_INPUT_HANDLE | type = file_type |
|
1 | |
| Get Info | STD_OUTPUT_HANDLE | type = file_type |
|
1 | |
| Get Info | STD_ERROR_HANDLE | type = file_type |
|
1 | |
| Get Info | c:\windows\system32\.HLP | type = file_attributes |
|
2 | |
| Get Info | C:\Windows\Help\.HLP | type = file_attributes |
|
2 | |
| Open | STD_INPUT_HANDLE | - |
|
1 | |
| Open | STD_OUTPUT_HANDLE | - |
|
1 | |
| Open | STD_ERROR_HANDLE | - |
|
1 |
Registry (7)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\Monitors | - |
|
2 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows | - |
|
2 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\HTML Help | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Help | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\HTML Help | value_name = .HLP, data = 196 |
|
1 |
Process (2)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SpyHunter5.exe | os_pid = 0xa9c, creation_flags = CREATE_SUSPENDED, show_window = SW_HIDE |
|
1 | |
| Create | RUNDLL32 | show_window = SW_HIDE |
|
1 |
Thread (3)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Context | c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe | os_tid = 0xa48 |
|
1 | |
| Set Context | c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe | os_tid = 0xa48 |
|
1 | |
| Resume | c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe | os_tid = 0xa48 |
|
1 |
Memory (7)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Allocate | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SpyHunter5.exe | address = 2293764, allocation_type = MEM_COMMIT, MEM_RESERVE, protection = PAGE_EXECUTE_READWRITE, size = 5782792 |
|
1 | |
| Write | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SpyHunter5.exe | address = 0x400000, size = 1024 |
|
1 | |
| Write | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SpyHunter5.exe | address = 0x407000, size = 1024 |
|
1 | |
| Write | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SpyHunter5.exe | address = 0x406000, size = 2048 |
|
1 | |
| Write | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SpyHunter5.exe | address = 0x405000, size = 512 |
|
1 | |
| Write | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SpyHunter5.exe | address = 0x401000, size = 12800 |
|
1 | |
| Write | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SpyHunter5.exe | address = 0x7efde008, size = 4 |
|
1 |
Module (118)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | OLEAUT32.DLL | base_address = 0x75220000 |
|
1 | |
| Load | SXS.DLL | base_address = 0x74b10000 |
|
1 | |
| Load | c:\windows\system32\kernel32 | base_address = 0x76c20000 |
|
6 | |
| Load | c:\windows\system32\user32 | base_address = 0x74f40000 |
|
1 | |
| Load | ntdll | base_address = 0x77130000 |
|
6 | |
| Load | kernel32 | base_address = 0x76c20000 |
|
3 | |
| Load | c:\windows\system32\shell32 | base_address = 0x75fd0000 |
|
1 | |
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x76c20000 |
|
2 | |
| Get Handle | c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe | base_address = 0x400000 |
|
1 | |
| Get Handle | c:\windows\syswow64\oleaut32.dll | base_address = 0x75220000 |
|
1 | |
| Get Handle | c:\windows\syswow64\ole32.dll | base_address = 0x755e0000 |
|
1 | |
| Get Handle | c:\windows\syswow64\user32.dll | base_address = 0x74f40000 |
|
1 | |
| Get Filename | - | process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SpyHunter5.exe, size = 260 |
|
4 | |
| Get Filename | - | process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe, file_name_orig = c:\windows\system32\msvbvm60.DLL, size = 260 |
|
3 | |
| Get Filename | c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe | process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SpyHunter5.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = IsTNT, address_out = 0x0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = IsProcessorFeaturePresent, address_out = 0x76c35235 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = OleLoadPictureEx, address_out = 0x752870a1 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = DispCallFunc, address_out = 0x75233dcf |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = LoadTypeLibEx, address_out = 0x752307b7 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = UnRegisterTypeLib, address_out = 0x75251ca9 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = CreateTypeLib2, address_out = 0x75238e70 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarDateFromUdate, address_out = 0x75237684 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarUdateFromDate, address_out = 0x7523cc98 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = GetAltMonthNames, address_out = 0x7526903a |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarNumFromParseNum, address_out = 0x75236231 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarParseNumFromStr, address_out = 0x75235fea |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarDecFromR4, address_out = 0x75243f94 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarDecFromR8, address_out = 0x75244e9e |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarDecFromDate, address_out = 0x7526db72 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarDecFromI4, address_out = 0x75252a8c |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarDecFromCy, address_out = 0x7526d737 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarR4FromDec, address_out = 0x7526e015 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = GetRecordInfoFromTypeInfo, address_out = 0x7526cc3d |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = GetRecordInfoFromGuids, address_out = 0x7526d1c4 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = SafeArrayGetRecordInfo, address_out = 0x7526d48c |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = SafeArraySetRecordInfo, address_out = 0x7526d4c6 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = SafeArrayGetIID, address_out = 0x7526d509 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = SafeArraySetIID, address_out = 0x7523e7bb |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = SafeArrayCopyData, address_out = 0x7523e496 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = SafeArrayAllocDescriptorEx, address_out = 0x7523ddf1 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = SafeArrayCreateEx, address_out = 0x7526d53f |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarFormat, address_out = 0x75272055 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarFormatDateTime, address_out = 0x752720ea |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarFormatNumber, address_out = 0x75272151 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarFormatPercent, address_out = 0x752721f5 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarFormatCurrency, address_out = 0x75272288 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarWeekdayName, address_out = 0x75272335 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarMonthName, address_out = 0x752723d5 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarAdd, address_out = 0x75245934 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarAnd, address_out = 0x75245a98 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarCat, address_out = 0x752459b4 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarDiv, address_out = 0x7529e405 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarEqv, address_out = 0x7529ef07 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarIdiv, address_out = 0x7529f00a |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarImp, address_out = 0x7529ef47 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarMod, address_out = 0x7529f15e |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarMul, address_out = 0x7529dbd4 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarOr, address_out = 0x7529ecfa |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarPow, address_out = 0x7529ea66 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarSub, address_out = 0x7529d332 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarXor, address_out = 0x7529ee2e |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarAbs, address_out = 0x7529ca11 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarFix, address_out = 0x7529cc5f |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarInt, address_out = 0x7529cde7 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarNeg, address_out = 0x7529c802 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarNot, address_out = 0x7529ec66 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarRound, address_out = 0x7529d155 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarCmp, address_out = 0x7523b0dc |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarDecAdd, address_out = 0x75255f3e |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarDecCmp, address_out = 0x75244fd0 |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarBstrCat, address_out = 0x75240d2c |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarCyMulI4, address_out = 0x752559ed |
|
1 | |
| Get Address | c:\windows\syswow64\oleaut32.dll | function = VarBstrCmp, address_out = 0x7522f8b8 |
|
1 | |
| Get Address | c:\windows\syswow64\ole32.dll | function = CoCreateInstanceEx, address_out = 0x75629d4e |
|
1 | |
| Get Address | c:\windows\syswow64\ole32.dll | function = CLSIDFromProgIDEx, address_out = 0x755f0782 |
|
1 | |
| Get Address | c:\windows\syswow64\sxs.dll | function = SxsOleAut32MapIIDOrCLSIDToTypeLibrary, address_out = 0x74b57685 |
|
1 | |
| Get Address | c:\windows\syswow64\user32.dll | function = GetSystemMetrics, address_out = 0x74f57d2f |
|
1 | |
| Get Address | c:\windows\syswow64\user32.dll | function = MonitorFromWindow, address_out = 0x74f63150 |
|
1 | |
| Get Address | c:\windows\syswow64\user32.dll | function = MonitorFromRect, address_out = 0x74f7e7a0 |
|
1 | |
| Get Address | c:\windows\syswow64\user32.dll | function = MonitorFromPoint, address_out = 0x74f65281 |
|
1 | |
| Get Address | c:\windows\syswow64\user32.dll | function = EnumDisplayMonitors, address_out = 0x74f6451a |
|
1 | |
| Get Address | c:\windows\syswow64\user32.dll | function = GetMonitorInfoA, address_out = 0x74f64413 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SleepEx, address_out = 0x76c31215 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = SetProcessDEPPolicy, address_out = 0x76c4eb9a |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FindResourceA, address_out = 0x76c4e9bb |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = RtlMoveMemory, address_out = 0x77193c40 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetModuleFileNameW, address_out = 0x76c34950 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = MulDiv, address_out = 0x76c31b80 |
|
1 | |
| Get Address | c:\windows\syswow64\user32.dll | function = CallWindowProcW, address_out = 0x74f60d32 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtAllocateVirtualMemory, address_out = 0x7714fab0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetCommandLineW, address_out = 0x76c35223 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = CreateProcessW, address_out = 0x76c3103d |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtUnmapViewOfSection, address_out = 0x7714fc70 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtWriteVirtualMemory, address_out = 0x7714fe04 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtGetContextThread, address_out = 0x77150c20 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtSetContextThread, address_out = 0x77151910 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtResumeThread, address_out = 0x77150058 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = GetExitCodeProcess, address_out = 0x76c4174d |
|
1 | |
| Get Address | c:\windows\syswow64\shell32.dll | function = ShellExecuteExA, address_out = 0x76216fdd |
|
1 |
Window (5)
| Operation | Window Name | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | - | class_name = ThunderRT6Main, wndproc_parameter = 0 |
|
1 | |
| Create | - | class_name = VBMsoStdCompMgr, wndproc_parameter = 0 |
|
1 | |
| Create | - | class_name = VBFocusRT6, wndproc_parameter = 0 |
|
1 | |
| Set Attribute | - | class_name = VBMsoStdCompMgr, index = 0, new_long = 39985308 |
|
1 | |
| Set Attribute | - | class_name = VBMsoStdCompMgr, index = 0, new_long = 0 |
|
1 |
Keyboard (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Info | type = KB_LOCALE_ID, os_tid = 0, result_out = 67699721 |
|
1 |
System (3289)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Cursor | x_out = 1403, y_out = 220 |
|
1 | |
| Sleep | duration = 2000 milliseconds (2.000 seconds) |
|
1 | |
| Sleep | duration = 0 milliseconds (0.000 seconds) |
|
341 | |
| Sleep | duration = 0 milliseconds (0.000 seconds) |
|
342 | |
| Sleep | duration = 1000 milliseconds (1.000 seconds) |
|
1 | |
| Sleep | duration = -1 (infinite) |
|
2 | |
| Get Time | type = Ticks, time = 115159 |
|
2 | |
| Get Time | type = Ticks, time = 115206 |
|
1 | |
| Get Time | type = Ticks, time = 115222 |
|
2 | |
| Get Time | type = Ticks, time = 115253 |
|
4 | |
| Get Time | type = Ticks, time = 115284 |
|
4 | |
| Get Time | type = Ticks, time = 115331 |
|
4 | |
| Get Time | type = Ticks, time = 115362 |
|
4 | |
| Get Time | type = Ticks, time = 115409 |
|
4 | |
| Get Time | type = Ticks, time = 115440 |
|
4 | |
| Get Time | type = Ticks, time = 115456 |
|
4 | |
| Get Time | type = Ticks, time = 115487 |
|
20 | |
| Get Time | type = Ticks, time = 115503 |
|
4 | |
| Get Time | type = Ticks, time = 115534 |
|
4 | |
| Get Time | type = Ticks, time = 115549 |
|
4 | |
| Get Time | type = Ticks, time = 115596 |
|
4 | |
| Get Time | type = Ticks, time = 115627 |
|
12 | |
| Get Time | type = Ticks, time = 115643 |
|
4 | |
| Get Time | type = Ticks, time = 115659 |
|
4 | |
| Get Time | type = Ticks, time = 115705 |
|
4 | |
| Get Time | type = Ticks, time = 115721 |
|
4 | |
| Get Time | type = Ticks, time = 115752 |
|
4 | |
| Get Time | type = Ticks, time = 115783 |
|
4 | |
| Get Time | type = Ticks, time = 115830 |
|
8 | |
| Get Time | type = Ticks, time = 115861 |
|
4 | |
| Get Time | type = Ticks, time = 115908 |
|
4 | |
| Get Time | type = Ticks, time = 115939 |
|
4 | |
| Get Time | type = Ticks, time = 115971 |
|
8 | |
| Get Time | type = Ticks, time = 115986 |
|
4 | |
| Get Time | type = Ticks, time = 116017 |
|
4 | |
| Get Time | type = Ticks, time = 116049 |
|
4 | |
| Get Time | type = Ticks, time = 116095 |
|
4 | |
| Get Time | type = Ticks, time = 116127 |
|
4 | |
| Get Time | type = Ticks, time = 116158 |
|
4 | |
| Get Time | type = Ticks, time = 116205 |
|
4 | |
| Get Time | type = Ticks, time = 116236 |
|
4 | |
| Get Time | type = Ticks, time = 116267 |
|
4 | |
| Get Time | type = Ticks, time = 116298 |
|
4 | |
| Get Time | type = Ticks, time = 116329 |
|
4 | |
| Get Time | type = Ticks, time = 116361 |
|
4 | |
| Get Time | type = Ticks, time = 116392 |
|
4 | |
| Get Time | type = Ticks, time = 116407 |
|
4 | |
| Get Time | type = Ticks, time = 116454 |
|
4 | |
| Get Time | type = Ticks, time = 116485 |
|
4 | |
| Get Time | type = Ticks, time = 116501 |
|
4 | |
| Get Time | type = Ticks, time = 116517 |
|
4 | |
| Get Time | type = Ticks, time = 116532 |
|
4 | |
| Get Time | type = Ticks, time = 116579 |
|
4 | |
| Get Time | type = Ticks, time = 116610 |
|
4 | |
| Get Time | type = Ticks, time = 116657 |
|
4 | |
| Get Time | type = Ticks, time = 116688 |
|
4 | |
| Get Time | type = Ticks, time = 116719 |
|
4 | |
| Get Time | type = Ticks, time = 116766 |
|
4 | |
| Get Time | type = Ticks, time = 116782 |
|
4 | |
| Get Time | type = Ticks, time = 116829 |
|
4 | |
| Get Time | type = Ticks, time = 116844 |
|
4 | |
| Get Time | type = Ticks, time = 116875 |
|
4 | |
| Get Time | type = Ticks, time = 116907 |
|
4 | |
| Get Time | type = Ticks, time = 116953 |
|
4 | |
| Get Time | type = Ticks, time = 116969 |
|
4 | |
| Get Time | type = Ticks, time = 117000 |
|
7 | |
| Get Time | type = Ticks, time = 117016 |
|
1 | |
| Get Time | type = Ticks, time = 117047 |
|
4 | |
| Get Time | type = Ticks, time = 117078 |
|
4 | |
| Get Time | type = Ticks, time = 117109 |
|
4 | |
| Get Time | type = Ticks, time = 117141 |
|
4 | |
| Get Time | type = Ticks, time = 117172 |
|
4 | |
| Get Time | type = Ticks, time = 117219 |
|
4 | |
| Get Time | type = Ticks, time = 117250 |
|
4 | |
| Get Time | type = Ticks, time = 117281 |
|
4 | |
| Get Time | type = Ticks, time = 117312 |
|
4 | |
| Get Time | type = Ticks, time = 117343 |
|
4 | |
| Get Time | type = Ticks, time = 117390 |
|
4 | |
| Get Time | type = Ticks, time = 117421 |
|
4 | |
| Get Time | type = Ticks, time = 117453 |
|
4 | |
| Get Time | type = Ticks, time = 117484 |
|
4 | |
| Get Time | type = Ticks, time = 117499 |
|
4 | |
| Get Time | type = Ticks, time = 117531 |
|
4 | |
| Get Time | type = Ticks, time = 117562 |
|
4 | |
| Get Time | type = Ticks, time = 117577 |
|
4 | |
| Get Time | type = Ticks, time = 117609 |
|
4 | |
| Get Time | type = Ticks, time = 117640 |
|
4 | |
| Get Time | type = Ticks, time = 117671 |
|
4 | |
| Get Time | type = Ticks, time = 117718 |
|
4 | |
| Get Time | type = Ticks, time = 117765 |
|
4 | |
| Get Time | type = Ticks, time = 117780 |
|
4 | |
| Get Time | type = Ticks, time = 117796 |
|
4 | |
| Get Time | type = Ticks, time = 117811 |
|
4 | |
| Get Time | type = Ticks, time = 117843 |
|
4 | |
| Get Time | type = Ticks, time = 117858 |
|
4 | |
| Get Time | type = Ticks, time = 117905 |
|
4 | |
| Get Time | type = Ticks, time = 117952 |
|
4 | |
| Get Time | type = Ticks, time = 117967 |
|
4 | |
| Get Time | type = Ticks, time = 117999 |
|
4 | |
| Get Time | type = Ticks, time = 118030 |
|
4 | |
| Get Time | type = Ticks, time = 118077 |
|
4 | |
| Get Time | type = Ticks, time = 118092 |
|
4 | |
| Get Time | type = Ticks, time = 118108 |
|
4 | |
| Get Time | type = Ticks, time = 118139 |
|
4 | |
| Get Time | type = Ticks, time = 118170 |
|
4 | |
| Get Time | type = Ticks, time = 118201 |
|
4 | |
| Get Time | type = Ticks, time = 118233 |
|
4 | |
| Get Time | type = Ticks, time = 118279 |
|
4 | |
| Get Time | type = Ticks, time = 118326 |
|
4 | |
| Get Time | type = Ticks, time = 118357 |
|
4 | |
| Get Time | type = Ticks, time = 118389 |
|
4 | |
| Get Time | type = Ticks, time = 118420 |
|
4 | |
| Get Time | type = Ticks, time = 118467 |
|
4 | |
| Get Time | type = Ticks, time = 118498 |
|
4 | |
| Get Time | type = Ticks, time = 118529 |
|
4 | |
| Get Time | type = Ticks, time = 118560 |
|
4 | |
| Get Time | type = Ticks, time = 118591 |
|
4 | |
| Get Time | type = Ticks, time = 118638 |
|
4 | |
| Get Time | type = Ticks, time = 118654 |
|
4 | |
| Get Time | type = Ticks, time = 118701 |
|
4 | |
| Get Time | type = Ticks, time = 118732 |
|
4 | |
| Get Time | type = Ticks, time = 118763 |
|
4 | |
| Get Time | type = Ticks, time = 118794 |
|
4 | |
| Get Time | type = Ticks, time = 118841 |
|
4 | |
| Get Time | type = Ticks, time = 118872 |
|
4 | |
| Get Time | type = Ticks, time = 118903 |
|
4 | |
| Get Time | type = Ticks, time = 118919 |
|
4 | |
| Get Time | type = Ticks, time = 118966 |
|
4 | |
| Get Time | type = Ticks, time = 118981 |
|
4 | |
| Get Time | type = Ticks, time = 118997 |
|
4 | |
| Get Time | type = Ticks, time = 119013 |
|
4 | |
| Get Time | type = Ticks, time = 119044 |
|
4 | |
| Get Time | type = Ticks, time = 119075 |
|
4 | |
| Get Time | type = Ticks, time = 119106 |
|
4 | |
| Get Time | type = Ticks, time = 119153 |
|
4 | |
| Get Time | type = Ticks, time = 119169 |
|
4 | |
| Get Time | type = Ticks, time = 119215 |
|
10 | |
| Get Time | type = Ticks, time = 119231 |
|
102 | |
| Get Time | type = Ticks, time = 119247 |
|
67 | |
| Get Time | type = Ticks, time = 119262 |
|
83 | |
| Get Time | type = Ticks, time = 119278 |
|
84 | |
| Get Time | type = Ticks, time = 119293 |
|
122 | |
| Get Time | type = Ticks, time = 119309 |
|
56 | |
| Get Time | type = Ticks, time = 119325 |
|
82 | |
| Get Time | type = Ticks, time = 119340 |
|
150 | |
| Get Time | type = Ticks, time = 119356 |
|
140 | |
| Get Time | type = Ticks, time = 119371 |
|
156 | |
| Get Time | type = Ticks, time = 119387 |
|
136 | |
| Get Time | type = Ticks, time = 119403 |
|
44 | |
| Get Time | type = Ticks, time = 119418 |
|
108 | |
| Get Time | type = Ticks, time = 119434 |
|
144 | |
| Get Time | type = Ticks, time = 119449 |
|
156 | |
| Get Time | type = Ticks, time = 119465 |
|
150 | |
| Get Time | type = Ticks, time = 119481 |
|
119 | |
| Get Time | type = Ticks, time = 119496 |
|
103 | |
| Get Time | type = Ticks, time = 119512 |
|
35 | |
| Get Time | type = Ticks, time = 125955 |
|
1 | |
| Register Hook | hookproc_address = 0x729a1e09 |
|
1 | |
| Get Info | type = Operating System |
|
3 | |
| Get Info | type = Operating System |
|
2 | |
| Get Info | type = Hardware Information |
|
1 | |
| Get Info | type = Windows Directory, result_out = C:\Windows |
|
1 |
Mutex (12)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | - |
|
1 | |
| Release | - |
|
11 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Ini (2)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Read | WINHELP.INI | section_name = FILES, key_name = .HLP |
|
2 |
Process #2: spyhunter5.exe
46551
0
| Information | Value |
|---|---|
| ID | #2 |
| File Name | c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe |
| Command Line | "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\SpyHunter5.exe" |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:01:09, Reason: Child Process |
| Unmonitor | End Time: 00:03:01, Reason: Self Terminated |
| Monitor Duration | 00:01:52 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xa9c |
| Parent PID | 0xa44 (c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
AA0
0x
ABC
0x
AC0
0x
AC4
0x
AC8
0x
ACC
0x
AD0
0x
B08
0x
B2C
0x
808
0x
5A8
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| buffer | 0x00400000 | 0x00407FFF | First Execution | - | 32-bit | 0x00402000, 0x00401FE7, ... |
|
|
|
| buffer | 0x00400000 | 0x00407FFF | Content Changed | - | 32-bit | 0x00404000 |
|
|
|
Injection Information
| Injection Type | Source Process | Source Os Thread ID | Information | Success | Count | Logfile |
|---|---|---|---|---|---|---|
| Modify Memory | #1: c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe | 0xa48 | address = 0x400000, size = 1024 |
|
1 | |
| Modify Memory | #1: c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe | 0xa48 | address = 0x407000, size = 1024 |
|
1 | |
| Modify Memory | #1: c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe | 0xa48 | address = 0x406000, size = 2048 |
|
1 | |
| Modify Memory | #1: c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe | 0xa48 | address = 0x405000, size = 512 |
|
1 | |
| Modify Memory | #1: c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe | 0xa48 | address = 0x401000, size = 12800 |
|
1 | |
| Modify Memory | #1: c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe | 0xa48 | address = 0x7efde008, size = 4 |
|
1 | |
| Modify Control Flow | #1: c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe | 0xa48 | os_tid = 0xaa0, address = 0x771401c4 |
|
1 |
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml | 5.48 KB |
MD5:
9348b1ce5161c4c37a043450c52ad7e1
SHA1: 34065c3c48195018ed05e97f0c83643b5aa55188 SHA256: db26378258f5255fd4234e543ba136ba1503a1e146c870e7140a2b6b57642397 SSDeep: 96:jsLxg27P+XTz5uyXywdOUYqSJLAbrysbj//XYLMWGsAtvYBaadJAVWGNxAAF726e:jV2r8v5BiwdO7qSZjsbDPYgW04aa/AId |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi | 848.55 KB |
MD5:
fcfb4cdcc7b9d9f3c8101cfb6d45d4b3
SHA1: 47ddc1093f333dbd5092a9c677c5c226af924e11 SHA256: 11fd06fc212698f387ceb821a16700a2f71477c36390926ec6d817fe6cf63254 SSDeep: 24576:f7f83PV4gEux3P6WBWkmf3egDqo8o93lA6p7wbt:+zgLf7qoQ6p7wp |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | 0.85 KB |
MD5:
3122026675f646641245aa126e171fab
SHA1: ef0318f473ad509a3c38e8838af6ea4db06ad236 SHA256: b16f4a57863a4e7ee488dd35132822a09201a3c47dc6ea974e717710f607e714 SSDeep: 24:haxQ92rhvPTxXei1SNSVWoK3ygxc/PEEt0KWMVaFjrt:haFhvbxzRWoMyzF0VDt |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml | 2.61 KB |
MD5:
cc67ffd73567ef67cb34f943da09da56
SHA1: 731f17f574b869dce89fa09a312b2aedbda0fb31 SHA256: fe7cf3dcc43fd6d5bec1357dbc663098d783ec491f953e812ad69599f3b9749e SSDeep: 48:nTtxdrGtnVCdl5BHK1KfV7lTgQqQS030YnYBL83IIpooJshH0rEOx:nT7xbqkplgQS0kPSIIpJx |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSPTLS.DLL | 1.14 MB |
MD5:
94bdfcd64eff9906c21cdf2e4256a834
SHA1: f09911330c7e5b9cf5f00e2454cd426736658144 SHA256: e96fe9ad47050a45513d86095a273eb7cfc95dfc3d0b920b0a48da8767e79132 SSDeep: 24576:d9HgzU86R0DZ3/qGa63kCymUAwi2xHoX1JAAz1TH:dJgzU86R0DZCGa63kClwi2xHoX/As |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML | 5.80 KB |
MD5:
a3e5d638357bc2461ef06f1570b78c6a
SHA1: 2e2eefb54d28cc5f98742f4523aaa97a1f5c2293 SHA256: d30fc3c13276e281a50a2e9cb166a0813f5701f080ebf8eee61df70a49828626 SSDeep: 96:/LDn+Y5bxbanluGO2mABZCDcMXhuqO/z2OL5rrbB0zpaI7wD3dikXvFE/2rvVoB:/LDn+QaluXIZCIMoqOyY1Cz0I7wD38ki |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE | 170.40 KB |
MD5:
0dd30398fe1f773277eee4c739f38072
SHA1: cadbc0163b27718e957cce65ff2beec99e78a0e9 SHA256: 9b3d3403ca30251e5f88c0b49e03f8fc74aeb5b16ffbf5d3e67453aa8679f17a SSDeep: 3072:XNrZSTAkXbVjAaX/0EVNt4xXqutFdNciAqnYCDb5+aVjMvhNOSH2S9on:XNrYskXbVjF/ZNGtFdNdFnTDYZNjPs |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\SmartTagInstall.exe | 15.43 KB |
MD5:
74d4ac433855a15973f730158427aa52
SHA1: 4b7f4fb3d12367fa118a75b68b646557bc14001b SHA256: 00515d3ea519a73230e6457ae6ea31e71c030e8e054f6fa3a4824692f7ce299a SSDeep: 384:bBpj9Ug0J3MnvjKjGqqBXXWMeXci2jpvk:bBB9oJMnRXTeMi2jpvk |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT632.CNV | 282.91 KB |
MD5:
00227eef869df5de405b3dc2d1dcb759
SHA1: d97105285e6020e3a0e4fbc1257d58d180fa9908 SHA256: 2148fada17794a3c041e23338bc6a4ee5a42123c166aa9c8777155582b501412 SSDeep: 6144:LkVjfKEEmPgU/9YsJx3swD3y0QdxFpTbEh:MTKGPgxsn3vD3y9bXTgh |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF | 2.83 KB |
MD5:
22beae71e10d8d80adcfa5b96188f5b9
SHA1: 88a8dd73499f4f541424c482024876d414f9bd83 SHA256: 4738c7239b70c566c3ff3f563564db72fa4a64f1013472417958d1dd81a95a74 SSDeep: 48:xk0vGl6icvKaVbspAnB3p5AnadQ1VXFQr9W5UmDaLu9ZO+jSRyovK7C5:mi5TP0C4NbKMGqZ7jA/K7K |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF | 1.57 KB |
MD5:
81108dccde9f4a0c6f52f2877458b84e
SHA1: 03d90c020f26137ff2a31e815dc46a94233ce866 SHA256: 71af5e6b5125c0965e2b2a92cd50a4013603c5f3104972f01c0539c088631e25 SSDeep: 48:bhieC7Y992sgNxymGTh5c2H0vuX24nSu5CF:VV9/gABUv948 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.INF | 0.53 KB |
MD5:
6096d95fbf970185ec897348789fb7f4
SHA1: 2147cfa6250c1b188b0e8661685f9b7989f9e027 SHA256: 51b4d8c65106a5dbf3ff63d138add2fa6dabc81865fda995ce7ee78c0f49d58a SSDeep: 12:sj8N5kE1ypR3o1u2BuOqztY8mTPbZ2he3ghBauLbva5L+gy6n:sj8N5kEMpR3Eu2Bt7PbZR38WZy6 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG | 18.03 KB |
MD5:
83d21b859197551228d936e99450fecb
SHA1: 30b30bb124d1756314ccabd05db5c6c818dca249 SHA256: 85a3a01f7da97944a4a3f12cbcadce229e76055085b12cc1fd8812b5e749364f SSDeep: 384:WOoMcqmn9ZueRP106hGDLk+QXmafEA4ANwiJqJo2sfh/d2eYUGaXOIMsO+N:nofqIueRP1lhGvm2UNwc1nf2eYUzxMsn |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHTGTXT.SHX | 633.07 KB |
MD5:
1b8ea46f081482d4b24bba9c4821793c
SHA1: 5f20ec339f35800f6a0438a9db8efdbfcdb26f7b SHA256: 977738fa24c7e2ce9322714dd1705b145eccb8e5d7ccbc5211535a33fa720860 SSDeep: 12288:sRhrIrywxGE4obHoaUFNuGGooENADAHWLi10nLdEE5:sRhrIGwxKo/USoXNAMWY0nLdb |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG | 165.71 KB |
MD5:
ab0f15f6f0f52549cf9104fc3c95775c
SHA1: 3e1c8ae81538e6b400c9dc3d0d4cbe40a1bd3262 SHA256: daba82cfabdf7595cf94919312cb741e27c1e58ebd90659accb935aca662975b SSDeep: 3072:Hyq9okmEhEIKkaYSRMo5BBXeeIiQbPiTe9IbIuQ4hfhqo/:HyVBXISRvenKCEhB/ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\FPWEC.DLL | 1.30 MB |
MD5:
921436b0880d059c73fb97d7bfd62e89
SHA1: b1b3aff5138eb18a294773f6cf5ce9fa686ecc79 SHA256: 4c35551c76832e65d3c11346bf964795d7a993e37a79102f528ac8f296e4cf0c SSDeep: 24576:AoBZfj1vepTkloWG4ohNZr7nxLNjelaJrTaogH1:A0Zfj8RkloWJoxr7nJNjelykV |
|
|
| \\?\C:\Program Files\desktop.ini | 0.22 KB |
MD5:
3f1ac35c836f27327e95480af023f0d7
SHA1: 043e71721f79897eae177c29c95098d75184f3ed SHA256: 7cd4ad0b8778a4c1caf246f43192e205172abcec7df13b23a89535e43f606f86 SSDeep: 6:elBadgyJFfaF33NeC+uhduMAtTXrUSo6QWhO:elBadggFm33NeCnhpyQh6QWw |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb | 15.88 KB |
MD5:
1442251f783da14c87f6dae63bfba74e
SHA1: 265fa83d8e44a3a3d764ecf6beaf5b1a0108876f SHA256: 40eb27193ccd500a69bc45bcff6faae83c45d6262ba74c787715024ea9b8c9c5 SSDeep: 384:k4QxFaJE+GKwX3Czlv+52fgCQkMu58LXci2jpv56:0dF3Chv+Efg9uCMi2jpv56 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBE7INTL.DLL | 151.38 KB |
MD5:
40594350c16a0d996293213e4bdba4d4
SHA1: 94f1b00ef92f90e912c9c062b836cd4c710b1ebc SHA256: a89d011508c72ff1ecb6536d5e1845a0b392b12b7f19c262a8ef286744084d5c SSDeep: 3072:VfMMqowMvjAJf/AX75PeaeEEXVpAMD5NiFmPKVHnopxLW05RJCcZ3BM95c:ZMDMgoXslG0N8m |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_uninstalling_.png | 0.74 KB |
MD5:
f56765ecf5ab7a9bfbc7eee47bc4f2fd
SHA1: d1929c16d28850f680f2d05ca425771428562366 SHA256: e7ae93a4623dede7d1d50f06e1c3ebb0c8f525124c4ad0fe974d73839d491225 SSDeep: 12:UtoUyGw9sKRArV6rArEOgDxORTCGyOTx4M7RGwkPObfe1LPOJYSG+0sJx+R6Z3q6:UtoUrTaAr0rAQOGxOws4M7gwNbmTOhVj |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml | 5.80 KB |
MD5:
b32754c2cfa725d462dd302a79d43521
SHA1: c0b126058682def74fd4bf2f3fb527b259e42b78 SHA256: b1a8c6baac4165d88665271aee34e7674350de9ac422e72e5f21950dc68901ad SSDeep: 96:whTKOSTwEZUDQn9OJFeI1WX25EGF1xnUnftEET/zmWZYvBzOM5v:whOOSTwEZUU92Fh5E+1OnVBT/zpZYJtl |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | 0.84 KB |
MD5:
a9a606a60496bee5b7a764b6b504b74b
SHA1: 3001396f8fb670b8f4f54c343a5aefe5fc919f97 SHA256: e56906741d9857aee9758ac407494ef0e0fa7582b1cf685c1c5a298411bf70ab SSDeep: 24:IiWgbczJg+2V0rd0NNSXfEIi9AmyAoKj24XKLSR:IiW6cC+2VJNNaf36A9Y2uKLW |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | 1.47 KB |
MD5:
daa90ac5b4dca519dc30468dbb6b812e
SHA1: 022b70656a3ab26592c1e329c528489dab2991af SHA256: 186e512b3949176b8c3f5db502cd0accde0da8b1de8455f091628517d98d0cd6 SSDeep: 24:lrmbOBti5Lh/249yU1p2DBAcp1QjR0wEWT/eYIvuubbnIlxYXL6iMudnWya:lqbitiphe4QJmo1QFfG/LbexYXL6iMuC |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | 1.99 KB |
MD5:
3059d44b0200f010c6f43b6040f9917d
SHA1: ffe62f236c015769cdbf93f164bdf08612cbaa24 SHA256: 124c1a34b6765d38e46dc9d56b74377bb1271ec9c3180fef63237d0ef6cba9c0 SSDeep: 48:/yfbeU3LUeRMRN5+CEdr7lT38Xd4m0DgDWJudkqV1:aaU7jqN5+CE3T8XdtIuiU |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | 1.62 KB |
MD5:
1eb4bff8280345c7ee5c9bd3d23d1755
SHA1: 791c9fe20bfcab3b21a83d55fe8572cae39ad1ab SHA256: f5bad9ffdbc5e60fb15029a621453e7930ad9ea8fb36b84a9d8b52a1019ce7cf SSDeep: 24:f3OBY7180vX4uF66rFhkcWCqcJHr+/JPwrhV6yI0IF0beDez9cx+5lnlLluerbVR:ff7DoGPa0eJPwrhVbOFQa2lnlLljrJR |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | 1.88 KB |
MD5:
5e2796a5634eea9fda10ae34f1198a96
SHA1: 4e5fdd747f1d2f815b5a12126e117a7b893531b4 SHA256: 4460a3a075c35e1899174f2bce50277d31dee8620906bf3e73a62ff0cceca070 SSDeep: 48:Zw+IU7JC1Z4hFr712rvWO6NJVFDEnbglC6dHqT:i+17/hV712H67PEnbgVHqT |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | 1.47 KB |
MD5:
415fa1d5cc3fabdd29b980e4fbdab7e3
SHA1: 8fdd778eeea854d4796583734d2c954d5f6579c2 SHA256: dbd3aa4c896d6ff2a53960b9813f42e3e22d531c97ec1bdf6edee45149728f6e SSDeep: 24:MiOccKmJflSSijJRByEigF36xB20FdTVtonR/w1VnwtLlaAB2t+gL4hvGH9OryOU:nZPRQA6xlTboVw1h4Ll9AEZGdOr67IGv |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi | 848.55 KB |
MD5:
addd60a2b59ade9eea6aad5e8d8e32e5
SHA1: e783be7577afe9cefdd432faaca68d4b3033ef33 SHA256: 8051664c9bac495be6619b1a47da5707939476a1774e47112e8b36b20a66c4f1 SSDeep: 24576:iy7f83PV4gElx3P6WBWkmf3egDqo8o93lo6pjEkB:iCzgLf7qo46pjE8 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | 1.47 KB |
MD5:
55653079cf15d3c8fd4b1ed0ebc526e7
SHA1: 8b2385332eda7631a746ced7c1a3a72ae203cc95 SHA256: da877d93a4ed0586e0df150df2cf4cd5ee4fe68356417e23ec3a93914fca5576 SSDeep: 24:PVjxypV6VYubj84CuRscM86FFp8WJzvF0E26/9gtmd0WYNXRIAuBFULoGLq3SIX0:x4pVEYuHC786h8kv/D/9gGIWzBFaRKY |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | 0.94 KB |
MD5:
dcc19d96ce964ed329be3368450f50e4
SHA1: 753e4ade967f2d71842046760c8cb4f0d6728467 SHA256: 71200d1f93d9d0b397d81c9ea56c9d4bc4a66384d3d68eac26d72a5bbaa7eef8 SSDeep: 24:GYGG7cr2q22OW6NPa9cglpLWsM8Mx0+bnnWBRske:dcBOW6o9RWrtUake |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST | 3.55 KB |
MD5:
0b40dc281a99ea7f3a6f6e149ca8341d
SHA1: 9a9da231776770dcd51d4910cef3bbe75a70fb52 SHA256: 9105448fec90daa9e47cdb89448867d8e6d9ed6aec224731c75418806b1b75a6 SSDeep: 96:9+9qGVayy3ULUfYVuwx6N3uFvEdkPGb7TbcT:g9qGEyyk4wVtqfyub73O |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml | 9.18 KB |
MD5:
d33e3dfcff5edab9a93211ac621b9220
SHA1: 55eca9077f39a1071f2dd1424ad13b34ecad130e SHA256: 8ccc9682bcbf96259db211db196d7e2f2a50e01f3acb49cac9e570405d95484a SSDeep: 192:4B5GZMkswxRTk2Eh+NbpdOikCKh/cAfvK5lyvjCFXsD+ycfat:4B2MRwxRTk2tJrOikJJfi5rA+5fat |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi | 2.40 MB |
MD5:
13e938b128dee40affd1530b4f63915b
SHA1: 7041d0a11ccffa0630ef004bc68f02b804e51afa SHA256: 7b918b1e51ce8038054fba7d9f57b364f694a37facbfc7d6dcad60e30cbf8646 SSDeep: 49152:CHYLL/WoGWeLjN5HRYnSt20yeJji34mElfaL:CqLVVHqA4S |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm | 26.61 KB |
MD5:
4bc1ab158f4d95eafb5d22f40465c666
SHA1: 12923100acd1c3bfbaf7f9cd425cccc111258125 SHA256: bf2f2b0aa27db5c38f27e2980eb04fad26337bc4af0cfdd00714eb973c5c0da4 SSDeep: 768:HHtuK7Xpgs4NTf8g2Ox8KuN5Upw/4oSaa7:P7Zg5N78lKYUtoSaU |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm | 65.67 KB |
MD5:
f24fae374bef8f3e34d44166fca649ea
SHA1: 3fc0df3ef4ff65e4d3d5862123b1157d02d76bd6 SHA256: 93ed4e5bd82de7e0d4dfb729fcef28eea84814b2c8f01f6c79187eeae1c60359 SSDeep: 1536:lPlD/HA2amS/mOQlIOz7nIV5aD7U4RgK8y:lPpHS/mOrOz745s7UygK5 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll | 187.43 KB |
MD5:
83dd85fb5873148dadd2e1c71b80ea84
SHA1: 37f3c3463f949032eb73fb4db9bf6d87cd9f31b5 SHA256: 52d977fc500c3b15b8cec1fd75457ff1f5ee7dc9741344e7055a161804da49be SSDeep: 3072:bgtI2nuI1XBW4dl4Y4/4Z4UZ4Y14z4m4sr4iC4w4+J4P4U414/jb364g4t4U4+4o:whnuI1JjxQpscjb3X48 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | 0.85 KB |
MD5:
9ea051c61b865a8806c9a8b3f5331193
SHA1: baf5cd0d3efa61cb4efcbe6cc6a16bf56b7a2d7b SHA256: 3f03bf2a44331f90f33ef961f8583da6d7413647e99b8b6ca6ec3d491e21ff42 SSDeep: 24:f5Yyt7nY64SGf4cI7BN3Uu32urWez87bdqhcB:qo9ls4cI4uGifzQwhQ |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab | 7.88 MB |
MD5:
90e699e6ba69740e54459a197a68daa1
SHA1: a3a99b1d74f23b851e9c91ae76683db396df1509 SHA256: 3fa899291ef47badd50922495250616963730b73794565fae7e0d89fcf77086d SSDeep: 196608:apua/qmm4dvbbCaLWiAsaF5jXk2dYYP+cNp:xvqRmaLWhj1XwYP+cNp |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi | 3.53 MB |
MD5:
e69edd5cf8a96bde4bcdcc3f0b033b9c
SHA1: 2b86475a0b0d64448046349e2208828859546069 SHA256: 215741e9c5c9cd09ee87a5d97ea5526fb1c417b1162c46a810413292a45da31c SSDeep: 49152:qvlLsUloOZlxyt+BDljNNHk3qS920yrJoDNpqTIIIIIdhh5Ax8yB:qxsluyAwDhpqTIIIIIdq |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab | 16.65 MB |
MD5:
e74285eeb1cc93a28c4377c0180bff74
SHA1: 30eedd31a8b225a53637d2f889c219a42c2d75a7 SHA256: 13673693b386435725daf3d39f30e3922276339385550da5c771c88e1936c7a4 SSDeep: 196608:abCS6U3OGj+OBxERLwNP0EvnPzzbqJtq10AM34J+dVGOBJcxPHCXv:abP6iSASLwvXn4tIS37rzJgk |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll | 640.55 KB |
MD5:
1ca6207d2254d3c8ece434fd142782ba
SHA1: 3cb00d83c6aca08a98db33ef1811153c64faaf3d SHA256: e64ec46cb7b9faaeaa29c0a05fcf0de56aa4f142e4f60d496a7a3f7c7033f751 SSDeep: 12288:2hr4UCeeHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axPFmRyy6aEt:Ce2g5gmO791I0E5uO9FAN9mRyyzEt |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi | 848.55 KB |
MD5:
a9383a9b4c1ed29852038413a178b4ec
SHA1: e69bedc01d190fd3ccd9697d97ce968cc1f89e7b SHA256: 220f9590b30829f02b56edda05150c36eaa9b51363eca1a585b66939aea2952d SSDeep: 24576:i7f83PV4gEux3P6WBWkmf3egDqo8o93lA6pMoKD:BzgLf7qoQ6pMoY |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml | 582.42 KB |
MD5:
3aecc20c4fd133bdc13a222e31cd845e
SHA1: 1e9ff009804966067026146e090e77ace29d4abc SHA256: c4f3dbb15aed939f2d87c53ba3bfa859f9e5368eca57986c9885a5144433d8a2 SSDeep: 12288:bI2wfCAijFvYFpjKW4MgJZZ/CAi02uCAi0IoiyEfCAijFvYFpjKW4MgJg:bIB |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml | 30.42 KB |
MD5:
dd82dc64a354ea9f696bdd42476feafb
SHA1: 99f918e7a77af86e8912f2c834205591dfc56434 SHA256: 260aeb1c7394f13b6dc33e71f36a7e349742212c658f41c8ff2e8b0591dc5380 SSDeep: 768:XtQ6qCMyivakvBOWjo1qrBFYBaQpBJh0pNL0:XtQ6q3akvBOWjo1OPYBaQpBJh0pNL0 |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe | 1.31 MB |
MD5:
7737ffd2c5bce3d3043defabcb0c84e3
SHA1: 3419f5deff99d103a54b4575496eb713f4b4a031 SHA256: 57b1a50200e1dac5177617caff9b75087dc2edd829b0e9cf7c3a5ceed54aa6da SSDeep: 24576:BP0Dfh6HHfKnE+RUi/LHgZJJkbipjZSMv:ufW+RUi/LHkJkOZH |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab | 13.47 MB |
MD5:
85850d9d04f705353006a58b4c106332
SHA1: 83196d5dc6453c86ef222c3ada29438cdb7ac436 SHA256: d095a1ebc8ddae9832370b837241e356de6af92348e15c4d4293115d95b2d0fb SSDeep: 196608:EmQPX5JnY8khJczLZKt2m/6rGzudE8DHGgr34qnaO6UHxO9nx:1Qf5H4JMLZKt27rGqhLroqnabUHx0 |
|
|
| \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml | 16.34 KB |
MD5:
ff774d7267b5ff435eb769eb999d9e67
SHA1: e061aa8565e052cacdcd4aa7e4ddfc318bc00a17 SHA256: cc2730724e8b7597f575d9697a06bd7f6989969f50937c48fdaddd4709f08f50 SSDeep: 384:py6m7ys8EABss7P2hHsnjkRCYJYl3qeBFYBxzhqmAh0pNLX:prmus8bdP2hMjnYXeBFYBZhqFh0pNLX |
|
|
| \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe | 1.31 MB |
MD5:
4e8a548549cbd3793c066ad4ff65853f
SHA1: 0f50c91bf122e4750c38b39f4ac15ea63e2d2d47 SHA256: a020139e5e0d756c0ac380333a29e6355a8b841af9f28033bb122e89ba41da98 SSDeep: 12288:IeryDBDN0vbfvfhhSVvnB1diKLHH7rKf8YmylcH+zFUib8I7XHgZwKhJAeCGRcAA:S0Dfh6HHfKnE+RUi/LHgZJJkbipjZSMG |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml | 8.57 KB |
MD5:
ae886b981b93d53ef7fcc108b0ad694d
SHA1: bc03ede73f16f989a61fc1ae85bbfefa58bfcece SHA256: e7278260ed18793c3b3ab76b4b1821ff5deb18ad7369faf5ceb7fd8c203c2676 SSDeep: 192:bJMHZDe3cz6gNDULDhmxZFnYrZT0OwFXkhrJxgOT1JhJVnB0iNN:biZ56gNDcDhmx3nY9wOwFU9J+m1JYq |
|
|
| \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL | 96.86 KB |
MD5:
cae061d67d277059a06a261da5d18f50
SHA1: 3c85864b49d86dba60cac337b013930bb0516391 SHA256: f6e065f995832987c99dff6e4bb510b4631e9fa980ad0bcf1680817e9a0e9e48 SSDeep: 3072:DR6fB3gS4naNpvwXCj/P0WbRx0Nlk/TvQF2Z1s:D4fB/4n4wgsWbolCFs |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE | 614.96 KB |
MD5:
d9edd86b585dab8a64a73adb3781852e
SHA1: 9303cc205abab41b8f1631b8ead440f4cbc9df65 SHA256: 5aad30e846ffd242ebc45c5b38a2cc7d1ea5e397df12247646eda0aa95b3e762 SSDeep: 12288:lwQqvEQlFR6XJazB1siN9I7XHgZwKhJAeCGuGi:n8zB1sioLHgZJJknGi |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab | 26.72 MB |
MD5:
8c48676e43667dab53a945b526490140
SHA1: de4906bee39105a4f3a8305f86895c127cf7c2bf SHA256: 4cedb8dae2c0bb02026b408d9a05e68db2a90babf42531c0266984a5c52a5cec SSDeep: 196608:1ryUwmW8LerWo1/kU86BDeDSbD76Vmyb2Pehiy59BFiO1TDkVB:1ryUwmWEed/P86B6DSbDUmPkBgiD8B |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF | 7.53 KB |
MD5:
66dd56b609f5bf28a07fd652469352ed
SHA1: 11fdf9a300183ae6cbac9e3221626aa9da9ec8ee SHA256: 4b279f3effafbafb40b84e0d0a3b373eb35422a928ec107c44024da59b000f94 SSDeep: 192:e2j8NqGwYIPE/ZArBq6ZohKHigBveklR81ZxVA1f:dAwSCcArBq6Z4PgB2klRC3VSf |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest | 0.60 KB |
MD5:
69282653e7c8d50394cb95c13a96b96a
SHA1: 302087af1f3a1f19ed4e4dd7de6016df55180257 SHA256: c28271c2f8b0842c92667d15e837222f5c347f8d45171df8580f71754f502752 SSDeep: 12:IQZvEnO8pS2NXN+uOzOvxZoquJ6sCVGycYCPkUgL4IegRZjnIN3o:tvW/NuzOv4VHVyCQ75RZEO |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP | 172.23 KB |
MD5:
5d8fd4b0fb93d22e60986734141b0fe4
SHA1: bd3314adb230b9545d471ef9ebeda6ec0f798993 SHA256: e6e682acf585e393b1acda74c7675fcbda7e52e4c3301073772ad994eb5bc2f7 SSDeep: 3072:fcSeaBNcEANAsHeEiZs81WdXyrSxGjcwmA:k/aBN2BeEiZs81O4SxGjcwmA |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll | 1.25 MB |
MD5:
cd20402c9feb5b88565743b6e62681b0
SHA1: a6bb0d4d02dc36dc31e904a4614cf0c22271b84e SHA256: e875e1351bcb4e411dfd29b5e31f6a825a3b0b07f47b69fde6e1f8a5ec350412 SSDeep: 24576:OcLfJsMyDHcB3pB/QMZAEI04u8OTVzJLHgZJJkpa:zmnDHct3oM6R04u3ThJLHkJkM |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll | 37.91 KB |
MD5:
673e1797377a835a55799ad3fc13b63e
SHA1: 9dfb9509187d8a156751814ddfcf812b8b6a7308 SHA256: db4703adca132a85b56f15d24bd5b657be5b0fd2d13ac226756a41a43d871c53 SSDeep: 768:S1FJeaSrxzMMB59KTYx/ZicMCnla39Wxe4KseOleZsTX0ZMi2jXHUI:UeaSltB5A+/s0pxeSeOEsb0q9rHUI |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll | 1.42 MB |
MD5:
58695e7df1ae82b49104cb02255f9b02
SHA1: db565c8a6f2028d50493cc3d917ce65d99d02be4 SHA256: b3d5293c58dde4adb43a8193354144d18adbe7291623e94f1dd27933b8cdb3ac SSDeep: 24576:R4oe66XXvijTIJuP0SbZLJ75COd958Gyd0VQGTVy7HCoLHgZJJk56:Cn6zoubZLJ70Ol8/0VDTs7ioLHkJkE |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL | 2.03 MB |
MD5:
93f1279dc0b7c63c0a47aef4f0b0caba
SHA1: c717b2c7119b6030997f031dde93ff62e35cc967 SHA256: a0760e26ea6708f9f30eb45e9ec13ea3161b342c8ce347f7e37d6f63c2047cfa SSDeep: 49152:VS7k7VYU1UU+LKil82uIYHwHKofVc5ecDmQ9w8ho7OKmerZAT45L6Mf:qkFUU+7DSuQ9xh5erZAT45xf |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL | 193.46 KB |
MD5:
d6aa7ffe226102af8d84b80147d77077
SHA1: d29c5d078f03e108171eaf99b45e98f9b134be4a SHA256: 4fa083a089297af3fe21467544587d4c2647d7b72822e9ec6d483bc675d68b7f SSDeep: 3072:aONlGkviXjj80ggbjD1UECecjgQd9+95X:TNENKgtJ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL | 409.46 KB |
MD5:
d1a2a9e90c314ed0c17046ee7c871435
SHA1: d424810632b60c3a662b4670f48b3d749d67c254 SHA256: a33600f555b098cc5feef36feb159d4df103ad72f77f316ec3dd915af817fd72 SSDeep: 6144:vdC7fKAAWm84YyChs53LlWyKgq9Ie2Am4a2OI5p3s2Lfve:4xm848i57JWIe7mf2Tve |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL | 40.93 KB |
MD5:
9c7466c592a928e08414845e987b5e12
SHA1: 90743edf7c3b3c251a459f1a72128f62c1549959 SHA256: f80086e3aefd8b98e9dcc91efbdfb3e2deb8f2c6e2faa91e8935b5d1f711c31b SSDeep: 768:LEFp3KHi3JwSaEMlO1s+52J7XJ956lvBok2Ei0MMi2jXHUTw:LEHiiV+MBooL9rHUTw |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL | 11.43 KB |
MD5:
fea6ebf4749be89f93db9691b0963941
SHA1: eec50f430c3106c1ba420a84f99551e96afbbfc8 SHA256: 6e676a46e7ad4b587b75b1b0123e040784a98b1e50fac8b70770156886862e94 SSDeep: 192:2A8HYSuL9wj5wcX/byDc61fgb+UX3R3D9y+24sJdcr4nVbG7TpyI01TrGwmFfK/Z:ho/g51fUX3R38+xszc28UZZ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE | 118.38 KB |
MD5:
31cdbcca6325c7ec1cb811530977602a
SHA1: 4bfc13a7177a22299255fb86241b678d1b1c7b54 SHA256: 468118a7894acf01638f8f32ee1e35aded30de0d9058e8463f81d694dcd5f2ad SSDeep: 1536:arQd8uQXxro+pXLAZZxLIty5weZop1+zNP4ZVGKJ32zH9rHU7:arQdhGo+p6LItKdWOzNP4ZVGKJGzH9o7 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ODBCMON.DLL | 29.40 KB |
MD5:
84dcf849b873f89a34f501d27a67eb9f
SHA1: cb1b987bca23887777803632e67d6ba37178978f SHA256: 83ccb60e9e7753aed3ffd079406cf1c1eb75f384e11d03e3461f772c3c31b2a0 SSDeep: 768:3Btbts3sE6z/QBFG/+wXfCyZVuDuO1mU/uMi2jXHUvm:3ryPSIe/+cquOkU/Z9rHUu |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUAUTH.CAB | 6.64 KB |
MD5:
2d1bed9be8c3ecfe5e21f43edf244b58
SHA1: 87ada0995c394043f811dbaca2f84ab0b9b2ebb9 SHA256: 802c79d84b53da081f5d077501f0f334637313a31591429b4d2cf5cfcb472572 SSDeep: 192:JZrnC4F8iJL5p3oQN/45tli9BcW+7maVxk8+Ssj:u8JNp35V4jg9SW6jsj |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe | 227.43 KB |
MD5:
eb764ffdbe6042b5c77b66b8e3643f59
SHA1: c830ab440de2b6087302236ed99d91084d05ff28 SHA256: a4cbe1872509d40a3902d9dd0f12141f2d04f44be1fa16ec715d14c882a5bfd4 SSDeep: 6144:cW8QUO65ofgD2z8Fz5V6pVJ+DgZvjX4L6Ue:mQUO1oO8FzTUpjIXe |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSSOAP30.DLL | 688.91 KB |
MD5:
7f74d3ad6e11538e15c895f710d1925e
SHA1: 6bdfe933f18bf63031033d5da6f101c6460174e1 SHA256: a293bab355af1fd627a42d837e8a2f551b690ea937d6ae06872f4bebb25b10e7 SSDeep: 6144:SrVb8WkEIdMa2xm/W2yFdjV+/GF7ganDu79Bf6y2lveBrlv5dRgGZnBEOQCnOLg9:yzm/Zy4/GROjfBuCX+cKZqCk |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUOPTIN.DLL | 24.44 KB |
MD5:
569213612285afffb31a7f1ff23d5b3e
SHA1: 56ac88f6924ceadb31fb026f66fdfb426d73a64f SHA256: 701affc5534d7ba61676fb60a54af9ce149d91603530d3101e3d07deb6f67a81 SSDeep: 768:iTgY6IVGWPnaERq1yerZZOz0AKPuMi2jXHU3t:iTnTJaERnerZZOzXKPZ9rHU9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL | 54.88 KB |
MD5:
a04cd75786ed54705827e7a487d5d2a2
SHA1: 36cd45d007337fcd7e86229bda81b20475bb7823 SHA256: 9df9702ec8acec824968d34854292ade9f4071adf38c3e9075f32056955cfa8e SSDeep: 768:hFE8/BmxjfYb1uXAqrt596laA/+6lp2mz2lCYu11qgckCtdpOGu0GP+Q0Mi2jXHG:hFE8J0XzrfARmPlo7RwdpOGMWk9rHU5 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll | 1.21 MB |
MD5:
e27ed98cda8d3cfcc36080397c462b4b
SHA1: a2a24791df681d9a17a073b179a6bbe11b726134 SHA256: 30ac6a34cdf71092ed700a4df5571a523777fe5e84fcf6be6baaadb735cc163d SSDeep: 24576:5SAAOZWsa2EkCYgpzO2Ux+p1bj7TVvq+LLHgZJJkQBE:MAAIFaz5pzO2I+vbj7Tdq+LLHkJkQm |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML | 1.58 KB |
MD5:
41782ed07e568b5637a86a5949ebc2a3
SHA1: 1580fb7507179cb4bf0debeea1326b88b966925d SHA256: c98d656ba6b99c002911bbb48ab516a8427d05d1c5da81a42d775a818b20c787 SSDeep: 24:j8dr3rllFj3ySgmw7T8DT4Qw8kC9pUSQBV90qJ4/VFFmWpvj9uYZAS:j8dL5lFjifTTiTzz99pgA9j8MAS |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML | 2.29 KB |
MD5:
f0515d925ba1568a8f95005b210b8158
SHA1: ef78099497e1fd039d4138aee8cb1866801ee2d5 SHA256: a0364a74a59396a2ef3a1e5aa3bb0d0f5281b41a6b9acd3d27390b03ea4674b5 SSDeep: 48:AGj+il+f47yobz7qBS3iphFQhETS5JPOqImrYrOs0B909g90W:3+m+W7qBSyp0KTS5JPOqInrOs49v90W |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSetupPS.dll | 46.46 KB |
MD5:
0fdc6d026bf4ae129111626d83a47a39
SHA1: a72cad717ccbca4f36bba81c793c3cbf0970d5c5 SHA256: 7eaef75f0bfafc881550e442ccd849666c87f9fc55560961d46d5c6592ada8df SSDeep: 768:dk2mK+2bfv/7MPvBv8oHbGigJRpdypF74lc027LB8rnrbNQATkBMi2jXHU8/:dWCr/uvioqigJRpdiilcpBQrbW0v9rHp |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML | 1.89 KB |
MD5:
b86aa9d8d41fcbc7709592ee4b64f243
SHA1: 1c4cde7cfa2a5b6e78f5409408fad9d2c8a3c8bd SHA256: 4d92d53819019010ae01cc6b25f8365ead392c4d1d149254b1b3f92f4e447cbd SSDeep: 48:ex2kqcnjnvNezv/MntvzSMhmg8Cw1/Tx6zRCezP+Qzv1HF:eUynj0zst2U8R/ER7PH1HF |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML | 1.47 KB |
MD5:
39c2b683b5a5ce777f6c86ba9c838a44
SHA1: 3fd7f224a769878452beff7f9ea71a5c1028144b SHA256: 38e98aafae489ae7ccc5242193a002093665377d65ec6beacc795e7499b515c8 SSDeep: 24:CkJ7ILwcqtUUMHINxxRtOBWeD5hTU3/WfTiFKC4WmY6COOaizYw1oPGAd4Ip/rOz:VJ7utqVHXtODhTUPWe0zhCnvzYwSZdhW |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML | 1.99 KB |
MD5:
29d9370872b49348a7d2e35e7634c420
SHA1: 1cebf39f3ff9e2f1899c3038f639a05b754af215 SHA256: 174a351689bc688fd7e04f72323cb9ab7c9fdaf3af8f9901d3f745c45dd17c33 SSDeep: 48:WY59Gjtgcl2Tsjzo05VwzrF88g3djoy0roxq8+:WY5A5gKbjzocwzhNg3Zoydxq8+ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSETUP.DLL | 7.04 MB |
MD5:
8d37b824296a8813ace63b517f3ec1ff
SHA1: a2beb7c63b2250e7253e814a65a13a96c99a67c8 SHA256: e10f95b9c3ed79fb736189b2a167b278b089282311c7ea2f81f901ecb6b6c371 SSDeep: 98304:20SHNoI+ml3KSSGA+ZMbSIASylJ1CFBmWRnCmDUe/0:20SHNoImFBmWRCIUes |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML | 0.84 KB |
MD5:
a39e2750234ae8a01033437703fe4e37
SHA1: 39d9c80cea96bc0dcd054677f687f3a1593b0059 SHA256: 1eb2f2402b64830b84ab15897cbc7d6c52219a1e873c0035b59152da78d10ef8 SSDeep: 24:/QujX8z1pW1YpQ5bnUv4WEv99e9oUzgpwf1t:ljM5pW1Ya57Uv4WEl92o5Yn |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML | 8.57 KB |
MD5:
2a4b5c78b7063d6f0f3f135723f4659d
SHA1: 3dd0406b21beb9fef7bb21ceec8b4cd34177a611 SHA256: 11ec5bbcda7394beb675a1c41ccb17a1c36d46d0f1f227c856b3f9848a6bd37c SSDeep: 192:+hPBcMoE50DATtzW9SYssr1rXqmVDuvSfBZ65R072qw4I:+tB7FoATtzW9f9hrPh/ZZ65RYCd |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_ES.LEX | 386.43 KB |
MD5:
7155f77c171cdc8c8e9cc3584018bd53
SHA1: aa100169b9b5af796ab6bda0bce42bf5e8ccdac2 SHA256: 7098dafff64cd9b168a4f5698e7c1f9b2e4e9f2c4f99708b81e559ccaf9a0a90 SSDeep: 12288:XuQP706G5DJXQsPyh20oxMbrkmg6RgaWLNKvYDC3:XuQPw+gyhUm3t6a8NIYC3 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_EN.LEX | 433.67 KB |
MD5:
c3df04bc9e7f2c93658cec909b552f9d
SHA1: e8a425a7eea294ad55d98c929aa206fb520915a6 SHA256: 24a4ae274334a2a4d9da161cac036c61b095ead498f3b8b568e024e47266080e SSDeep: 12288:Jq/NGnyUWrEx+kjZhWZI1YVcSeoQEtlUw/cP:JXyUWr4+MWZI1YV0alUn |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF | 46.64 KB |
MD5:
2eaf52fca78c13eb9f3ef1929d0213ca
SHA1: 764e02d01d40ba9cea6c857cb56010ddecf16894 SHA256: 8eb5392839e80d7c7d48335ce56b32c73ebb1a67b8ad213391006e4c8c06d540 SSDeep: 768:JTOLpLD6v19pEfzF2Fl3A3K5ZVMpjmgWnD:9kpI19pE4Fl3A3yVMpjO |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_FR.LEX | 288.78 KB |
MD5:
41173fe4ec10e7e602c958455c393a53
SHA1: 0afab73215e1d36fdecb6f12f603957b15ef5c44 SHA256: 0a36140379afee8bd26e2847e56d68667842f300d98156c220226d312e46e074 SSDeep: 6144:AftlAPRQq4rzmamFNEAB1zKIW32+B0SlsL6ZIFiVvB4Ngsen/NB6paeSK8yjT069:AzA4rqaoWu11wR8su+fzFeB8iT0tu |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FPLACE.DLL | 176.93 KB |
MD5:
d4ad6b68d281a12c4b48c3075cbb450c
SHA1: 723bc955ed43fd62fb99fd51b928ceb0d4d3e546 SHA256: eb3fb7f4b39abe6d150233a545ee39a8a9b8a8d49fa2f3c56b143c6f73e0cc75 SSDeep: 3072:h8jbDq4oY648x1gjpVFeVHfxnODKf41xLdFuOUTpwYAMZa9otb:hqnu41GxnO5QpwTm |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FSTOCK.DLL | 155.43 KB |
MD5:
634c1a4ac46456ac6585e0d02e2fd407
SHA1: 425db044a89b4ffd0a82bc5ff533f5e881bce987 SHA256: 313f2bc816a9f66da292206875845f695a240c57e8d16352fc513ae8fb79690a SSDeep: 3072:cMdCVe22JWK96mx+yLbhGOe7ByRwnO9VZyeyUt19oC:/dCVehZJXhwnOMeLV |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\MSTAG.TLB | 13.41 KB |
MD5:
4b62eb800ce0a86a7c6eb0f20a35c72e
SHA1: e34e0ab22d3dc19bc683b79aab17e1fc62869113 SHA256: cd6535c988543712eca5477f9931d3d53e6f0eaf4c9befe50ff4a2514e727d33 SSDeep: 384:2aYw3wuXgGjkSPiIcguMt/Pel521y8l3+oRtN:LnXgGVug9a52bsc |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\MOFL.DLL | 356.43 KB |
MD5:
a2506ab6f618c9c1e41e09f7dbf611d5
SHA1: 167a9ecabc262259585065ce0ba710fa02808247 SHA256: 437c8480582ad4af1c5c35ed32df5b60c7778ccfc9f7e9c1f140e7a21c1e2ef8 SSDeep: 6144:nSTFDJV4kgWgXoOpmJWFpLsOl8rVqswOY:STFDJV4kCAsXeYs/Y |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\IMCONTACT.DLL | 98.93 KB |
MD5:
e7c3964fbfa1861e8100b2eaff2f747f
SHA1: f495b143b75dedaa1414137b23be2de16fd0975f SHA256: b5992417a9ef1b311dc51887a268f9ddcf58c0527c22979e336458abd207a591 SSDeep: 1536:mdxz96AV2MJrq2ihc/ajkGl3AjQy/qSPMIje4yS5NQOluiKMgvCmwyf5LKd81Kka:oz0MJrq2ihH4Gl3AYmje4bQOlK1g99ou |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\IETAG.DLL | 229.43 KB |
MD5:
53d4a10925a551f9ef4f01991a3020a6
SHA1: febae99dbd47d52d46ec37282519458bb64ffc64 SHA256: 3c3e27d72c32c4007cdffb19efb9f5728d2675ad869dca3dae3d95779c65cef0 SSDeep: 6144:ORnzOe6atbvRMZYWjjqVk0oRfcOs1zIp7/:qp6IvRoYiq+sc1/ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.DLL | 108.43 KB |
MD5:
7dc27cf3b6e5767c1cb282b742ed5aac
SHA1: 557aed3afbbcb67271f75ff70655178f7a016c99 SHA256: 1874d7338f3646a96f5b19fd193c651648ebb753ee741f50b1047a1af1d850c1 SSDeep: 3072:EgwgIov/rZKfwNjHerABOlau1zr4GqwG4batZhe95n:KZo3VBOlnrSWV |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL | 222.03 KB |
MD5:
e5345fb7b78ad57f4a7965424b57aded
SHA1: bffa884ecad422e79322e44e19e1388ab917e32c SHA256: 1a4f136a79770713715deabf1d806b67ea9b83301f799fd3d2b6f38c45d65ded SSDeep: 6144:5zVrzSAIo1DhGyeR9CYnlbzuq2H67L2lFTMiS3IWtmTvdpg1zZWy2d6mp9mf5leq:C |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT | 1.13 MB |
MD5:
9949861f90487c50a28c0f335719b405
SHA1: bd6278f530f0eb0cdc37ff70294cb1635beb8bdc SHA256: 83a588b66c497e42d8f56eb75342a4a74fc49ba2efad00b8f641de4b58bdc503 SSDeep: 24576:WRORrRaRLRLRiIi/A/N/RxRGR6LRARlRTRu:c |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\RECOVR32.CNV | 35.90 KB |
MD5:
f7e6cc66eb32cb42a7ee143e29cf1446
SHA1: 9260583dc639e06cc0619619e61f1ed4535dffa1 SHA256: 8c9f0e8b9b419f0e4dc5fa3662df9fa558422035065b8eed83568674975073f0 SSDeep: 768:ih8C5WWh7d0rkf3i6IVZt3/Ov9SD7Oha4oMi2jXHUFg3:iKned0Qf36ZOlSDl4P9rHUFg3 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT532.CNV | 192.41 KB |
MD5:
f423f2991f16cdf46f17c2097593b22a
SHA1: d229b67c3f9bd1a5e54338cd69db8afcf4557fed SHA256: 936e2b40061afcc5ebf4a327d56ebd0808d930fb3a51dca7c5c951cbd55bd9c1 SSDeep: 6144:gbqGXZKQRWOlnyJOxJ456CuLTBwC8FqzB:Sq+AAvyJCJ456lBQMB |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\Wks9Pxy.cnv | 55.96 KB |
MD5:
50fca4e206c769e1e6bbb267771ba87b
SHA1: 6df0da1a4258840c62b24614f58b35533a6ae8c1 SHA256: 10b5f74391df641a981971a050b15455919a008a052482cee7a354670bb05c71 SSDeep: 768:TVLIWG/dXZX0OoMts2+We0vJ/kNHGKKuidr35hc5HgQ09tx3vCf6qa0dbMi2jpvE:TVEWmxZ9ofrmYihcSQ09jvCfCcI951tw |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.INF | 0.57 KB |
MD5:
e3d291ac2aeec605fc425bc1f261617e
SHA1: 88911391da9deec2404e87b27d7403bea1e38f23 SHA256: 0f9b2c44264a6195e87a97705a8ecd4579a771b2e43b7bbeef353f37454ebee4 SSDeep: 12:cfyEU6zoaeJ/PyJkuiBG79F8s4SL3MBIULgmMIBNAsa4Mz7Y:7huiBG7Dv4S8BIK/bAsaW |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG | 32.29 KB |
MD5:
8f0782624deee69d4250bb44aad31b4a
SHA1: 8a10489da73354fcf6040a46cdcf72c531bf9293 SHA256: cf5395ff3af836cc05b81a9e950c2a5f1157503f2745b74ec573c2b2de8de74c SSDeep: 768:U3JnuNPDpMWg5Mjsj0iHMAIhqshvOYGDSGpWr7+uD:U3lCehMjs3sPHhvOYGpWWuD |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG | 31.14 KB |
MD5:
afeb7d18a2a6f716bebd9b8a0198cabb
SHA1: b4a69d3ac0e653d2828f67842f352f9088bd4139 SHA256: cb638aa04115f3ea318d10f0e63848a9c8b71e5e506c4ca1d7b9a7d2d52bed7a SSDeep: 768:xEYfL9MUzoC4igUAeSWAsAubZEJKYeFRSmEA7j5z/YgwIK9mP:9hMUzbsihAJubsKYeFImEA7VzYiCK |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG | 34.15 KB |
MD5:
71474178b82af3d75e0fd1352af742d1
SHA1: 743a04ad7a9a21acacb6e51ac0d3b50b746efde5 SHA256: f9d3eb230707441e95202b39f8c07b2a4cd683d9cf8c313c3410d923bc61436b SSDeep: 768:KHEixCex6FzQFeKmrzmVZpJCSc5FmCJ4yiwQHKyujf:KkixCexJeKmeUjmAB+E |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.ELM | 98.49 KB |
MD5:
e8471c8fd166c733cf0fb0a582bf652f
SHA1: eae244d5271b7c2dc56ba537720dba723f9592ad SHA256: c9ca6363fbde5e00b56aa5299e4fd4b40370562b9fc4fc228d70625b5218a279 SSDeep: 1536:dFsF4NEbf6cl50xbMAhal50xbM/F49L3wWNL:vs4KbXoMAkXoMO9jN |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG | 31.89 KB |
MD5:
ceea3a41d8006000b317c632f4c3edcf
SHA1: fac9e1a34136a5403bcbae8f29575b1d6890bd6d SHA256: bbe6445dff5d19afd8691133effde9e5e431900ef37a08b4b5afc5b1267cc7f2 SSDeep: 768:b6ea8yct8Rj8iYdskk7oCTQeIqdPtgyP3H3J97LqrQ:Ba8yiqj8F+kk0qrbP3H3J97Lq8 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG | 19.94 KB |
MD5:
8f8325694ddb2dfae46e394c3cfa7e6a
SHA1: 68f2566a69187da4a310b18409d555d9ef4e34d8 SHA256: 5d77958a1eb4e07d4256cd21b2eb180488b5e9086246c97f3bc47184c0904827 SSDeep: 384:gUzf96fWO/hwQc/bHU9jA9UvS8J29m3GCH5k22MNHvpfkA32WcaZfN6SPun:gAfQfh5wbmsSG9m02HxpMA3vcaJin |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF | 1.31 KB |
MD5:
0858fd5de6228064f3b07de136b6ca15
SHA1: d4efe88aa89de9515ab5e764d39702d06c145a34 SHA256: 6cd266902408bd38f79f6e49ed144135d0585579a1596e88423fe3544c397360 SSDeep: 24:9uFB73rQmBPCrnShEXOGhwufYTQCnfEtLGmaKy2jGVi53zLMH0joFJ+goWno3ODQ:96BRarnDH+7nfEtLGmRiVi5DWUGJBFn2 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG | 20.14 KB |
MD5:
18cc69b4ccacf0417a0f7494c85b5fdf
SHA1: 499560f239afda06f0c7873dd1c35911060ebf46 SHA256: 5123c9256fefc43b5cc195446ce44178cc6277c35dc1a930f509624bb3f33577 SSDeep: 384:9psrrqbA4F3FiDQSF2ZUrhDfDFH3/g+H94BY+DetpMZxjgceJKRIMDA:9SrGbhiDQrZUrhvFXpaBY+0kjVo |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.ELM | 53.57 KB |
MD5:
681cc7a49ca2d66a249d00b476db4b0d
SHA1: b0b92b77c72d5696a2662ca122165fb120189987 SHA256: 7958b4f28062559ca9f34ee5dad7c9f7f1c8947755731a2d0fdb237ad6c21417 SSDeep: 768:+F6J/Q0YQL3qzmlmomIgd0QZx/kMJbSZ20aWfVNi:F/1Yu3KCi |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG | 59.35 KB |
MD5:
ec3f70e1ba1fa8f4be92f84ee5d64842
SHA1: 201bbfe5fc54cc220eb57440b5e30cfdb36c9ed2 SHA256: fb4b9f505fe8e277b4db4864fcee0a42aef3cc0491a6c58c664b74b2fc289d36 SSDeep: 1536:0uyRHvBsTtfV/8YL5hTYK4GISJUmw8irlzZv6:0u4JsTt9UAFgXX8irZZi |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF | 3.92 KB |
MD5:
89882695e53084ffacd24a4a406f9578
SHA1: 74bfb0568d16fbe456e363bdd996df38cc94c097 SHA256: af074e4b701c10efad5f779a2e688b79d1005c8b80499eabd2cb57822f5c1015 SSDeep: 96:pekKQEqlF0SjNUkNEV0atLq6n3yytrqls6oRlNyndF13:8kKQRlFvjCkiVfLT3yyNqls6CNidFV |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG | 32.55 KB |
MD5:
c086e4e2280ca43c9c40868b16c33c89
SHA1: ad6b7551702fc787f7e7d53df1368a5fed6a231f SHA256: d54e9d7b0fdc30a2900d1dc314bdf72a13674e03ba0df59594b08e7945d085df SSDeep: 768:Gs3txbN4W5oIo6oxnqHqO/JuC9UFkVyVJ0yPg1JDD/g7hkgTLQw:GQBoZHAJ7+FkVC0yI1FbgNVQw |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG | 24.57 KB |
MD5:
3dea2784c60252580c3ef43304ab8cc5
SHA1: 55ca23473c73166953bbcfb28f3a9e38cdf95f18 SHA256: c12d26272469fbd8c6c9afcd31a9ccd6c7451d547dd4c80a14ff4b4ba3cc17de SSDeep: 768:CrQlzIrmtJjNLRCgbCeQFuIMZYLz4Dh5/IT:FLhZbCrUYLzgcT |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG | 18.43 KB |
MD5:
8695f9565bdfa05fde297556d7f1439a
SHA1: a4b1e8fbd3b6d8087f36d59dc477c0c4c001b5d8 SHA256: 7aa8f8e5750fa9a5f8f408d3dcbe7a5179ad450a9d25af81e0d1d7126c6bc4cc SSDeep: 384:tovLMeml95bo0CWFsP4RfxcCIxVV6+JUFQ01A4JxakgDV7QeJDPp:SvIekUN+7YUeEu8xzcVMQDR |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF | 5.05 KB |
MD5:
5051d7bc7f23f478563ecfe6b014e3e6
SHA1: f3a57a43aaef9bbe846ab485aa0eed18396d71b6 SHA256: 58d6ef164d4ed4ee2e26b3057443230ee39af406f2d4e76c945c345b9808a4b0 SSDeep: 96:UQiZpVK23+aZBjJcj3Z/wefFYab5q07voijqCKLDsLM0CPsOiJn:UQUkM7+j3ZcGq0DYDkLM0UdQ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\ICE.INF | 0.47 KB |
MD5:
ec4677764e8c4ae0c2b88e1f6cc96aff
SHA1: e32cfebac6a7e3498f29a4ec9405ea28e62ba57e SHA256: cd61968fcf5c67f506a4686c80dc6f2a6791b8cdde1ed3796852420f287e0889 SSDeep: 6:i7hC9/KBLFdPojfVhszhDE0pQiTU/wDvY0fqggZXOLqmwGMTtwOxU/4NC/oabf8T:i7Q/aPojkbpQR4ffqgA3GOc4I88ypb |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF | 2.54 KB |
MD5:
23f23516967d37a9b6bc31c85bb3f28e
SHA1: 808b10a6eeaee38bf7284d5612333db3be04fa8e SHA256: 8ae4a99528887f2f0ee09458f3c8e866b26f0abe524ca3ac727916e0b11f550d SSDeep: 48:O6kOfANLkBIyKGaNQt8TCrodT/Qjhak7wI30AeiHZeAhXoALnj050noX/hQdeaMu:ZPULkBBKGaCtSCkajhak0I3oiHZeQXJX |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\JOURNAL.INF | 0.54 KB |
MD5:
95be6ec3e8ba3beac2dda2ebe3be4200
SHA1: 65df438e90674449101034aa5c2c592e33719301 SHA256: 275a9e13ee367ad2b0e599cda0d585aae91a799e27fb867efe3aae9481099bbc SSDeep: 12:wSiqBv+/H6yYoSiUAtFvTBfni2H3p7fw9mzvcp3EwkZ+dUsaD3hmdtt:wIkH6yJVvZn93p7f2f0wkI2ZD3hS |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF | 1.25 KB |
MD5:
caae996ac1c0092b8f0f851d73fb2936
SHA1: 8cc352883194d0b825445f10b34517ca51d5aa39 SHA256: 7d0efdb27f86e4286bb3a551d0dc4c2284dff0e993d77d6952cafa48d0fd3129 SSDeep: 24:YRuusfZhIOvFlNKM8qMPNjC7j+6+Yw1N+9FmBm32GzLgUXpvVjGMH:YRuux4C7PpCm6Bwe9FmBm9gupBGM |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG | 11.35 KB |
MD5:
b6d919e6d39e39eb44958922d33da62f
SHA1: 9df428c6cd938b58865d508a56e41c08665abcd4 SHA256: 4a6b3ae00cb91c166dca96fa91f939d7bc63ae9a9f454b46463b06dee998a9ee SSDeep: 192:v5rOk+xqLRl4dyUEqYexLCmE+NrC6SMBWeVViV87u3CMyvPLlR7fPK:xrO/GfU7tCmx3SCViVsu3CDTH7PK |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\NETWORK.INF | 0.62 KB |
MD5:
87609bef459b811cd8a890aee13592aa
SHA1: e5f0de57fdd527f0925e9518505bb90e90cd1814 SHA256: dbb2e6e7d1910753689d68f11bc227f2c9df0346de8077d360f270e26099bd49 SSDeep: 12:cXkQ0kw9XaB+0DVlNd1QA8AQFs70xO4KChfnlk9FG5/2PxEbJgBOF0v1CC3LAjVr:UqlcD1QH40xUChfn2G/2lBOKv8C7At |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF | 1.38 KB |
MD5:
9edc860a6f114ddc9613520e954b30dd
SHA1: 2f530e1bf03bbd370045c44b008eb7dbca2fbb07 SHA256: 1db86a4c6a0a9456e46cfcca2b3ca53db41fb336dcdfccbacfd13ec58f7c025b SSDeep: 24:ZKQopgF/orXGESUw9rMT+1isMWqsy1N43M+cNn9KBf6FbpFKq+hqtgWoAreNki3o:ZKtgFQbVStV0+1isMHBTi5cGUhKq+M0m |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\SKY.INF | 0.48 KB |
MD5:
b4b7102d2b03cd364f06eb02a980a5ba
SHA1: f6c57c1d0dfbeafdcfd88cba910790b7156673eb SHA256: 09aecab68032801c6cc4bc54e9f4195d5af77029997bc891ebd34c2a1ea4b4a4 SSDeep: 12:L1cw9pClRbzuhMxfFUFGKlAs/dxriYx+ecBUyGuQ:KkClRbqaGFPA4ViYxvcxQ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG | 28.67 KB |
MD5:
098dd10eb234230c8352fda773f989b9
SHA1: e0fe64f6cc6f8ae8b03641470d9b5c36a176bf71 SHA256: 2242fa3fac2ae2771fe17449c4c2819c53019734d9e9a9b6bcd98e4390f8b1b7 SSDeep: 768:VG/2q3Iz2rve6CwNHa5unJvnA4TI8vLMZXxbAA0:VM2SIzYve6C2pBnTI8vsRA1 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\SPRING.INF | 0.51 KB |
MD5:
d4def61ca9c41706da44f918d6df6ba8
SHA1: f42c2616696b9d5c0657cff10c50045dddb4ecdb SHA256: 9472636e266efd5d38ad804b4cddf726e5200dd580f89cacaace162bf6f96471 SSDeep: 12:ewLHhVqUnX/MqFNxs9TMuIpyaZBcdqJ2ioFg2SulDddJ2Yc7psskthZ:enUvztJLcd02io2hulDddJ+pzkt |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\SPRING.ELM | 66.79 KB |
MD5:
aae681ca3e842b34bc73611c5a885e51
SHA1: c71aa0d4ecd1a650f53f6727f80c4adf60bdfb0e SHA256: 3c23841418353edd55e6933b474c65a70b08a39a8b12d51ce68112e8494b7d43 SSDeep: 768:eW4mGcFq6UcQzmS+gOqtBQCxRwEEXcULIqtBQZdtnHmyuas3T5iWKVz6tMfFfyNi:bMq/3qfQCxccULIqfQyi |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF | 2.52 KB |
MD5:
1e73224f9b8e90799ea5688dd65e0d6f
SHA1: ac40e1f6ecaf9d1423f4d0aac609de0cf30c3952 SHA256: ae3dd581c973c1e203fce5632ee8b9efccda955885075ad03c126377705f0d1f SSDeep: 48:Y114DZrLxE/9M9hH8eMjW8KMYT3XhDCgv2+6O3bgbj9CkCxoSl87:wCDZrLG+hcLjXKMGhDCgv2+5b4o1o |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG | 26.59 KB |
MD5:
cb0542971fb7250079b776212d955f0e
SHA1: 6a513bcaf52614f1ca4406e3080d5ad8c9c3e90a SHA256: 9f4aecaeaf2602aa3d85b535d66400482d65f2cb0161143911bd55b55f9ad8dd SSDeep: 384:60YEpHN1mn0keh3rQj+GUTuuIWdpox+LMBUsqpGad5Qusrv:6qpHNslehbQ4THw+YBUsqppQuav |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\THEMES.INF | 7.16 KB |
MD5:
c0cffa91b0cebf09ee507bd9efea0b7a
SHA1: acecdd86329361dc10d262f511e3f88fe1a8574b SHA256: c5707bd0e39ccef7a1da0b3b275a59af1cdeef27c19eb9d76778b47dc191e9f5 SSDeep: 192:k5yBIvxNuVksnAKFrTn9t7iYsPi77575M3U:TIJsDV9td57EU |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\STRTEDGE.ELM | 56.60 KB |
MD5:
bc1b06dcebd922cc8ab1c6fcb7cea76a
SHA1: 8d52f8557386be61b312a0856cc89db9796df1ec SHA256: 4b3f1c9e8bb87425811f3952e49187f3c043f4e5020fde46a3f19d643b2ec58b SSDeep: 768:5I6kRQD80a1MhuxDSL94nvFA+bkp90mAaTnESpWvK/NBP:e9y8PBSL4i |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG | 19.12 KB |
MD5:
5de4b1a596c9feeb95a77442ee585cef
SHA1: c706ab27ed86e50a514b63290704f61477941304 SHA256: 6f79131f7c926ada2e08aa0507f97cf2ed5f13848591cc7bb2a5750276d2c06a SSDeep: 384:ERoagoMbVS3QfcVNIx9VoDXX6VVhh9bXkBHMNgS2jD2OaRqJH5M:LoMbVkQfaEVoDXqwBI2/95M |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG | 29.51 KB |
MD5:
20913720153ab54f0dc01abaad4c5138
SHA1: cea1d7d213f6ef9b1e050bcc7b4b3aef6ca14862 SHA256: 45a93b21d9b3882d970d20039d97a78154c8951e75be8f3dce54816dfd38000a SSDeep: 768:7iyCoorbb1Qjn7jlRDOgSdE7UXwYwEh+mt:zCooHb167BRyrE7UXwYwEhlt |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\WTSP61MS.DLL | 216.05 KB |
MD5:
09c16332ff5482f2cd8a551f429819ed
SHA1: 76bf610316ffe8fbf6d4573a776e725cc703b5ff SHA256: c6fdce25dcf1a592307a59a54d64f57c564ed079963bfad5bbda397eba41f468 SSDeep: 3072:e5BTZlDf39NYR35OKmCgcTwl4R1px3O5Sm0d5empTzghYlDnThqmjHj1Ox1QYYtt:Gl8A4Nd5empT8hYlDnThqm31PuZhMsZG |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\SKY.ELM | 80.36 KB |
MD5:
b51829d4701624f4d491df48bd039eb9
SHA1: 55a2b02ffac4f38dd712bf32df6c8d6eb3d3f3b3 SHA256: cf62c74ab4a6e54a6059ac12089a73e41a1d981e9a65524bb2aa22923d380955 SSDeep: 768:6V1NgkROfXSiAoqAyNBFJpCRhGy9VDL8BxWxwQwTzv0kbBr9ImME6Br+tCCFIKBR:s7gk8vxAoqAyNBFrCKy4BxjamMQf |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1CACH.LEX | 1.55 KB |
MD5:
a3682bc682d8f74e5fdbf94e3333946b
SHA1: c278aebe3de8a946ed7cd18d165c42387dba08fc SHA256: 9a3b897a17938e9a6efa353e3008cf368920df985d5ff5213db9eebd51328267 SSDeep: 24:uF1Fx6KAJfKHA+9QqC6o4Muq3Vf3JBiRf+XsdPJfGMWp7v/BE+5jPeqj:01X6EkL5uqFiRdBfGRTlj |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1XTOR.DLL | 68.94 KB |
MD5:
e33b8e262d4111389a3536008176aec7
SHA1: 5455881b4226f1e97fb0cf0463d1b875497d7f0b SHA256: 392f0b43c672d760c29c2c5aa5cc44c732f3d90ef88bcb8ef1dd3480f024e87d SSDeep: 1536:RnzqPaygEJcPSguPZunE/ELivYelSoFIvtGO2fTBY9tleX95K:RuParAvPZunbeYelSoF4tGO2f1Y9aX94 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1CORE.DLL | 174.44 KB |
MD5:
d789fe1f3c9b50cbc219e44a6db99dd9
SHA1: 9f7b5894c017ddb08fbc28e1cefe333e08bed4de SHA256: 384e2fff70fdda237c817eabb2b02cf81e456e18e8994442ceefe24d41c6010f SSDeep: 3072:n59ibUhePAA7PvHakMcCXEn/PM/4KCqeTXHS40dOcyjRn4d6UKc95F:n29FL0dOcyFn5ML |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM | 407.20 KB |
MD5:
8c65cddbbbfb3b63eb7a91af8680e6bf
SHA1: e250e8dd8c921209e1c2dc6062ce290e4c338faa SHA256: 553a3f6588db07518fad5989fe945c38d93c74febb27ed7f555bd556d9c546c3 SSDeep: 12288:13kgrSLv0wJYyWrIbcv3sI7EJwDQSXO01INP:10grA0R+cfsMEJwDQSXkNP |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll | 966.88 KB |
MD5:
8c4dc4b980e6bbe13dec83e6ad5c72a9
SHA1: 5b6f72e864bdd061bb7ff4fe3e7a2bf577945f41 SHA256: cfa459bdd7277f0d595b142ae93f9709f09808635e332691c56f8c1594ec7584 SSDeep: 12288:oc2YwE7VSxeUMUCcTd8Ht4lYyF2f78oyoMZggTSN:P2DE7oxeUXfaHtkYZjiQg2N |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1STAR.DLL | 259.91 KB |
MD5:
de022a5b0754ba5c2d47cbd53c62083a
SHA1: fd6b6282fb640ce54a0b9ea47b09ad5b2331c92e SHA256: dda93f6e52a14cadad69e08fbdfc3591a282448f9dd47d11882e3ef1befdcea9 SSDeep: 6144:Wrw1/Yix1TGqcvRlJaZgaNpXC2fqN+qju5oxM:4w1gm1TGTrJaBX5xiM |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM | 121.10 KB |
MD5:
6c2a7fec416c5ebe9af9e5d000b510d1
SHA1: 13f10a3e0574165fbf477785ffcafdd08678805b SHA256: 2a63d3c31f903e6ccacf8b9e288d3b478d0753573ac9a7c0bc3849a7258c463a SSDeep: 3072:lsJcCgEMladkzNUnHH9Vcr4Go862RIF49wTUYQ2:JEeXNmcrm86D49wT5Q2 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\VBE7.DLL | 3.51 MB |
MD5:
b3c2bb81428559e0dd008b6ff907a8ee
SHA1: aa98f18366b0332bc7a6dfad915416f9e4b9ecd2 SHA256: 9e6835ce8d7c8a35073bdc86774e1e09cdf48a68c2131b7e9e427089f9ec9406 SSDeep: 49152:VfKMeBz7SRz3ch/uSYSzDdd17yYPDvRvB4g0ADVun4/ZT/J3PIW4:VWThzvrPVuneBPIL |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM | 922.90 KB |
MD5:
2478eeb1cee95d5fe8be4d557b076696
SHA1: ccdc10967e66d843fd87ed49f5fb56f91cc6eb7d SHA256: c2b6b4f04e7fcca762a6dcac24e6c960a03f98daa2314c702c40b33a2410c4f3 SSDeep: 24576:W8SLY1r4snoHaFH28EB4nTDnBGue2uaZjFkncfgPwuVPyDS:hfXCal2L4veraP3gPwuVPH |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHGTXT.SHX | 191.52 KB |
MD5:
4737cc4b9d3c583950fee5a5c8498c4f
SHA1: 80b91b17c4eb8052a41fd2e25e31172066942112 SHA256: 61966ab0cfa0cb49c1e9ea63494fdc3db6971479ea8c18e1f5875ad9774d91fc SSDeep: 3072:Admn1iM45YP94091NdlcJZPVU7cQ00x8KrIcNIgNIsJTN0rpQdQ1ZJYUpjNkwN6Q:8M1945YP94091NdlcJZPVU7cQ00x8Kr2 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll | 835.38 KB |
MD5:
acfea5b052a271dcf5b6d0a16d1380f5
SHA1: 4d7a81a16eb54184dd1b791b09323cfe1e1f53e3 SHA256: bcdb798854941fac46b87a769114f13ec6e5691c187c17580db85f8c26f07e7f SSDeep: 12288:QtBtFaU5q0DXe3vz9GvVoXMl9UE3YzYgyAAX3A+:QpJ9re3vz9G9oXc9j3rX3A+ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHTMTXT.SHX | 895.20 KB |
MD5:
e439886b8396db989d401add9cd84910
SHA1: 112068e25fb5ac6ef44992a71dd8cb77fc12172f SHA256: 7694437a4b0ff13e85c2bc804bf2573872a97af983922fa3a6e68bff764ee276 SSDeep: 12288:D6GEhuMndaTartzKhplUYFKvCZZTrxlk0EKthj7ojILELeYWvs1E:DOuMdltypuvGxm4thgIQ6vwE |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll | 17.89 KB |
MD5:
b44f3a300136e239ba94995020317293
SHA1: dd050a32e036af47babffb7e5a077ed36bc00dc2 SHA256: 86120c5cf76ee3ddadc8fcdfdeed146a5a68bcfb6b7977274ae4b6accdacc11d SSDeep: 384:vnqQQnsKmSj7OqQVLuIaNbDGNaLNKgHLXci2jXHUkztv3:isKm+OpVLuI4bwGNxrMi2jXHU2J3 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSOSV.DLL | 43.93 KB |
MD5:
876f3325dee74aa2097c28e52cfc5610
SHA1: 218815ff8b6b169223bbd8b160fa569ed7078dc3 SHA256: 6292e1fb7918123e9cfbf7fc42034ebae70b1f0122f088afb2e3234f903ddd26 SSDeep: 768:8GH9IK6gHMmORaFYn52HHHHnG6FWympO+9nV71afV6JMi2jXHUZnx:NIK6gsReHHHHCpOcnV7Iw69rHUxx |
|
|
| \\?\C:\Program Files\Common Files\System\MSMAPI\1033\MSMAPI32.DLL | 57.43 KB |
MD5:
d2e087849c9adc9f3a579e5d15cb5314
SHA1: 8c7770de6cb52556829f604f7d88b77c113189e6 SHA256: 1b2042c4b2d886233992c1901f6bc2e31eb0f4da849b8b4ad6ba894361f59568 SSDeep: 1536:K4h6s7NOi0m+HcvjxbqrCzQ8zuPd4Q9rHUeuL:K4hx7NGmwKjx2KzS4Q9oee |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\MSOSVINT.DLL | 10.43 KB |
MD5:
20c6235411a0db24f8679e45cc8c7987
SHA1: 4c17cc70a7953fb05bbf368996a39d8797c0b41e SHA256: 3b333c3960b4168c6ddba58eedd26458477935366ce0482302cbd05e19f4073f SSDeep: 192:V0EU7Yq3m+vTnmFb/eW/wrgeDug3xO2iwkA6UAhJXi9rhaOGz:VrU7JdbnASW/wia8y6zhJXIrdGz |
|
|
| \\?\C:\Program Files\Common Files\System\Ole DB\xmlrwbin.dll | 194.57 KB |
MD5:
a246aee820027c1b2f36ab062191190c
SHA1: 79160d412bd9402581282521afd46cbc9c727b9e SHA256: 995f4aca144337ffc64500e2de442521a174b0bccdf1f3d81670e5fb6c01c9ac SSDeep: 3072:rAupKe5tCCTrXX2lcJgqhEfDF/ycVO1JhLyT6Osr38Cu1o:rkoTrXX2l6ODF/ZVEZOszao |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb | 21.38 KB |
MD5:
5e125b56aa64ae4e40b758a8977ad110
SHA1: 2c2a16ffcf44edefd52c5fa86c6b2d46fac5974b SHA256: 85976d995c510798e53176e538f52398017b1c897a9b0121a8ed2b94c466cdb7 SSDeep: 384:0pBlQ+GARmuf8zKJ5DfYx59+K+k4mutF3mWmllI8WMy2GWzZLXci2jXHUsU:05WcLUzYVK+PmKFW82rdMi2jXHUsU |
|
|
| \\?\C:\Program Files\Common Files\System\Ole DB\xmlrw.dll | 275.57 KB |
MD5:
d4139717e1f1f8b010fda2482744eed3
SHA1: fa3082c2098010c5dbc7261c8fb2aabea3e66b4b SHA256: be9b02ef609c9d0b10ae31ce24199179fd1bcb3d685530defbd4637ed2d2e4bd SSDeep: 3072:uCc4XQQQsGyXSoYDxD39C1THORd1RB0sY6bioJ5Q1Q4qswcv2pLgX5HF8Cu1c:LZFQMZYDxj9AivWoJ4nqns3XDac |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL | 2.41 MB |
MD5:
7521e0afa38c09f08279539c8daf0ac3
SHA1: ec6b8a96523f137d60af02f586f0d4a615ad0a9a SHA256: be1fdc4e8d4955c68ec1647a5806b54c49f4203d014b5ad76438304ca98e0faf SSDeep: 24576:mkta/4hS3Ql8tQmW+9HFoekIKg//efwTKCF6BSX5yCroe3Jt3rCytj3//Gl:mktwgliXW+XoZIl3efe0BIMe3/CI/g |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll | 46.90 KB |
MD5:
b663c70145570cacaedb4dc76b790e3d
SHA1: 7f640f0a5510f195c0f376ef1586d9bd761f8a93 SHA256: ba3bdeff170411667917a260cd61d03e39fbf03f48bee0d16e1f342c60012579 SSDeep: 768:CU6iIdPJphY3SXDhHAikazzuB5aTPvDwN4op/pJnV14QI48WAE8mfDLPMi2jpvF:CRrdPbhYYKikAO58PvDwN4cRJV1KYAE2 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll | 180.37 KB |
MD5:
db86e4d2ef170c8029edf7c50bc82ddb
SHA1: d7e9e9d33afbe1e96b8f7253b5e2db1a76bc4f81 SHA256: 7da5476a0b1303f28676edabd485b1a3a9191bc6b64f9b6f92a7ab5ba3932ba8 SSDeep: 3072:Y2Z3kh84YdcbpzqKbsLZqbGrGn6pTMUeH3RtYxFilgVXpPXxppXTh95o:Y2ZNRdMVmsUGn6ponHzIRLi |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll | 9.89 KB |
MD5:
c01fd51f8a6a69f5f13c7f5538169dad
SHA1: 0e9bb29f36aaa5ccc60aabf0d429210264416d46 SHA256: 135c54fa2d7872102c3507b6f7ff0c45f5329bb9854d0a31b7a1a8726e18db9c SSDeep: 192:pLV08+E7n8DZbzHpgSIrnhArQe9rKpkNYAwODEjB98gnJX3Pkx0qQLcdIvjhn/kc:P08+EYDXgbnhKt9+pkeAwOD8B7JX3k0p |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll | 378.38 KB |
MD5:
1cc0729b12068800fc5322be10465049
SHA1: e873743323be791febbf38910c55ce3d396846be SHA256: e0a0849aae8c08f545a8d39b93fb8ad8fed6750c32e05930b8edfdd15607e143 SSDeep: 6144:lWcmPqAE8Mki1/jHiURwF7tv1iE3PjctYKrO4ANn/E0iFs:w9rEDj/jHibP1/TLM0ia |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config | 0.75 KB |
MD5:
e827abcd5cba94a6006b3976b5974188
SHA1: ebe312d9a3b73b2a061c4bb37db618438dba302e SHA256: 99df6d8ba390e770582bcb455ad4167a3101cd9e06101337b6f46708ae173bd5 SSDeep: 12:J8ig8xHz2yBwEymNzOqe1sZ6m1+tAGjR2OQw7WKET9TkAdogoikg5CcYqBTrXt2V:J8i5xBwEHH7Z6A+24oHAEThNoWf5hJrY |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\ICAD.FMP | 0.37 KB |
MD5:
02a0ace4920341731d3280f106119b94
SHA1: b22e4f9dac987bc15ca66b598f155fca5b032ff9 SHA256: f045080e4e9d9ce92720781105252bf3fc8da5285c745a0060015ec0a351c18f SSDeep: 6:8sHy+9xxKr1ZtbCCZi49h202aBSOEtJNurujOO5fz1tVFZzJ3sf3Ebc5jJR:8szchZBCCYiM6SOEtDuruZ13XUDD |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\IC-TXT.SHX | 10.80 KB |
MD5:
5536c2541a32053750de605a600a816e
SHA1: cd962d3cedf3a5cbc1f881c96ff93d06a6bc4b08 SHA256: 4bd1f3f6ad7fea4b88edca59efe33aaa8e9b08e77fa9642e1e92c42b2138bc0d SSDeep: 192:brbxdA5HA7rcKu+0UibtNgxBol5yVabFWZmqvXMI0gwyLDSQjdZ5+FvU+:7raIrh0u06abIkgF9T+a+ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\EXTFONT.SHX | 426.53 KB |
MD5:
7e181df42304b0622a88b6ad339f5669
SHA1: 75d76a76cb4b56e619144b9036304b5e7351a4a0 SHA256: 4bf4782fc9fe68a90ecaf62f555aaf495c6298d8ab3c293bf7fb66d0a6fc0111 SSDeep: 6144:ESFD3vJEUcRh7Q3u6aUAearitYNHxY7gfvrs:ESFCUI0RYNCqA |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\GBCBIG.SHX | 881.73 KB |
MD5:
afe2007f14f4ccad9c370648b01f70db
SHA1: 44b81aa8a4f69a88965cfe54bb90b4dfa0dd2aad SHA256: 8f54d47a54337771af6a39a35b771cc3f67916818ffcac452c18a0de7b5e99ed SSDeep: 24576:rp1Hy3pahq5DNaG+RRvXMvJv+m74yycWWTGxJEri8O:rjyEhs8G+vvXAV+w5WWTuJj8O |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe | 97.39 KB |
MD5:
a01096b7c1b5529c1e6a6a0355f9fa0e
SHA1: 02b10d9aec918dd261e9560f410bda7218a165e6 SHA256: b0441f10b5544ccc58481d2281a43fae58de5121013339bd4e2856a9593d078b SSDeep: 3072:NzzfyTE+XSTHwEmFvdbiK08GgmZBjuGkKgnpAkqesE950:tyAASbtm1dbi182iGNhere |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM | 56.72 KB |
MD5:
97dce6dfb5ab51490fdea69d3901fb81
SHA1: a8878b4b85566e2a78826144f5f638d7b63eebfa SHA256: 5dc47b5a58c14bcf168202c3232254cb744bfe9b9671a51aeeb60947a1de35df SSDeep: 1536:b6pw/tkns0AR4DjDWkMcmItHSrC368VL+B:b6C+jDQWkC3uB |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\CHINESET.SHX | 649.58 KB |
MD5:
f339f26ccc36bdc6f174b060f2563e45
SHA1: 285c506ff1328dd6a0bd5385a31d6b64b192e78b SHA256: 8bb8f16a889eff39135212dfacde1ce56f192b479f0dd0fd83b3a41554370d04 SSDeep: 12288:TTyT8oGb3jBDqXUTXlRFHT7xKmMWRKMXYOdZL0dHEWcDqhR:aTCbYY39tzYrak |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHGDTXT.SHX | 218.51 KB |
MD5:
a300443f9b530d77b1afed2a336dead9
SHA1: e5a76d6069232b5bcbab60ab2d8d055fe8c77ec0 SHA256: d4c81917a0d2f1fd8a3469bb8f2dc2e5439ba9d9f7c0bdc0497a8246dee01a42 SSDeep: 3072:DwBqExvf4KVrhLc1Or0PD4+LdkVu1EJBLaIvoBDeSF7HBt0Le/Stwdcio+:DwB3l4KVrhY1k07hdQfDvo6+ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM | 107.20 KB |
MD5:
fced9bcc4cef795282830d110594f714
SHA1: bbb2ec9b3f91cf4489fd0c63d8f26ce073b7d632 SHA256: 4217bd2208b739e2141d2a75102cdd844dc5d042b58bf1d0b588e6a6731813cf SSDeep: 3072:xfQbi1r2WP1+K5+J/0IFzYRj7idUHOrpLzt9AIP/rA:xfmQKWP13g0Tj7zkLzt9bE |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM | 70.39 KB |
MD5:
0732b8bd80a6f3e4e2e3fd38d00dd163
SHA1: 3410a335ac14a57bf7e778ca3533a72a1b29406d SHA256: 50313e557bfe79de8b0acc9e24e23caaef5f2698eb431c3146b39b07c5d44de7 SSDeep: 1536:PH+P2ngRSh+p9rJXAUVvqH5PAQhFWZWJBug1zX2XBw83smm74g:PPGnrJXAgvCJAUWZw7d2x3tmr |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\BIGFONT.SHX | 316.78 KB |
MD5:
0bf10f4957b1979271c4a1a60babee18
SHA1: c8501be18e6dfff2645437f71d5285b9b9ac89ac SHA256: 42b59b97754f7e2d7230d96be9e8a8dbdf754046095036a6743776ec2549bd7d SSDeep: 3072:IvRCpr9UO8gmF005x7WXCWawuHk5FvoM6CgUzImj+TtYb3gAcsouq8+WbiXGmQGz:McUuiNhkvBPgUV+6EAcsozJWda |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\WT61FR.LEX | 602.55 KB |
MD5:
5bea008007a2a15112c4d0ef24f368e9
SHA1: 72d666e8b176902c93f09356051387574229a9a0 SHA256: 5315f222833481517aa0089a1d520e8d142bb3175c95abb39f99ba93439ab4d0 SSDeep: 12288:+faF+hGPOEmdFrGt9rNcIlLUI9puhhVwBDvjVhcj:+facwGEmdFrwrqIlbpuzsdhY |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1AR.LEX | 2.02 MB |
MD5:
648252ef2c3ddd420acaa10f1e67f62f
SHA1: 41f41376a0c084395a96158bf4eb58e5d512ac68 SHA256: edd33e346c99c7d8264656753d452661138f6e62b80345fa1e1f26cab322e0d6 SSDeep: 24576:JOyWC8CQCJC8Cy1XULEeJL3fpPp+qM3ZHDwV:6TJLRnM3ZHDwV |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FRAR\MSB1FRAR.ITS | 1.40 MB |
MD5:
79aedec6f288b40ff4f9e0606c054ac0
SHA1: b71a736032808313a7094042222699d3d35c35e2 SHA256: 5ad9f996d7ed12879f124d1f32f03ef4211e1cbfd71238e2db9668e98e45ebbe SSDeep: 24576:o4nHDFqMt8YONscreHzHuzAfBkhUKnImhyoZL3PkTHqaUQYkwlsrmXjAoQEF/duc:FHDFqdYONNeDuzApkhUYIHoV3POFUQw/ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.DLL | 224.55 KB |
MD5:
8712b6dd7acde77d0ca8962c2fff59ad
SHA1: c495080118641ef242ed70fda33a4776d3cbf990 SHA256: 2c8779884a822daf8905c58f8ac03d99af434441afe187620f6c0763111d751f SSDeep: 3072:MDxniVxZ0r3vBuC3UEgybZfXwSCLX1zSqgIUW2N58J:knCoroC3U/MxXZCLX1zbgI528J |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM | 326.64 KB |
MD5:
a8ff596eee689a2d0724aa5622084e91
SHA1: 6cb8760fef344c401e14ff04f9499d58149c786f SHA256: d576360d70d376dc8fc70ac4c85a4c77e35e0d2338b73c29318fe7c1b17f9dca SSDeep: 6144:W/iCjekFDEFycCdSHbOXHOeV2IWYLXlB5cUC5M+YLhee1D6ihIxfwGvdnK:fCje+sASHbKVPpNxhLheeD6g1KdK |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.DLL | 224.55 KB |
MD5:
475829265285498b7624a7857a6fde35
SHA1: 974b0722400f2b1d2fef3fdaa72ba00aaa5dc298 SHA256: e704ff6f8dec3b0d1fc8b8a45bb8c1905e2c92148802f6848498a174a6bc0b9b SSDeep: 3072:B7rpYxzVNgfFBkbjvpzC34E4S3ZXkwSCvfRfO2U4ks4djN5ij:B7rpGVNykHRC34XIJkZCvfRfzU44pij |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENFR\MSB1ENFR.ITS | 921.26 KB |
MD5:
d5c966d2c2745945bc9e3c6ab623cc13
SHA1: 3036b4ef100f91f69a2208e10e5300ab47b4c7eb SHA256: d01be18228912790646981b2cef41e615285ee1b43c5a21b74283592f2871ce2 SSDeep: 24576:S1YfiG+HPp93oE/tvp9+WYwYyotoeSQyeEH3gL9irpGEX2:S1ONg93oM7YwY5toWgHKEG |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.ITS | 820.72 KB |
MD5:
cf73ac54e4037b3edd040a92608ca30b
SHA1: c74e7fc4ed735c6ae20a75070abb11d6a48a56eb SHA256: 586d39771ee822b8791e84b83197fb2a159fd5b28d4702776bd4d99a8225af64 SSDeep: 24576:QFdvU44SXjoReeW+gTtIlDDYilCdIJcVp9D:WvU44SXjon2tI98XSmH9D |
|
|
| \\?\C:\Program Files\Internet Explorer\SIGNUP\install.ins | 0.50 KB |
MD5:
b8e82d26383c0b0c5a0360c0c4bbd0f8
SHA1: 3a895598d69adfd4c906b5c6f6a0b1a00d1111e8 SHA256: 5144d0d8e3d04b6c1e62c400ea8c3d520663f83ca1e9912f5d8261a611ac0adf SSDeep: 12:f+ydMoOLJP6Nw1UinkROnNXUEN7YZ7mO3emTsXvezzYs:fDMoOLl6e1lnSOZUi67RiezUs |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENES\MSB1ENES.ITS | 955.33 KB |
MD5:
aaebac7f0013bc1075d846cc8710785d
SHA1: 5653fd4ba1da61046d5b94aee9d6f8c88197a282 SHA256: 2ae0091d9cfd61684841730aab854b8a9dbcda5914b481e7ee2efca11586dc45 SSDeep: 24576:RU6Expo2lu5EQudFB06VArUC4N6O8FIl0:RUBxq28563rA4N6O8FI6 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.ITS | 1.00 MB |
MD5:
653496689ed3abc558de4eca29d05ac3
SHA1: ef503679742fc5ccce205fdb6d482ed2ff3c7e3c SHA256: 3181fd82ae2007748320ad2d99ffd4923406ad864257aa89604f15889f199ef6 SSDeep: 24576:QIbUWwGqywx1TnO/faPRrBJPnSLqY+rgC4qf8sme+:QIbUWjDw7O/UeL0eqUF1 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\WT61ES.LEX | 663.05 KB |
MD5:
15d792867739f476ec9b9dff7e176fcf
SHA1: 121ec96798824ecb1e8c2b427975af5805cec89e SHA256: a009545d0b28e45b8e4324c5a2e42a2d3431a1a98036a39d9412b5b48b8872e3 SSDeep: 12288:eoZZLNBBpU2LWmsNQuiIIBuRZy0KvUt/Rm3+mUQNaidUj4W9pX:eIZDpUxrlXZy0btJm3BHEo2X |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\$HOWDECRYPT$.txt | 0.96 KB |
MD5:
ca6b9b77b2b60b1f793a925522b0422a
SHA1: a5debb35c6add4efa47d37bdb60bc76e75d2299e SHA256: b621a0c4d061880aebdd1c9f76e0d85d7c41fabf5abf93ed62edc1c93224eb66 SSDeep: 24:zkkRhfvix/Jd66MwCAdmoUrTaAr0rAQOGxOws4M7gwNbmTOhVJxbF9dY:zXDsdJkAm3rTaXkpGxOv4M7gmVJ9a |
|
|
Modified Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml | 5.48 KB |
MD5:
9348b1ce5161c4c37a043450c52ad7e1
SHA1: 34065c3c48195018ed05e97f0c83643b5aa55188 SHA256: db26378258f5255fd4234e543ba136ba1503a1e146c870e7140a2b6b57642397 SSDeep: 96:jsLxg27P+XTz5uyXywdOUYqSJLAbrysbj//XYLMWGsAtvYBaadJAVWGNxAAF726e:jV2r8v5BiwdO7qSZjsbDPYgW04aa/AId |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi | 848.55 KB |
MD5:
fcfb4cdcc7b9d9f3c8101cfb6d45d4b3
SHA1: 47ddc1093f333dbd5092a9c677c5c226af924e11 SHA256: 11fd06fc212698f387ceb821a16700a2f71477c36390926ec6d817fe6cf63254 SSDeep: 24576:f7f83PV4gEux3P6WBWkmf3egDqo8o93lA6p7wbt:+zgLf7qoQ6p7wp |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | 0.85 KB |
MD5:
3122026675f646641245aa126e171fab
SHA1: ef0318f473ad509a3c38e8838af6ea4db06ad236 SHA256: b16f4a57863a4e7ee488dd35132822a09201a3c47dc6ea974e717710f607e714 SSDeep: 24:haxQ92rhvPTxXei1SNSVWoK3ygxc/PEEt0KWMVaFjrt:haFhvbxzRWoMyzF0VDt |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml | 2.61 KB |
MD5:
cc67ffd73567ef67cb34f943da09da56
SHA1: 731f17f574b869dce89fa09a312b2aedbda0fb31 SHA256: fe7cf3dcc43fd6d5bec1357dbc663098d783ec491f953e812ad69599f3b9749e SSDeep: 48:nTtxdrGtnVCdl5BHK1KfV7lTgQqQS030YnYBL83IIpooJshH0rEOx:nT7xbqkplgQS0kPSIIpJx |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSPTLS.DLL | 1.14 MB |
MD5:
94bdfcd64eff9906c21cdf2e4256a834
SHA1: f09911330c7e5b9cf5f00e2454cd426736658144 SHA256: e96fe9ad47050a45513d86095a273eb7cfc95dfc3d0b920b0a48da8767e79132 SSDeep: 24576:d9HgzU86R0DZ3/qGa63kCymUAwi2xHoX1JAAz1TH:dJgzU86R0DZCGa63kClwi2xHoX/As |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML | 5.80 KB |
MD5:
a3e5d638357bc2461ef06f1570b78c6a
SHA1: 2e2eefb54d28cc5f98742f4523aaa97a1f5c2293 SHA256: d30fc3c13276e281a50a2e9cb166a0813f5701f080ebf8eee61df70a49828626 SSDeep: 96:/LDn+Y5bxbanluGO2mABZCDcMXhuqO/z2OL5rrbB0zpaI7wD3dikXvFE/2rvVoB:/LDn+QaluXIZCIMoqOyY1Cz0I7wD38ki |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE | 170.40 KB |
MD5:
0dd30398fe1f773277eee4c739f38072
SHA1: cadbc0163b27718e957cce65ff2beec99e78a0e9 SHA256: 9b3d3403ca30251e5f88c0b49e03f8fc74aeb5b16ffbf5d3e67453aa8679f17a SSDeep: 3072:XNrZSTAkXbVjAaX/0EVNt4xXqutFdNciAqnYCDb5+aVjMvhNOSH2S9on:XNrYskXbVjF/ZNGtFdNdFnTDYZNjPs |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\SmartTagInstall.exe | 15.43 KB |
MD5:
74d4ac433855a15973f730158427aa52
SHA1: 4b7f4fb3d12367fa118a75b68b646557bc14001b SHA256: 00515d3ea519a73230e6457ae6ea31e71c030e8e054f6fa3a4824692f7ce299a SSDeep: 384:bBpj9Ug0J3MnvjKjGqqBXXWMeXci2jpvk:bBB9oJMnRXTeMi2jpvk |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT632.CNV | 282.91 KB |
MD5:
00227eef869df5de405b3dc2d1dcb759
SHA1: d97105285e6020e3a0e4fbc1257d58d180fa9908 SHA256: 2148fada17794a3c041e23338bc6a4ee5a42123c166aa9c8777155582b501412 SSDeep: 6144:LkVjfKEEmPgU/9YsJx3swD3y0QdxFpTbEh:MTKGPgxsn3vD3y9bXTgh |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF | 2.83 KB |
MD5:
22beae71e10d8d80adcfa5b96188f5b9
SHA1: 88a8dd73499f4f541424c482024876d414f9bd83 SHA256: 4738c7239b70c566c3ff3f563564db72fa4a64f1013472417958d1dd81a95a74 SSDeep: 48:xk0vGl6icvKaVbspAnB3p5AnadQ1VXFQr9W5UmDaLu9ZO+jSRyovK7C5:mi5TP0C4NbKMGqZ7jA/K7K |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF | 1.57 KB |
MD5:
81108dccde9f4a0c6f52f2877458b84e
SHA1: 03d90c020f26137ff2a31e815dc46a94233ce866 SHA256: 71af5e6b5125c0965e2b2a92cd50a4013603c5f3104972f01c0539c088631e25 SSDeep: 48:bhieC7Y992sgNxymGTh5c2H0vuX24nSu5CF:VV9/gABUv948 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.INF | 0.53 KB |
MD5:
6096d95fbf970185ec897348789fb7f4
SHA1: 2147cfa6250c1b188b0e8661685f9b7989f9e027 SHA256: 51b4d8c65106a5dbf3ff63d138add2fa6dabc81865fda995ce7ee78c0f49d58a SSDeep: 12:sj8N5kE1ypR3o1u2BuOqztY8mTPbZ2he3ghBauLbva5L+gy6n:sj8N5kEMpR3Eu2Bt7PbZR38WZy6 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG | 18.03 KB |
MD5:
83d21b859197551228d936e99450fecb
SHA1: 30b30bb124d1756314ccabd05db5c6c818dca249 SHA256: 85a3a01f7da97944a4a3f12cbcadce229e76055085b12cc1fd8812b5e749364f SSDeep: 384:WOoMcqmn9ZueRP106hGDLk+QXmafEA4ANwiJqJo2sfh/d2eYUGaXOIMsO+N:nofqIueRP1lhGvm2UNwc1nf2eYUzxMsn |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHTGTXT.SHX | 633.07 KB |
MD5:
1b8ea46f081482d4b24bba9c4821793c
SHA1: 5f20ec339f35800f6a0438a9db8efdbfcdb26f7b SHA256: 977738fa24c7e2ce9322714dd1705b145eccb8e5d7ccbc5211535a33fa720860 SSDeep: 12288:sRhrIrywxGE4obHoaUFNuGGooENADAHWLi10nLdEE5:sRhrIGwxKo/USoXNAMWY0nLdb |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG | 165.71 KB |
MD5:
ab0f15f6f0f52549cf9104fc3c95775c
SHA1: 3e1c8ae81538e6b400c9dc3d0d4cbe40a1bd3262 SHA256: daba82cfabdf7595cf94919312cb741e27c1e58ebd90659accb935aca662975b SSDeep: 3072:Hyq9okmEhEIKkaYSRMo5BBXeeIiQbPiTe9IbIuQ4hfhqo/:HyVBXISRvenKCEhB/ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\FPWEC.DLL | 1.30 MB |
MD5:
921436b0880d059c73fb97d7bfd62e89
SHA1: b1b3aff5138eb18a294773f6cf5ce9fa686ecc79 SHA256: 4c35551c76832e65d3c11346bf964795d7a993e37a79102f528ac8f296e4cf0c SSDeep: 24576:AoBZfj1vepTkloWG4ohNZr7nxLNjelaJrTaogH1:A0Zfj8RkloWJoxr7nJNjelykV |
|
|
| \\?\C:\Program Files\desktop.ini | 0.22 KB |
MD5:
3f1ac35c836f27327e95480af023f0d7
SHA1: 043e71721f79897eae177c29c95098d75184f3ed SHA256: 7cd4ad0b8778a4c1caf246f43192e205172abcec7df13b23a89535e43f606f86 SSDeep: 6:elBadgyJFfaF33NeC+uhduMAtTXrUSo6QWhO:elBadggFm33NeCnhpyQh6QWw |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb | 15.88 KB |
MD5:
1442251f783da14c87f6dae63bfba74e
SHA1: 265fa83d8e44a3a3d764ecf6beaf5b1a0108876f SHA256: 40eb27193ccd500a69bc45bcff6faae83c45d6262ba74c787715024ea9b8c9c5 SSDeep: 384:k4QxFaJE+GKwX3Czlv+52fgCQkMu58LXci2jpv56:0dF3Chv+Efg9uCMi2jpv56 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBE7INTL.DLL | 151.38 KB |
MD5:
40594350c16a0d996293213e4bdba4d4
SHA1: 94f1b00ef92f90e912c9c062b836cd4c710b1ebc SHA256: a89d011508c72ff1ecb6536d5e1845a0b392b12b7f19c262a8ef286744084d5c SSDeep: 3072:VfMMqowMvjAJf/AX75PeaeEEXVpAMD5NiFmPKVHnopxLW05RJCcZ3BM95c:ZMDMgoXslG0N8m |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml | 5.80 KB |
MD5:
b32754c2cfa725d462dd302a79d43521
SHA1: c0b126058682def74fd4bf2f3fb527b259e42b78 SHA256: b1a8c6baac4165d88665271aee34e7674350de9ac422e72e5f21950dc68901ad SSDeep: 96:whTKOSTwEZUDQn9OJFeI1WX25EGF1xnUnftEET/zmWZYvBzOM5v:whOOSTwEZUU92Fh5E+1OnVBT/zpZYJtl |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | 0.84 KB |
MD5:
a9a606a60496bee5b7a764b6b504b74b
SHA1: 3001396f8fb670b8f4f54c343a5aefe5fc919f97 SHA256: e56906741d9857aee9758ac407494ef0e0fa7582b1cf685c1c5a298411bf70ab SSDeep: 24:IiWgbczJg+2V0rd0NNSXfEIi9AmyAoKj24XKLSR:IiW6cC+2VJNNaf36A9Y2uKLW |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | 1.47 KB |
MD5:
daa90ac5b4dca519dc30468dbb6b812e
SHA1: 022b70656a3ab26592c1e329c528489dab2991af SHA256: 186e512b3949176b8c3f5db502cd0accde0da8b1de8455f091628517d98d0cd6 SSDeep: 24:lrmbOBti5Lh/249yU1p2DBAcp1QjR0wEWT/eYIvuubbnIlxYXL6iMudnWya:lqbitiphe4QJmo1QFfG/LbexYXL6iMuC |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | 1.99 KB |
MD5:
3059d44b0200f010c6f43b6040f9917d
SHA1: ffe62f236c015769cdbf93f164bdf08612cbaa24 SHA256: 124c1a34b6765d38e46dc9d56b74377bb1271ec9c3180fef63237d0ef6cba9c0 SSDeep: 48:/yfbeU3LUeRMRN5+CEdr7lT38Xd4m0DgDWJudkqV1:aaU7jqN5+CE3T8XdtIuiU |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | 1.62 KB |
MD5:
1eb4bff8280345c7ee5c9bd3d23d1755
SHA1: 791c9fe20bfcab3b21a83d55fe8572cae39ad1ab SHA256: f5bad9ffdbc5e60fb15029a621453e7930ad9ea8fb36b84a9d8b52a1019ce7cf SSDeep: 24:f3OBY7180vX4uF66rFhkcWCqcJHr+/JPwrhV6yI0IF0beDez9cx+5lnlLluerbVR:ff7DoGPa0eJPwrhVbOFQa2lnlLljrJR |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | 1.88 KB |
MD5:
5e2796a5634eea9fda10ae34f1198a96
SHA1: 4e5fdd747f1d2f815b5a12126e117a7b893531b4 SHA256: 4460a3a075c35e1899174f2bce50277d31dee8620906bf3e73a62ff0cceca070 SSDeep: 48:Zw+IU7JC1Z4hFr712rvWO6NJVFDEnbglC6dHqT:i+17/hV712H67PEnbgVHqT |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | 1.47 KB |
MD5:
415fa1d5cc3fabdd29b980e4fbdab7e3
SHA1: 8fdd778eeea854d4796583734d2c954d5f6579c2 SHA256: dbd3aa4c896d6ff2a53960b9813f42e3e22d531c97ec1bdf6edee45149728f6e SSDeep: 24:MiOccKmJflSSijJRByEigF36xB20FdTVtonR/w1VnwtLlaAB2t+gL4hvGH9OryOU:nZPRQA6xlTboVw1h4Ll9AEZGdOr67IGv |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi | 848.55 KB |
MD5:
addd60a2b59ade9eea6aad5e8d8e32e5
SHA1: e783be7577afe9cefdd432faaca68d4b3033ef33 SHA256: 8051664c9bac495be6619b1a47da5707939476a1774e47112e8b36b20a66c4f1 SSDeep: 24576:iy7f83PV4gElx3P6WBWkmf3egDqo8o93lo6pjEkB:iCzgLf7qo46pjE8 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | 1.47 KB |
MD5:
55653079cf15d3c8fd4b1ed0ebc526e7
SHA1: 8b2385332eda7631a746ced7c1a3a72ae203cc95 SHA256: da877d93a4ed0586e0df150df2cf4cd5ee4fe68356417e23ec3a93914fca5576 SSDeep: 24:PVjxypV6VYubj84CuRscM86FFp8WJzvF0E26/9gtmd0WYNXRIAuBFULoGLq3SIX0:x4pVEYuHC786h8kv/D/9gGIWzBFaRKY |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | 0.94 KB |
MD5:
dcc19d96ce964ed329be3368450f50e4
SHA1: 753e4ade967f2d71842046760c8cb4f0d6728467 SHA256: 71200d1f93d9d0b397d81c9ea56c9d4bc4a66384d3d68eac26d72a5bbaa7eef8 SSDeep: 24:GYGG7cr2q22OW6NPa9cglpLWsM8Mx0+bnnWBRske:dcBOW6o9RWrtUake |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST | 3.55 KB |
MD5:
0b40dc281a99ea7f3a6f6e149ca8341d
SHA1: 9a9da231776770dcd51d4910cef3bbe75a70fb52 SHA256: 9105448fec90daa9e47cdb89448867d8e6d9ed6aec224731c75418806b1b75a6 SSDeep: 96:9+9qGVayy3ULUfYVuwx6N3uFvEdkPGb7TbcT:g9qGEyyk4wVtqfyub73O |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml | 9.18 KB |
MD5:
d33e3dfcff5edab9a93211ac621b9220
SHA1: 55eca9077f39a1071f2dd1424ad13b34ecad130e SHA256: 8ccc9682bcbf96259db211db196d7e2f2a50e01f3acb49cac9e570405d95484a SSDeep: 192:4B5GZMkswxRTk2Eh+NbpdOikCKh/cAfvK5lyvjCFXsD+ycfat:4B2MRwxRTk2tJrOikJJfi5rA+5fat |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi | 2.40 MB |
MD5:
13e938b128dee40affd1530b4f63915b
SHA1: 7041d0a11ccffa0630ef004bc68f02b804e51afa SHA256: 7b918b1e51ce8038054fba7d9f57b364f694a37facbfc7d6dcad60e30cbf8646 SSDeep: 49152:CHYLL/WoGWeLjN5HRYnSt20yeJji34mElfaL:CqLVVHqA4S |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm | 26.61 KB |
MD5:
4bc1ab158f4d95eafb5d22f40465c666
SHA1: 12923100acd1c3bfbaf7f9cd425cccc111258125 SHA256: bf2f2b0aa27db5c38f27e2980eb04fad26337bc4af0cfdd00714eb973c5c0da4 SSDeep: 768:HHtuK7Xpgs4NTf8g2Ox8KuN5Upw/4oSaa7:P7Zg5N78lKYUtoSaU |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm | 65.67 KB |
MD5:
f24fae374bef8f3e34d44166fca649ea
SHA1: 3fc0df3ef4ff65e4d3d5862123b1157d02d76bd6 SHA256: 93ed4e5bd82de7e0d4dfb729fcef28eea84814b2c8f01f6c79187eeae1c60359 SSDeep: 1536:lPlD/HA2amS/mOQlIOz7nIV5aD7U4RgK8y:lPpHS/mOrOz745s7UygK5 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll | 187.43 KB |
MD5:
83dd85fb5873148dadd2e1c71b80ea84
SHA1: 37f3c3463f949032eb73fb4db9bf6d87cd9f31b5 SHA256: 52d977fc500c3b15b8cec1fd75457ff1f5ee7dc9741344e7055a161804da49be SSDeep: 3072:bgtI2nuI1XBW4dl4Y4/4Z4UZ4Y14z4m4sr4iC4w4+J4P4U414/jb364g4t4U4+4o:whnuI1JjxQpscjb3X48 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | 0.85 KB |
MD5:
9ea051c61b865a8806c9a8b3f5331193
SHA1: baf5cd0d3efa61cb4efcbe6cc6a16bf56b7a2d7b SHA256: 3f03bf2a44331f90f33ef961f8583da6d7413647e99b8b6ca6ec3d491e21ff42 SSDeep: 24:f5Yyt7nY64SGf4cI7BN3Uu32urWez87bdqhcB:qo9ls4cI4uGifzQwhQ |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab | 7.88 MB |
MD5:
90e699e6ba69740e54459a197a68daa1
SHA1: a3a99b1d74f23b851e9c91ae76683db396df1509 SHA256: 3fa899291ef47badd50922495250616963730b73794565fae7e0d89fcf77086d SSDeep: 196608:apua/qmm4dvbbCaLWiAsaF5jXk2dYYP+cNp:xvqRmaLWhj1XwYP+cNp |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi | 3.53 MB |
MD5:
e69edd5cf8a96bde4bcdcc3f0b033b9c
SHA1: 2b86475a0b0d64448046349e2208828859546069 SHA256: 215741e9c5c9cd09ee87a5d97ea5526fb1c417b1162c46a810413292a45da31c SSDeep: 49152:qvlLsUloOZlxyt+BDljNNHk3qS920yrJoDNpqTIIIIIdhh5Ax8yB:qxsluyAwDhpqTIIIIIdq |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab | 16.65 MB |
MD5:
e74285eeb1cc93a28c4377c0180bff74
SHA1: 30eedd31a8b225a53637d2f889c219a42c2d75a7 SHA256: 13673693b386435725daf3d39f30e3922276339385550da5c771c88e1936c7a4 SSDeep: 196608:abCS6U3OGj+OBxERLwNP0EvnPzzbqJtq10AM34J+dVGOBJcxPHCXv:abP6iSASLwvXn4tIS37rzJgk |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll | 640.55 KB |
MD5:
1ca6207d2254d3c8ece434fd142782ba
SHA1: 3cb00d83c6aca08a98db33ef1811153c64faaf3d SHA256: e64ec46cb7b9faaeaa29c0a05fcf0de56aa4f142e4f60d496a7a3f7c7033f751 SSDeep: 12288:2hr4UCeeHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axPFmRyy6aEt:Ce2g5gmO791I0E5uO9FAN9mRyyzEt |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi | 848.55 KB |
MD5:
a9383a9b4c1ed29852038413a178b4ec
SHA1: e69bedc01d190fd3ccd9697d97ce968cc1f89e7b SHA256: 220f9590b30829f02b56edda05150c36eaa9b51363eca1a585b66939aea2952d SSDeep: 24576:i7f83PV4gEux3P6WBWkmf3egDqo8o93lA6pMoKD:BzgLf7qoQ6pMoY |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml | 582.42 KB |
MD5:
3aecc20c4fd133bdc13a222e31cd845e
SHA1: 1e9ff009804966067026146e090e77ace29d4abc SHA256: c4f3dbb15aed939f2d87c53ba3bfa859f9e5368eca57986c9885a5144433d8a2 SSDeep: 12288:bI2wfCAijFvYFpjKW4MgJZZ/CAi02uCAi0IoiyEfCAijFvYFpjKW4MgJg:bIB |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml | 30.42 KB |
MD5:
dd82dc64a354ea9f696bdd42476feafb
SHA1: 99f918e7a77af86e8912f2c834205591dfc56434 SHA256: 260aeb1c7394f13b6dc33e71f36a7e349742212c658f41c8ff2e8b0591dc5380 SSDeep: 768:XtQ6qCMyivakvBOWjo1qrBFYBaQpBJh0pNL0:XtQ6q3akvBOWjo1OPYBaQpBJh0pNL0 |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe | 1.31 MB |
MD5:
7737ffd2c5bce3d3043defabcb0c84e3
SHA1: 3419f5deff99d103a54b4575496eb713f4b4a031 SHA256: 57b1a50200e1dac5177617caff9b75087dc2edd829b0e9cf7c3a5ceed54aa6da SSDeep: 24576:BP0Dfh6HHfKnE+RUi/LHgZJJkbipjZSMv:ufW+RUi/LHkJkOZH |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab | 13.47 MB |
MD5:
85850d9d04f705353006a58b4c106332
SHA1: 83196d5dc6453c86ef222c3ada29438cdb7ac436 SHA256: d095a1ebc8ddae9832370b837241e356de6af92348e15c4d4293115d95b2d0fb SSDeep: 196608:EmQPX5JnY8khJczLZKt2m/6rGzudE8DHGgr34qnaO6UHxO9nx:1Qf5H4JMLZKt27rGqhLroqnabUHx0 |
|
|
| \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml | 16.34 KB |
MD5:
ff774d7267b5ff435eb769eb999d9e67
SHA1: e061aa8565e052cacdcd4aa7e4ddfc318bc00a17 SHA256: cc2730724e8b7597f575d9697a06bd7f6989969f50937c48fdaddd4709f08f50 SSDeep: 384:py6m7ys8EABss7P2hHsnjkRCYJYl3qeBFYBxzhqmAh0pNLX:prmus8bdP2hMjnYXeBFYBZhqFh0pNLX |
|
|
| \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe | 1.31 MB |
MD5:
4e8a548549cbd3793c066ad4ff65853f
SHA1: 0f50c91bf122e4750c38b39f4ac15ea63e2d2d47 SHA256: a020139e5e0d756c0ac380333a29e6355a8b841af9f28033bb122e89ba41da98 SSDeep: 12288:IeryDBDN0vbfvfhhSVvnB1diKLHH7rKf8YmylcH+zFUib8I7XHgZwKhJAeCGRcAA:S0Dfh6HHfKnE+RUi/LHgZJJkbipjZSMG |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml | 8.57 KB |
MD5:
ae886b981b93d53ef7fcc108b0ad694d
SHA1: bc03ede73f16f989a61fc1ae85bbfefa58bfcece SHA256: e7278260ed18793c3b3ab76b4b1821ff5deb18ad7369faf5ceb7fd8c203c2676 SSDeep: 192:bJMHZDe3cz6gNDULDhmxZFnYrZT0OwFXkhrJxgOT1JhJVnB0iNN:biZ56gNDcDhmx3nY9wOwFU9J+m1JYq |
|
|
| \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL | 96.86 KB |
MD5:
cae061d67d277059a06a261da5d18f50
SHA1: 3c85864b49d86dba60cac337b013930bb0516391 SHA256: f6e065f995832987c99dff6e4bb510b4631e9fa980ad0bcf1680817e9a0e9e48 SSDeep: 3072:DR6fB3gS4naNpvwXCj/P0WbRx0Nlk/TvQF2Z1s:D4fB/4n4wgsWbolCFs |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE | 614.96 KB |
MD5:
d9edd86b585dab8a64a73adb3781852e
SHA1: 9303cc205abab41b8f1631b8ead440f4cbc9df65 SHA256: 5aad30e846ffd242ebc45c5b38a2cc7d1ea5e397df12247646eda0aa95b3e762 SSDeep: 12288:lwQqvEQlFR6XJazB1siN9I7XHgZwKhJAeCGuGi:n8zB1sioLHgZJJknGi |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab | 26.72 MB |
MD5:
8c48676e43667dab53a945b526490140
SHA1: de4906bee39105a4f3a8305f86895c127cf7c2bf SHA256: 4cedb8dae2c0bb02026b408d9a05e68db2a90babf42531c0266984a5c52a5cec SSDeep: 196608:1ryUwmW8LerWo1/kU86BDeDSbD76Vmyb2Pehiy59BFiO1TDkVB:1ryUwmWEed/P86B6DSbDUmPkBgiD8B |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF | 7.53 KB |
MD5:
66dd56b609f5bf28a07fd652469352ed
SHA1: 11fdf9a300183ae6cbac9e3221626aa9da9ec8ee SHA256: 4b279f3effafbafb40b84e0d0a3b373eb35422a928ec107c44024da59b000f94 SSDeep: 192:e2j8NqGwYIPE/ZArBq6ZohKHigBveklR81ZxVA1f:dAwSCcArBq6Z4PgB2klRC3VSf |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest | 0.60 KB |
MD5:
69282653e7c8d50394cb95c13a96b96a
SHA1: 302087af1f3a1f19ed4e4dd7de6016df55180257 SHA256: c28271c2f8b0842c92667d15e837222f5c347f8d45171df8580f71754f502752 SSDeep: 12:IQZvEnO8pS2NXN+uOzOvxZoquJ6sCVGycYCPkUgL4IegRZjnIN3o:tvW/NuzOv4VHVyCQ75RZEO |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP | 172.23 KB |
MD5:
5d8fd4b0fb93d22e60986734141b0fe4
SHA1: bd3314adb230b9545d471ef9ebeda6ec0f798993 SHA256: e6e682acf585e393b1acda74c7675fcbda7e52e4c3301073772ad994eb5bc2f7 SSDeep: 3072:fcSeaBNcEANAsHeEiZs81WdXyrSxGjcwmA:k/aBN2BeEiZs81O4SxGjcwmA |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll | 1.25 MB |
MD5:
cd20402c9feb5b88565743b6e62681b0
SHA1: a6bb0d4d02dc36dc31e904a4614cf0c22271b84e SHA256: e875e1351bcb4e411dfd29b5e31f6a825a3b0b07f47b69fde6e1f8a5ec350412 SSDeep: 24576:OcLfJsMyDHcB3pB/QMZAEI04u8OTVzJLHgZJJkpa:zmnDHct3oM6R04u3ThJLHkJkM |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll | 37.91 KB |
MD5:
673e1797377a835a55799ad3fc13b63e
SHA1: 9dfb9509187d8a156751814ddfcf812b8b6a7308 SHA256: db4703adca132a85b56f15d24bd5b657be5b0fd2d13ac226756a41a43d871c53 SSDeep: 768:S1FJeaSrxzMMB59KTYx/ZicMCnla39Wxe4KseOleZsTX0ZMi2jXHUI:UeaSltB5A+/s0pxeSeOEsb0q9rHUI |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll | 1.42 MB |
MD5:
58695e7df1ae82b49104cb02255f9b02
SHA1: db565c8a6f2028d50493cc3d917ce65d99d02be4 SHA256: b3d5293c58dde4adb43a8193354144d18adbe7291623e94f1dd27933b8cdb3ac SSDeep: 24576:R4oe66XXvijTIJuP0SbZLJ75COd958Gyd0VQGTVy7HCoLHgZJJk56:Cn6zoubZLJ70Ol8/0VDTs7ioLHkJkE |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL | 2.03 MB |
MD5:
93f1279dc0b7c63c0a47aef4f0b0caba
SHA1: c717b2c7119b6030997f031dde93ff62e35cc967 SHA256: a0760e26ea6708f9f30eb45e9ec13ea3161b342c8ce347f7e37d6f63c2047cfa SSDeep: 49152:VS7k7VYU1UU+LKil82uIYHwHKofVc5ecDmQ9w8ho7OKmerZAT45L6Mf:qkFUU+7DSuQ9xh5erZAT45xf |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL | 193.46 KB |
MD5:
d6aa7ffe226102af8d84b80147d77077
SHA1: d29c5d078f03e108171eaf99b45e98f9b134be4a SHA256: 4fa083a089297af3fe21467544587d4c2647d7b72822e9ec6d483bc675d68b7f SSDeep: 3072:aONlGkviXjj80ggbjD1UECecjgQd9+95X:TNENKgtJ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL | 409.46 KB |
MD5:
d1a2a9e90c314ed0c17046ee7c871435
SHA1: d424810632b60c3a662b4670f48b3d749d67c254 SHA256: a33600f555b098cc5feef36feb159d4df103ad72f77f316ec3dd915af817fd72 SSDeep: 6144:vdC7fKAAWm84YyChs53LlWyKgq9Ie2Am4a2OI5p3s2Lfve:4xm848i57JWIe7mf2Tve |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL | 40.93 KB |
MD5:
9c7466c592a928e08414845e987b5e12
SHA1: 90743edf7c3b3c251a459f1a72128f62c1549959 SHA256: f80086e3aefd8b98e9dcc91efbdfb3e2deb8f2c6e2faa91e8935b5d1f711c31b SSDeep: 768:LEFp3KHi3JwSaEMlO1s+52J7XJ956lvBok2Ei0MMi2jXHUTw:LEHiiV+MBooL9rHUTw |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL | 11.43 KB |
MD5:
fea6ebf4749be89f93db9691b0963941
SHA1: eec50f430c3106c1ba420a84f99551e96afbbfc8 SHA256: 6e676a46e7ad4b587b75b1b0123e040784a98b1e50fac8b70770156886862e94 SSDeep: 192:2A8HYSuL9wj5wcX/byDc61fgb+UX3R3D9y+24sJdcr4nVbG7TpyI01TrGwmFfK/Z:ho/g51fUX3R38+xszc28UZZ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE | 118.38 KB |
MD5:
31cdbcca6325c7ec1cb811530977602a
SHA1: 4bfc13a7177a22299255fb86241b678d1b1c7b54 SHA256: 468118a7894acf01638f8f32ee1e35aded30de0d9058e8463f81d694dcd5f2ad SSDeep: 1536:arQd8uQXxro+pXLAZZxLIty5weZop1+zNP4ZVGKJ32zH9rHU7:arQdhGo+p6LItKdWOzNP4ZVGKJGzH9o7 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ODBCMON.DLL | 29.40 KB |
MD5:
84dcf849b873f89a34f501d27a67eb9f
SHA1: cb1b987bca23887777803632e67d6ba37178978f SHA256: 83ccb60e9e7753aed3ffd079406cf1c1eb75f384e11d03e3461f772c3c31b2a0 SSDeep: 768:3Btbts3sE6z/QBFG/+wXfCyZVuDuO1mU/uMi2jXHUvm:3ryPSIe/+cquOkU/Z9rHUu |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUAUTH.CAB | 6.64 KB |
MD5:
2d1bed9be8c3ecfe5e21f43edf244b58
SHA1: 87ada0995c394043f811dbaca2f84ab0b9b2ebb9 SHA256: 802c79d84b53da081f5d077501f0f334637313a31591429b4d2cf5cfcb472572 SSDeep: 192:JZrnC4F8iJL5p3oQN/45tli9BcW+7maVxk8+Ssj:u8JNp35V4jg9SW6jsj |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe | 227.43 KB |
MD5:
eb764ffdbe6042b5c77b66b8e3643f59
SHA1: c830ab440de2b6087302236ed99d91084d05ff28 SHA256: a4cbe1872509d40a3902d9dd0f12141f2d04f44be1fa16ec715d14c882a5bfd4 SSDeep: 6144:cW8QUO65ofgD2z8Fz5V6pVJ+DgZvjX4L6Ue:mQUO1oO8FzTUpjIXe |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSSOAP30.DLL | 688.91 KB |
MD5:
7f74d3ad6e11538e15c895f710d1925e
SHA1: 6bdfe933f18bf63031033d5da6f101c6460174e1 SHA256: a293bab355af1fd627a42d837e8a2f551b690ea937d6ae06872f4bebb25b10e7 SSDeep: 6144:SrVb8WkEIdMa2xm/W2yFdjV+/GF7ganDu79Bf6y2lveBrlv5dRgGZnBEOQCnOLg9:yzm/Zy4/GROjfBuCX+cKZqCk |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUOPTIN.DLL | 24.44 KB |
MD5:
569213612285afffb31a7f1ff23d5b3e
SHA1: 56ac88f6924ceadb31fb026f66fdfb426d73a64f SHA256: 701affc5534d7ba61676fb60a54af9ce149d91603530d3101e3d07deb6f67a81 SSDeep: 768:iTgY6IVGWPnaERq1yerZZOz0AKPuMi2jXHU3t:iTnTJaERnerZZOzXKPZ9rHU9 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL | 54.88 KB |
MD5:
a04cd75786ed54705827e7a487d5d2a2
SHA1: 36cd45d007337fcd7e86229bda81b20475bb7823 SHA256: 9df9702ec8acec824968d34854292ade9f4071adf38c3e9075f32056955cfa8e SSDeep: 768:hFE8/BmxjfYb1uXAqrt596laA/+6lp2mz2lCYu11qgckCtdpOGu0GP+Q0Mi2jXHG:hFE8J0XzrfARmPlo7RwdpOGMWk9rHU5 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll | 1.21 MB |
MD5:
e27ed98cda8d3cfcc36080397c462b4b
SHA1: a2a24791df681d9a17a073b179a6bbe11b726134 SHA256: 30ac6a34cdf71092ed700a4df5571a523777fe5e84fcf6be6baaadb735cc163d SSDeep: 24576:5SAAOZWsa2EkCYgpzO2Ux+p1bj7TVvq+LLHgZJJkQBE:MAAIFaz5pzO2I+vbj7Tdq+LLHkJkQm |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML | 1.58 KB |
MD5:
41782ed07e568b5637a86a5949ebc2a3
SHA1: 1580fb7507179cb4bf0debeea1326b88b966925d SHA256: c98d656ba6b99c002911bbb48ab516a8427d05d1c5da81a42d775a818b20c787 SSDeep: 24:j8dr3rllFj3ySgmw7T8DT4Qw8kC9pUSQBV90qJ4/VFFmWpvj9uYZAS:j8dL5lFjifTTiTzz99pgA9j8MAS |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML | 2.29 KB |
MD5:
f0515d925ba1568a8f95005b210b8158
SHA1: ef78099497e1fd039d4138aee8cb1866801ee2d5 SHA256: a0364a74a59396a2ef3a1e5aa3bb0d0f5281b41a6b9acd3d27390b03ea4674b5 SSDeep: 48:AGj+il+f47yobz7qBS3iphFQhETS5JPOqImrYrOs0B909g90W:3+m+W7qBSyp0KTS5JPOqInrOs49v90W |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSetupPS.dll | 46.46 KB |
MD5:
0fdc6d026bf4ae129111626d83a47a39
SHA1: a72cad717ccbca4f36bba81c793c3cbf0970d5c5 SHA256: 7eaef75f0bfafc881550e442ccd849666c87f9fc55560961d46d5c6592ada8df SSDeep: 768:dk2mK+2bfv/7MPvBv8oHbGigJRpdypF74lc027LB8rnrbNQATkBMi2jXHU8/:dWCr/uvioqigJRpdiilcpBQrbW0v9rHp |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML | 1.89 KB |
MD5:
b86aa9d8d41fcbc7709592ee4b64f243
SHA1: 1c4cde7cfa2a5b6e78f5409408fad9d2c8a3c8bd SHA256: 4d92d53819019010ae01cc6b25f8365ead392c4d1d149254b1b3f92f4e447cbd SSDeep: 48:ex2kqcnjnvNezv/MntvzSMhmg8Cw1/Tx6zRCezP+Qzv1HF:eUynj0zst2U8R/ER7PH1HF |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML | 1.47 KB |
MD5:
39c2b683b5a5ce777f6c86ba9c838a44
SHA1: 3fd7f224a769878452beff7f9ea71a5c1028144b SHA256: 38e98aafae489ae7ccc5242193a002093665377d65ec6beacc795e7499b515c8 SSDeep: 24:CkJ7ILwcqtUUMHINxxRtOBWeD5hTU3/WfTiFKC4WmY6COOaizYw1oPGAd4Ip/rOz:VJ7utqVHXtODhTUPWe0zhCnvzYwSZdhW |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML | 1.99 KB |
MD5:
29d9370872b49348a7d2e35e7634c420
SHA1: 1cebf39f3ff9e2f1899c3038f639a05b754af215 SHA256: 174a351689bc688fd7e04f72323cb9ab7c9fdaf3af8f9901d3f745c45dd17c33 SSDeep: 48:WY59Gjtgcl2Tsjzo05VwzrF88g3djoy0roxq8+:WY5A5gKbjzocwzhNg3Zoydxq8+ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSETUP.DLL | 7.04 MB |
MD5:
8d37b824296a8813ace63b517f3ec1ff
SHA1: a2beb7c63b2250e7253e814a65a13a96c99a67c8 SHA256: e10f95b9c3ed79fb736189b2a167b278b089282311c7ea2f81f901ecb6b6c371 SSDeep: 98304:20SHNoI+ml3KSSGA+ZMbSIASylJ1CFBmWRnCmDUe/0:20SHNoImFBmWRCIUes |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML | 0.84 KB |
MD5:
a39e2750234ae8a01033437703fe4e37
SHA1: 39d9c80cea96bc0dcd054677f687f3a1593b0059 SHA256: 1eb2f2402b64830b84ab15897cbc7d6c52219a1e873c0035b59152da78d10ef8 SSDeep: 24:/QujX8z1pW1YpQ5bnUv4WEv99e9oUzgpwf1t:ljM5pW1Ya57Uv4WEl92o5Yn |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML | 8.57 KB |
MD5:
2a4b5c78b7063d6f0f3f135723f4659d
SHA1: 3dd0406b21beb9fef7bb21ceec8b4cd34177a611 SHA256: 11ec5bbcda7394beb675a1c41ccb17a1c36d46d0f1f227c856b3f9848a6bd37c SSDeep: 192:+hPBcMoE50DATtzW9SYssr1rXqmVDuvSfBZ65R072qw4I:+tB7FoATtzW9f9hrPh/ZZ65RYCd |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_ES.LEX | 386.43 KB |
MD5:
7155f77c171cdc8c8e9cc3584018bd53
SHA1: aa100169b9b5af796ab6bda0bce42bf5e8ccdac2 SHA256: 7098dafff64cd9b168a4f5698e7c1f9b2e4e9f2c4f99708b81e559ccaf9a0a90 SSDeep: 12288:XuQP706G5DJXQsPyh20oxMbrkmg6RgaWLNKvYDC3:XuQPw+gyhUm3t6a8NIYC3 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_EN.LEX | 433.67 KB |
MD5:
c3df04bc9e7f2c93658cec909b552f9d
SHA1: e8a425a7eea294ad55d98c929aa206fb520915a6 SHA256: 24a4ae274334a2a4d9da161cac036c61b095ead498f3b8b568e024e47266080e SSDeep: 12288:Jq/NGnyUWrEx+kjZhWZI1YVcSeoQEtlUw/cP:JXyUWr4+MWZI1YV0alUn |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF | 46.64 KB |
MD5:
2eaf52fca78c13eb9f3ef1929d0213ca
SHA1: 764e02d01d40ba9cea6c857cb56010ddecf16894 SHA256: 8eb5392839e80d7c7d48335ce56b32c73ebb1a67b8ad213391006e4c8c06d540 SSDeep: 768:JTOLpLD6v19pEfzF2Fl3A3K5ZVMpjmgWnD:9kpI19pE4Fl3A3yVMpjO |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_FR.LEX | 288.78 KB |
MD5:
41173fe4ec10e7e602c958455c393a53
SHA1: 0afab73215e1d36fdecb6f12f603957b15ef5c44 SHA256: 0a36140379afee8bd26e2847e56d68667842f300d98156c220226d312e46e074 SSDeep: 6144:AftlAPRQq4rzmamFNEAB1zKIW32+B0SlsL6ZIFiVvB4Ngsen/NB6paeSK8yjT069:AzA4rqaoWu11wR8su+fzFeB8iT0tu |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FPLACE.DLL | 176.93 KB |
MD5:
d4ad6b68d281a12c4b48c3075cbb450c
SHA1: 723bc955ed43fd62fb99fd51b928ceb0d4d3e546 SHA256: eb3fb7f4b39abe6d150233a545ee39a8a9b8a8d49fa2f3c56b143c6f73e0cc75 SSDeep: 3072:h8jbDq4oY648x1gjpVFeVHfxnODKf41xLdFuOUTpwYAMZa9otb:hqnu41GxnO5QpwTm |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FSTOCK.DLL | 155.43 KB |
MD5:
634c1a4ac46456ac6585e0d02e2fd407
SHA1: 425db044a89b4ffd0a82bc5ff533f5e881bce987 SHA256: 313f2bc816a9f66da292206875845f695a240c57e8d16352fc513ae8fb79690a SSDeep: 3072:cMdCVe22JWK96mx+yLbhGOe7ByRwnO9VZyeyUt19oC:/dCVehZJXhwnOMeLV |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\MSTAG.TLB | 13.41 KB |
MD5:
4b62eb800ce0a86a7c6eb0f20a35c72e
SHA1: e34e0ab22d3dc19bc683b79aab17e1fc62869113 SHA256: cd6535c988543712eca5477f9931d3d53e6f0eaf4c9befe50ff4a2514e727d33 SSDeep: 384:2aYw3wuXgGjkSPiIcguMt/Pel521y8l3+oRtN:LnXgGVug9a52bsc |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\MOFL.DLL | 356.43 KB |
MD5:
a2506ab6f618c9c1e41e09f7dbf611d5
SHA1: 167a9ecabc262259585065ce0ba710fa02808247 SHA256: 437c8480582ad4af1c5c35ed32df5b60c7778ccfc9f7e9c1f140e7a21c1e2ef8 SSDeep: 6144:nSTFDJV4kgWgXoOpmJWFpLsOl8rVqswOY:STFDJV4kCAsXeYs/Y |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\IMCONTACT.DLL | 98.93 KB |
MD5:
e7c3964fbfa1861e8100b2eaff2f747f
SHA1: f495b143b75dedaa1414137b23be2de16fd0975f SHA256: b5992417a9ef1b311dc51887a268f9ddcf58c0527c22979e336458abd207a591 SSDeep: 1536:mdxz96AV2MJrq2ihc/ajkGl3AjQy/qSPMIje4yS5NQOluiKMgvCmwyf5LKd81Kka:oz0MJrq2ihH4Gl3AYmje4bQOlK1g99ou |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\IETAG.DLL | 229.43 KB |
MD5:
53d4a10925a551f9ef4f01991a3020a6
SHA1: febae99dbd47d52d46ec37282519458bb64ffc64 SHA256: 3c3e27d72c32c4007cdffb19efb9f5728d2675ad869dca3dae3d95779c65cef0 SSDeep: 6144:ORnzOe6atbvRMZYWjjqVk0oRfcOs1zIp7/:qp6IvRoYiq+sc1/ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.DLL | 108.43 KB |
MD5:
7dc27cf3b6e5767c1cb282b742ed5aac
SHA1: 557aed3afbbcb67271f75ff70655178f7a016c99 SHA256: 1874d7338f3646a96f5b19fd193c651648ebb753ee741f50b1047a1af1d850c1 SSDeep: 3072:EgwgIov/rZKfwNjHerABOlau1zr4GqwG4batZhe95n:KZo3VBOlnrSWV |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL | 222.03 KB |
MD5:
e5345fb7b78ad57f4a7965424b57aded
SHA1: bffa884ecad422e79322e44e19e1388ab917e32c SHA256: 1a4f136a79770713715deabf1d806b67ea9b83301f799fd3d2b6f38c45d65ded SSDeep: 6144:5zVrzSAIo1DhGyeR9CYnlbzuq2H67L2lFTMiS3IWtmTvdpg1zZWy2d6mp9mf5leq:C |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT | 1.13 MB |
MD5:
9949861f90487c50a28c0f335719b405
SHA1: bd6278f530f0eb0cdc37ff70294cb1635beb8bdc SHA256: 83a588b66c497e42d8f56eb75342a4a74fc49ba2efad00b8f641de4b58bdc503 SSDeep: 24576:WRORrRaRLRLRiIi/A/N/RxRGR6LRARlRTRu:c |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\RECOVR32.CNV | 35.90 KB |
MD5:
f7e6cc66eb32cb42a7ee143e29cf1446
SHA1: 9260583dc639e06cc0619619e61f1ed4535dffa1 SHA256: 8c9f0e8b9b419f0e4dc5fa3662df9fa558422035065b8eed83568674975073f0 SSDeep: 768:ih8C5WWh7d0rkf3i6IVZt3/Ov9SD7Oha4oMi2jXHUFg3:iKned0Qf36ZOlSDl4P9rHUFg3 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT532.CNV | 192.41 KB |
MD5:
f423f2991f16cdf46f17c2097593b22a
SHA1: d229b67c3f9bd1a5e54338cd69db8afcf4557fed SHA256: 936e2b40061afcc5ebf4a327d56ebd0808d930fb3a51dca7c5c951cbd55bd9c1 SSDeep: 6144:gbqGXZKQRWOlnyJOxJ456CuLTBwC8FqzB:Sq+AAvyJCJ456lBQMB |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\Wks9Pxy.cnv | 55.96 KB |
MD5:
50fca4e206c769e1e6bbb267771ba87b
SHA1: 6df0da1a4258840c62b24614f58b35533a6ae8c1 SHA256: 10b5f74391df641a981971a050b15455919a008a052482cee7a354670bb05c71 SSDeep: 768:TVLIWG/dXZX0OoMts2+We0vJ/kNHGKKuidr35hc5HgQ09tx3vCf6qa0dbMi2jpvE:TVEWmxZ9ofrmYihcSQ09jvCfCcI951tw |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.INF | 0.57 KB |
MD5:
e3d291ac2aeec605fc425bc1f261617e
SHA1: 88911391da9deec2404e87b27d7403bea1e38f23 SHA256: 0f9b2c44264a6195e87a97705a8ecd4579a771b2e43b7bbeef353f37454ebee4 SSDeep: 12:cfyEU6zoaeJ/PyJkuiBG79F8s4SL3MBIULgmMIBNAsa4Mz7Y:7huiBG7Dv4S8BIK/bAsaW |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG | 32.29 KB |
MD5:
8f0782624deee69d4250bb44aad31b4a
SHA1: 8a10489da73354fcf6040a46cdcf72c531bf9293 SHA256: cf5395ff3af836cc05b81a9e950c2a5f1157503f2745b74ec573c2b2de8de74c SSDeep: 768:U3JnuNPDpMWg5Mjsj0iHMAIhqshvOYGDSGpWr7+uD:U3lCehMjs3sPHhvOYGpWWuD |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG | 31.14 KB |
MD5:
afeb7d18a2a6f716bebd9b8a0198cabb
SHA1: b4a69d3ac0e653d2828f67842f352f9088bd4139 SHA256: cb638aa04115f3ea318d10f0e63848a9c8b71e5e506c4ca1d7b9a7d2d52bed7a SSDeep: 768:xEYfL9MUzoC4igUAeSWAsAubZEJKYeFRSmEA7j5z/YgwIK9mP:9hMUzbsihAJubsKYeFImEA7VzYiCK |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG | 34.15 KB |
MD5:
71474178b82af3d75e0fd1352af742d1
SHA1: 743a04ad7a9a21acacb6e51ac0d3b50b746efde5 SHA256: f9d3eb230707441e95202b39f8c07b2a4cd683d9cf8c313c3410d923bc61436b SSDeep: 768:KHEixCex6FzQFeKmrzmVZpJCSc5FmCJ4yiwQHKyujf:KkixCexJeKmeUjmAB+E |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.ELM | 98.49 KB |
MD5:
e8471c8fd166c733cf0fb0a582bf652f
SHA1: eae244d5271b7c2dc56ba537720dba723f9592ad SHA256: c9ca6363fbde5e00b56aa5299e4fd4b40370562b9fc4fc228d70625b5218a279 SSDeep: 1536:dFsF4NEbf6cl50xbMAhal50xbM/F49L3wWNL:vs4KbXoMAkXoMO9jN |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG | 31.89 KB |
MD5:
ceea3a41d8006000b317c632f4c3edcf
SHA1: fac9e1a34136a5403bcbae8f29575b1d6890bd6d SHA256: bbe6445dff5d19afd8691133effde9e5e431900ef37a08b4b5afc5b1267cc7f2 SSDeep: 768:b6ea8yct8Rj8iYdskk7oCTQeIqdPtgyP3H3J97LqrQ:Ba8yiqj8F+kk0qrbP3H3J97Lq8 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG | 19.94 KB |
MD5:
8f8325694ddb2dfae46e394c3cfa7e6a
SHA1: 68f2566a69187da4a310b18409d555d9ef4e34d8 SHA256: 5d77958a1eb4e07d4256cd21b2eb180488b5e9086246c97f3bc47184c0904827 SSDeep: 384:gUzf96fWO/hwQc/bHU9jA9UvS8J29m3GCH5k22MNHvpfkA32WcaZfN6SPun:gAfQfh5wbmsSG9m02HxpMA3vcaJin |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF | 1.31 KB |
MD5:
0858fd5de6228064f3b07de136b6ca15
SHA1: d4efe88aa89de9515ab5e764d39702d06c145a34 SHA256: 6cd266902408bd38f79f6e49ed144135d0585579a1596e88423fe3544c397360 SSDeep: 24:9uFB73rQmBPCrnShEXOGhwufYTQCnfEtLGmaKy2jGVi53zLMH0joFJ+goWno3ODQ:96BRarnDH+7nfEtLGmRiVi5DWUGJBFn2 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG | 20.14 KB |
MD5:
18cc69b4ccacf0417a0f7494c85b5fdf
SHA1: 499560f239afda06f0c7873dd1c35911060ebf46 SHA256: 5123c9256fefc43b5cc195446ce44178cc6277c35dc1a930f509624bb3f33577 SSDeep: 384:9psrrqbA4F3FiDQSF2ZUrhDfDFH3/g+H94BY+DetpMZxjgceJKRIMDA:9SrGbhiDQrZUrhvFXpaBY+0kjVo |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.ELM | 53.57 KB |
MD5:
681cc7a49ca2d66a249d00b476db4b0d
SHA1: b0b92b77c72d5696a2662ca122165fb120189987 SHA256: 7958b4f28062559ca9f34ee5dad7c9f7f1c8947755731a2d0fdb237ad6c21417 SSDeep: 768:+F6J/Q0YQL3qzmlmomIgd0QZx/kMJbSZ20aWfVNi:F/1Yu3KCi |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG | 59.35 KB |
MD5:
ec3f70e1ba1fa8f4be92f84ee5d64842
SHA1: 201bbfe5fc54cc220eb57440b5e30cfdb36c9ed2 SHA256: fb4b9f505fe8e277b4db4864fcee0a42aef3cc0491a6c58c664b74b2fc289d36 SSDeep: 1536:0uyRHvBsTtfV/8YL5hTYK4GISJUmw8irlzZv6:0u4JsTt9UAFgXX8irZZi |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF | 3.92 KB |
MD5:
89882695e53084ffacd24a4a406f9578
SHA1: 74bfb0568d16fbe456e363bdd996df38cc94c097 SHA256: af074e4b701c10efad5f779a2e688b79d1005c8b80499eabd2cb57822f5c1015 SSDeep: 96:pekKQEqlF0SjNUkNEV0atLq6n3yytrqls6oRlNyndF13:8kKQRlFvjCkiVfLT3yyNqls6CNidFV |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG | 32.55 KB |
MD5:
c086e4e2280ca43c9c40868b16c33c89
SHA1: ad6b7551702fc787f7e7d53df1368a5fed6a231f SHA256: d54e9d7b0fdc30a2900d1dc314bdf72a13674e03ba0df59594b08e7945d085df SSDeep: 768:Gs3txbN4W5oIo6oxnqHqO/JuC9UFkVyVJ0yPg1JDD/g7hkgTLQw:GQBoZHAJ7+FkVC0yI1FbgNVQw |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG | 24.57 KB |
MD5:
3dea2784c60252580c3ef43304ab8cc5
SHA1: 55ca23473c73166953bbcfb28f3a9e38cdf95f18 SHA256: c12d26272469fbd8c6c9afcd31a9ccd6c7451d547dd4c80a14ff4b4ba3cc17de SSDeep: 768:CrQlzIrmtJjNLRCgbCeQFuIMZYLz4Dh5/IT:FLhZbCrUYLzgcT |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG | 18.43 KB |
MD5:
8695f9565bdfa05fde297556d7f1439a
SHA1: a4b1e8fbd3b6d8087f36d59dc477c0c4c001b5d8 SHA256: 7aa8f8e5750fa9a5f8f408d3dcbe7a5179ad450a9d25af81e0d1d7126c6bc4cc SSDeep: 384:tovLMeml95bo0CWFsP4RfxcCIxVV6+JUFQ01A4JxakgDV7QeJDPp:SvIekUN+7YUeEu8xzcVMQDR |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF | 5.05 KB |
MD5:
5051d7bc7f23f478563ecfe6b014e3e6
SHA1: f3a57a43aaef9bbe846ab485aa0eed18396d71b6 SHA256: 58d6ef164d4ed4ee2e26b3057443230ee39af406f2d4e76c945c345b9808a4b0 SSDeep: 96:UQiZpVK23+aZBjJcj3Z/wefFYab5q07voijqCKLDsLM0CPsOiJn:UQUkM7+j3ZcGq0DYDkLM0UdQ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\ICE.INF | 0.47 KB |
MD5:
ec4677764e8c4ae0c2b88e1f6cc96aff
SHA1: e32cfebac6a7e3498f29a4ec9405ea28e62ba57e SHA256: cd61968fcf5c67f506a4686c80dc6f2a6791b8cdde1ed3796852420f287e0889 SSDeep: 6:i7hC9/KBLFdPojfVhszhDE0pQiTU/wDvY0fqggZXOLqmwGMTtwOxU/4NC/oabf8T:i7Q/aPojkbpQR4ffqgA3GOc4I88ypb |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF | 2.54 KB |
MD5:
23f23516967d37a9b6bc31c85bb3f28e
SHA1: 808b10a6eeaee38bf7284d5612333db3be04fa8e SHA256: 8ae4a99528887f2f0ee09458f3c8e866b26f0abe524ca3ac727916e0b11f550d SSDeep: 48:O6kOfANLkBIyKGaNQt8TCrodT/Qjhak7wI30AeiHZeAhXoALnj050noX/hQdeaMu:ZPULkBBKGaCtSCkajhak0I3oiHZeQXJX |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\JOURNAL.INF | 0.54 KB |
MD5:
95be6ec3e8ba3beac2dda2ebe3be4200
SHA1: 65df438e90674449101034aa5c2c592e33719301 SHA256: 275a9e13ee367ad2b0e599cda0d585aae91a799e27fb867efe3aae9481099bbc SSDeep: 12:wSiqBv+/H6yYoSiUAtFvTBfni2H3p7fw9mzvcp3EwkZ+dUsaD3hmdtt:wIkH6yJVvZn93p7f2f0wkI2ZD3hS |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF | 1.25 KB |
MD5:
caae996ac1c0092b8f0f851d73fb2936
SHA1: 8cc352883194d0b825445f10b34517ca51d5aa39 SHA256: 7d0efdb27f86e4286bb3a551d0dc4c2284dff0e993d77d6952cafa48d0fd3129 SSDeep: 24:YRuusfZhIOvFlNKM8qMPNjC7j+6+Yw1N+9FmBm32GzLgUXpvVjGMH:YRuux4C7PpCm6Bwe9FmBm9gupBGM |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG | 11.35 KB |
MD5:
b6d919e6d39e39eb44958922d33da62f
SHA1: 9df428c6cd938b58865d508a56e41c08665abcd4 SHA256: 4a6b3ae00cb91c166dca96fa91f939d7bc63ae9a9f454b46463b06dee998a9ee SSDeep: 192:v5rOk+xqLRl4dyUEqYexLCmE+NrC6SMBWeVViV87u3CMyvPLlR7fPK:xrO/GfU7tCmx3SCViVsu3CDTH7PK |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\NETWORK.INF | 0.62 KB |
MD5:
87609bef459b811cd8a890aee13592aa
SHA1: e5f0de57fdd527f0925e9518505bb90e90cd1814 SHA256: dbb2e6e7d1910753689d68f11bc227f2c9df0346de8077d360f270e26099bd49 SSDeep: 12:cXkQ0kw9XaB+0DVlNd1QA8AQFs70xO4KChfnlk9FG5/2PxEbJgBOF0v1CC3LAjVr:UqlcD1QH40xUChfn2G/2lBOKv8C7At |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF | 1.38 KB |
MD5:
9edc860a6f114ddc9613520e954b30dd
SHA1: 2f530e1bf03bbd370045c44b008eb7dbca2fbb07 SHA256: 1db86a4c6a0a9456e46cfcca2b3ca53db41fb336dcdfccbacfd13ec58f7c025b SSDeep: 24:ZKQopgF/orXGESUw9rMT+1isMWqsy1N43M+cNn9KBf6FbpFKq+hqtgWoAreNki3o:ZKtgFQbVStV0+1isMHBTi5cGUhKq+M0m |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\SKY.INF | 0.48 KB |
MD5:
b4b7102d2b03cd364f06eb02a980a5ba
SHA1: f6c57c1d0dfbeafdcfd88cba910790b7156673eb SHA256: 09aecab68032801c6cc4bc54e9f4195d5af77029997bc891ebd34c2a1ea4b4a4 SSDeep: 12:L1cw9pClRbzuhMxfFUFGKlAs/dxriYx+ecBUyGuQ:KkClRbqaGFPA4ViYxvcxQ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG | 28.67 KB |
MD5:
098dd10eb234230c8352fda773f989b9
SHA1: e0fe64f6cc6f8ae8b03641470d9b5c36a176bf71 SHA256: 2242fa3fac2ae2771fe17449c4c2819c53019734d9e9a9b6bcd98e4390f8b1b7 SSDeep: 768:VG/2q3Iz2rve6CwNHa5unJvnA4TI8vLMZXxbAA0:VM2SIzYve6C2pBnTI8vsRA1 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\SPRING.INF | 0.51 KB |
MD5:
d4def61ca9c41706da44f918d6df6ba8
SHA1: f42c2616696b9d5c0657cff10c50045dddb4ecdb SHA256: 9472636e266efd5d38ad804b4cddf726e5200dd580f89cacaace162bf6f96471 SSDeep: 12:ewLHhVqUnX/MqFNxs9TMuIpyaZBcdqJ2ioFg2SulDddJ2Yc7psskthZ:enUvztJLcd02io2hulDddJ+pzkt |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\SPRING.ELM | 66.79 KB |
MD5:
aae681ca3e842b34bc73611c5a885e51
SHA1: c71aa0d4ecd1a650f53f6727f80c4adf60bdfb0e SHA256: 3c23841418353edd55e6933b474c65a70b08a39a8b12d51ce68112e8494b7d43 SSDeep: 768:eW4mGcFq6UcQzmS+gOqtBQCxRwEEXcULIqtBQZdtnHmyuas3T5iWKVz6tMfFfyNi:bMq/3qfQCxccULIqfQyi |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF | 2.52 KB |
MD5:
1e73224f9b8e90799ea5688dd65e0d6f
SHA1: ac40e1f6ecaf9d1423f4d0aac609de0cf30c3952 SHA256: ae3dd581c973c1e203fce5632ee8b9efccda955885075ad03c126377705f0d1f SSDeep: 48:Y114DZrLxE/9M9hH8eMjW8KMYT3XhDCgv2+6O3bgbj9CkCxoSl87:wCDZrLG+hcLjXKMGhDCgv2+5b4o1o |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG | 26.59 KB |
MD5:
cb0542971fb7250079b776212d955f0e
SHA1: 6a513bcaf52614f1ca4406e3080d5ad8c9c3e90a SHA256: 9f4aecaeaf2602aa3d85b535d66400482d65f2cb0161143911bd55b55f9ad8dd SSDeep: 384:60YEpHN1mn0keh3rQj+GUTuuIWdpox+LMBUsqpGad5Qusrv:6qpHNslehbQ4THw+YBUsqppQuav |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\THEMES.INF | 7.16 KB |
MD5:
c0cffa91b0cebf09ee507bd9efea0b7a
SHA1: acecdd86329361dc10d262f511e3f88fe1a8574b SHA256: c5707bd0e39ccef7a1da0b3b275a59af1cdeef27c19eb9d76778b47dc191e9f5 SSDeep: 192:k5yBIvxNuVksnAKFrTn9t7iYsPi77575M3U:TIJsDV9td57EU |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\STRTEDGE.ELM | 56.60 KB |
MD5:
bc1b06dcebd922cc8ab1c6fcb7cea76a
SHA1: 8d52f8557386be61b312a0856cc89db9796df1ec SHA256: 4b3f1c9e8bb87425811f3952e49187f3c043f4e5020fde46a3f19d643b2ec58b SSDeep: 768:5I6kRQD80a1MhuxDSL94nvFA+bkp90mAaTnESpWvK/NBP:e9y8PBSL4i |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG | 19.12 KB |
MD5:
5de4b1a596c9feeb95a77442ee585cef
SHA1: c706ab27ed86e50a514b63290704f61477941304 SHA256: 6f79131f7c926ada2e08aa0507f97cf2ed5f13848591cc7bb2a5750276d2c06a SSDeep: 384:ERoagoMbVS3QfcVNIx9VoDXX6VVhh9bXkBHMNgS2jD2OaRqJH5M:LoMbVkQfaEVoDXqwBI2/95M |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG | 29.51 KB |
MD5:
20913720153ab54f0dc01abaad4c5138
SHA1: cea1d7d213f6ef9b1e050bcc7b4b3aef6ca14862 SHA256: 45a93b21d9b3882d970d20039d97a78154c8951e75be8f3dce54816dfd38000a SSDeep: 768:7iyCoorbb1Qjn7jlRDOgSdE7UXwYwEh+mt:zCooHb167BRyrE7UXwYwEhlt |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\WTSP61MS.DLL | 216.05 KB |
MD5:
09c16332ff5482f2cd8a551f429819ed
SHA1: 76bf610316ffe8fbf6d4573a776e725cc703b5ff SHA256: c6fdce25dcf1a592307a59a54d64f57c564ed079963bfad5bbda397eba41f468 SSDeep: 3072:e5BTZlDf39NYR35OKmCgcTwl4R1px3O5Sm0d5empTzghYlDnThqmjHj1Ox1QYYtt:Gl8A4Nd5empT8hYlDnThqm31PuZhMsZG |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\SKY.ELM | 80.36 KB |
MD5:
b51829d4701624f4d491df48bd039eb9
SHA1: 55a2b02ffac4f38dd712bf32df6c8d6eb3d3f3b3 SHA256: cf62c74ab4a6e54a6059ac12089a73e41a1d981e9a65524bb2aa22923d380955 SSDeep: 768:6V1NgkROfXSiAoqAyNBFJpCRhGy9VDL8BxWxwQwTzv0kbBr9ImME6Br+tCCFIKBR:s7gk8vxAoqAyNBFrCKy4BxjamMQf |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1CACH.LEX | 1.55 KB |
MD5:
a3682bc682d8f74e5fdbf94e3333946b
SHA1: c278aebe3de8a946ed7cd18d165c42387dba08fc SHA256: 9a3b897a17938e9a6efa353e3008cf368920df985d5ff5213db9eebd51328267 SSDeep: 24:uF1Fx6KAJfKHA+9QqC6o4Muq3Vf3JBiRf+XsdPJfGMWp7v/BE+5jPeqj:01X6EkL5uqFiRdBfGRTlj |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1XTOR.DLL | 68.94 KB |
MD5:
e33b8e262d4111389a3536008176aec7
SHA1: 5455881b4226f1e97fb0cf0463d1b875497d7f0b SHA256: 392f0b43c672d760c29c2c5aa5cc44c732f3d90ef88bcb8ef1dd3480f024e87d SSDeep: 1536:RnzqPaygEJcPSguPZunE/ELivYelSoFIvtGO2fTBY9tleX95K:RuParAvPZunbeYelSoF4tGO2f1Y9aX94 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1CORE.DLL | 174.44 KB |
MD5:
d789fe1f3c9b50cbc219e44a6db99dd9
SHA1: 9f7b5894c017ddb08fbc28e1cefe333e08bed4de SHA256: 384e2fff70fdda237c817eabb2b02cf81e456e18e8994442ceefe24d41c6010f SSDeep: 3072:n59ibUhePAA7PvHakMcCXEn/PM/4KCqeTXHS40dOcyjRn4d6UKc95F:n29FL0dOcyFn5ML |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM | 407.20 KB |
MD5:
8c65cddbbbfb3b63eb7a91af8680e6bf
SHA1: e250e8dd8c921209e1c2dc6062ce290e4c338faa SHA256: 553a3f6588db07518fad5989fe945c38d93c74febb27ed7f555bd556d9c546c3 SSDeep: 12288:13kgrSLv0wJYyWrIbcv3sI7EJwDQSXO01INP:10grA0R+cfsMEJwDQSXkNP |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll | 966.88 KB |
MD5:
8c4dc4b980e6bbe13dec83e6ad5c72a9
SHA1: 5b6f72e864bdd061bb7ff4fe3e7a2bf577945f41 SHA256: cfa459bdd7277f0d595b142ae93f9709f09808635e332691c56f8c1594ec7584 SSDeep: 12288:oc2YwE7VSxeUMUCcTd8Ht4lYyF2f78oyoMZggTSN:P2DE7oxeUXfaHtkYZjiQg2N |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1STAR.DLL | 259.91 KB |
MD5:
de022a5b0754ba5c2d47cbd53c62083a
SHA1: fd6b6282fb640ce54a0b9ea47b09ad5b2331c92e SHA256: dda93f6e52a14cadad69e08fbdfc3591a282448f9dd47d11882e3ef1befdcea9 SSDeep: 6144:Wrw1/Yix1TGqcvRlJaZgaNpXC2fqN+qju5oxM:4w1gm1TGTrJaBX5xiM |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM | 121.10 KB |
MD5:
6c2a7fec416c5ebe9af9e5d000b510d1
SHA1: 13f10a3e0574165fbf477785ffcafdd08678805b SHA256: 2a63d3c31f903e6ccacf8b9e288d3b478d0753573ac9a7c0bc3849a7258c463a SSDeep: 3072:lsJcCgEMladkzNUnHH9Vcr4Go862RIF49wTUYQ2:JEeXNmcrm86D49wT5Q2 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\VBE7.DLL | 3.51 MB |
MD5:
b3c2bb81428559e0dd008b6ff907a8ee
SHA1: aa98f18366b0332bc7a6dfad915416f9e4b9ecd2 SHA256: 9e6835ce8d7c8a35073bdc86774e1e09cdf48a68c2131b7e9e427089f9ec9406 SSDeep: 49152:VfKMeBz7SRz3ch/uSYSzDdd17yYPDvRvB4g0ADVun4/ZT/J3PIW4:VWThzvrPVuneBPIL |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM | 922.90 KB |
MD5:
2478eeb1cee95d5fe8be4d557b076696
SHA1: ccdc10967e66d843fd87ed49f5fb56f91cc6eb7d SHA256: c2b6b4f04e7fcca762a6dcac24e6c960a03f98daa2314c702c40b33a2410c4f3 SSDeep: 24576:W8SLY1r4snoHaFH28EB4nTDnBGue2uaZjFkncfgPwuVPyDS:hfXCal2L4veraP3gPwuVPH |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHGTXT.SHX | 191.52 KB |
MD5:
4737cc4b9d3c583950fee5a5c8498c4f
SHA1: 80b91b17c4eb8052a41fd2e25e31172066942112 SHA256: 61966ab0cfa0cb49c1e9ea63494fdc3db6971479ea8c18e1f5875ad9774d91fc SSDeep: 3072:Admn1iM45YP94091NdlcJZPVU7cQ00x8KrIcNIgNIsJTN0rpQdQ1ZJYUpjNkwN6Q:8M1945YP94091NdlcJZPVU7cQ00x8Kr2 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll | 835.38 KB |
MD5:
acfea5b052a271dcf5b6d0a16d1380f5
SHA1: 4d7a81a16eb54184dd1b791b09323cfe1e1f53e3 SHA256: bcdb798854941fac46b87a769114f13ec6e5691c187c17580db85f8c26f07e7f SSDeep: 12288:QtBtFaU5q0DXe3vz9GvVoXMl9UE3YzYgyAAX3A+:QpJ9re3vz9G9oXc9j3rX3A+ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHTMTXT.SHX | 895.20 KB |
MD5:
e439886b8396db989d401add9cd84910
SHA1: 112068e25fb5ac6ef44992a71dd8cb77fc12172f SHA256: 7694437a4b0ff13e85c2bc804bf2573872a97af983922fa3a6e68bff764ee276 SSDeep: 12288:D6GEhuMndaTartzKhplUYFKvCZZTrxlk0EKthj7ojILELeYWvs1E:DOuMdltypuvGxm4thgIQ6vwE |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll | 17.89 KB |
MD5:
b44f3a300136e239ba94995020317293
SHA1: dd050a32e036af47babffb7e5a077ed36bc00dc2 SHA256: 86120c5cf76ee3ddadc8fcdfdeed146a5a68bcfb6b7977274ae4b6accdacc11d SSDeep: 384:vnqQQnsKmSj7OqQVLuIaNbDGNaLNKgHLXci2jXHUkztv3:isKm+OpVLuI4bwGNxrMi2jXHU2J3 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSOSV.DLL | 43.93 KB |
MD5:
876f3325dee74aa2097c28e52cfc5610
SHA1: 218815ff8b6b169223bbd8b160fa569ed7078dc3 SHA256: 6292e1fb7918123e9cfbf7fc42034ebae70b1f0122f088afb2e3234f903ddd26 SSDeep: 768:8GH9IK6gHMmORaFYn52HHHHnG6FWympO+9nV71afV6JMi2jXHUZnx:NIK6gsReHHHHCpOcnV7Iw69rHUxx |
|
|
| \\?\C:\Program Files\Common Files\System\MSMAPI\1033\MSMAPI32.DLL | 57.43 KB |
MD5:
d2e087849c9adc9f3a579e5d15cb5314
SHA1: 8c7770de6cb52556829f604f7d88b77c113189e6 SHA256: 1b2042c4b2d886233992c1901f6bc2e31eb0f4da849b8b4ad6ba894361f59568 SSDeep: 1536:K4h6s7NOi0m+HcvjxbqrCzQ8zuPd4Q9rHUeuL:K4hx7NGmwKjx2KzS4Q9oee |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\MSOSVINT.DLL | 10.43 KB |
MD5:
20c6235411a0db24f8679e45cc8c7987
SHA1: 4c17cc70a7953fb05bbf368996a39d8797c0b41e SHA256: 3b333c3960b4168c6ddba58eedd26458477935366ce0482302cbd05e19f4073f SSDeep: 192:V0EU7Yq3m+vTnmFb/eW/wrgeDug3xO2iwkA6UAhJXi9rhaOGz:VrU7JdbnASW/wia8y6zhJXIrdGz |
|
|
| \\?\C:\Program Files\Common Files\System\Ole DB\xmlrwbin.dll | 194.57 KB |
MD5:
a246aee820027c1b2f36ab062191190c
SHA1: 79160d412bd9402581282521afd46cbc9c727b9e SHA256: 995f4aca144337ffc64500e2de442521a174b0bccdf1f3d81670e5fb6c01c9ac SSDeep: 3072:rAupKe5tCCTrXX2lcJgqhEfDF/ycVO1JhLyT6Osr38Cu1o:rkoTrXX2l6ODF/ZVEZOszao |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb | 21.38 KB |
MD5:
5e125b56aa64ae4e40b758a8977ad110
SHA1: 2c2a16ffcf44edefd52c5fa86c6b2d46fac5974b SHA256: 85976d995c510798e53176e538f52398017b1c897a9b0121a8ed2b94c466cdb7 SSDeep: 384:0pBlQ+GARmuf8zKJ5DfYx59+K+k4mutF3mWmllI8WMy2GWzZLXci2jXHUsU:05WcLUzYVK+PmKFW82rdMi2jXHUsU |
|
|
| \\?\C:\Program Files\Common Files\System\Ole DB\xmlrw.dll | 275.57 KB |
MD5:
d4139717e1f1f8b010fda2482744eed3
SHA1: fa3082c2098010c5dbc7261c8fb2aabea3e66b4b SHA256: be9b02ef609c9d0b10ae31ce24199179fd1bcb3d685530defbd4637ed2d2e4bd SSDeep: 3072:uCc4XQQQsGyXSoYDxD39C1THORd1RB0sY6bioJ5Q1Q4qswcv2pLgX5HF8Cu1c:LZFQMZYDxj9AivWoJ4nqns3XDac |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL | 2.41 MB |
MD5:
7521e0afa38c09f08279539c8daf0ac3
SHA1: ec6b8a96523f137d60af02f586f0d4a615ad0a9a SHA256: be1fdc4e8d4955c68ec1647a5806b54c49f4203d014b5ad76438304ca98e0faf SSDeep: 24576:mkta/4hS3Ql8tQmW+9HFoekIKg//efwTKCF6BSX5yCroe3Jt3rCytj3//Gl:mktwgliXW+XoZIl3efe0BIMe3/CI/g |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll | 46.90 KB |
MD5:
b663c70145570cacaedb4dc76b790e3d
SHA1: 7f640f0a5510f195c0f376ef1586d9bd761f8a93 SHA256: ba3bdeff170411667917a260cd61d03e39fbf03f48bee0d16e1f342c60012579 SSDeep: 768:CU6iIdPJphY3SXDhHAikazzuB5aTPvDwN4op/pJnV14QI48WAE8mfDLPMi2jpvF:CRrdPbhYYKikAO58PvDwN4cRJV1KYAE2 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll | 180.37 KB |
MD5:
db86e4d2ef170c8029edf7c50bc82ddb
SHA1: d7e9e9d33afbe1e96b8f7253b5e2db1a76bc4f81 SHA256: 7da5476a0b1303f28676edabd485b1a3a9191bc6b64f9b6f92a7ab5ba3932ba8 SSDeep: 3072:Y2Z3kh84YdcbpzqKbsLZqbGrGn6pTMUeH3RtYxFilgVXpPXxppXTh95o:Y2ZNRdMVmsUGn6ponHzIRLi |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll | 9.89 KB |
MD5:
c01fd51f8a6a69f5f13c7f5538169dad
SHA1: 0e9bb29f36aaa5ccc60aabf0d429210264416d46 SHA256: 135c54fa2d7872102c3507b6f7ff0c45f5329bb9854d0a31b7a1a8726e18db9c SSDeep: 192:pLV08+E7n8DZbzHpgSIrnhArQe9rKpkNYAwODEjB98gnJX3Pkx0qQLcdIvjhn/kc:P08+EYDXgbnhKt9+pkeAwOD8B7JX3k0p |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll | 378.38 KB |
MD5:
1cc0729b12068800fc5322be10465049
SHA1: e873743323be791febbf38910c55ce3d396846be SHA256: e0a0849aae8c08f545a8d39b93fb8ad8fed6750c32e05930b8edfdd15607e143 SSDeep: 6144:lWcmPqAE8Mki1/jHiURwF7tv1iE3PjctYKrO4ANn/E0iFs:w9rEDj/jHibP1/TLM0ia |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config | 0.75 KB |
MD5:
e827abcd5cba94a6006b3976b5974188
SHA1: ebe312d9a3b73b2a061c4bb37db618438dba302e SHA256: 99df6d8ba390e770582bcb455ad4167a3101cd9e06101337b6f46708ae173bd5 SSDeep: 12:J8ig8xHz2yBwEymNzOqe1sZ6m1+tAGjR2OQw7WKET9TkAdogoikg5CcYqBTrXt2V:J8i5xBwEHH7Z6A+24oHAEThNoWf5hJrY |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\ICAD.FMP | 0.37 KB |
MD5:
02a0ace4920341731d3280f106119b94
SHA1: b22e4f9dac987bc15ca66b598f155fca5b032ff9 SHA256: f045080e4e9d9ce92720781105252bf3fc8da5285c745a0060015ec0a351c18f SSDeep: 6:8sHy+9xxKr1ZtbCCZi49h202aBSOEtJNurujOO5fz1tVFZzJ3sf3Ebc5jJR:8szchZBCCYiM6SOEtDuruZ13XUDD |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\IC-TXT.SHX | 10.80 KB |
MD5:
5536c2541a32053750de605a600a816e
SHA1: cd962d3cedf3a5cbc1f881c96ff93d06a6bc4b08 SHA256: 4bd1f3f6ad7fea4b88edca59efe33aaa8e9b08e77fa9642e1e92c42b2138bc0d SSDeep: 192:brbxdA5HA7rcKu+0UibtNgxBol5yVabFWZmqvXMI0gwyLDSQjdZ5+FvU+:7raIrh0u06abIkgF9T+a+ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\EXTFONT.SHX | 426.53 KB |
MD5:
7e181df42304b0622a88b6ad339f5669
SHA1: 75d76a76cb4b56e619144b9036304b5e7351a4a0 SHA256: 4bf4782fc9fe68a90ecaf62f555aaf495c6298d8ab3c293bf7fb66d0a6fc0111 SSDeep: 6144:ESFD3vJEUcRh7Q3u6aUAearitYNHxY7gfvrs:ESFCUI0RYNCqA |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\GBCBIG.SHX | 881.73 KB |
MD5:
afe2007f14f4ccad9c370648b01f70db
SHA1: 44b81aa8a4f69a88965cfe54bb90b4dfa0dd2aad SHA256: 8f54d47a54337771af6a39a35b771cc3f67916818ffcac452c18a0de7b5e99ed SSDeep: 24576:rp1Hy3pahq5DNaG+RRvXMvJv+m74yycWWTGxJEri8O:rjyEhs8G+vvXAV+w5WWTuJj8O |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe | 97.39 KB |
MD5:
a01096b7c1b5529c1e6a6a0355f9fa0e
SHA1: 02b10d9aec918dd261e9560f410bda7218a165e6 SHA256: b0441f10b5544ccc58481d2281a43fae58de5121013339bd4e2856a9593d078b SSDeep: 3072:NzzfyTE+XSTHwEmFvdbiK08GgmZBjuGkKgnpAkqesE950:tyAASbtm1dbi182iGNhere |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM | 56.72 KB |
MD5:
97dce6dfb5ab51490fdea69d3901fb81
SHA1: a8878b4b85566e2a78826144f5f638d7b63eebfa SHA256: 5dc47b5a58c14bcf168202c3232254cb744bfe9b9671a51aeeb60947a1de35df SSDeep: 1536:b6pw/tkns0AR4DjDWkMcmItHSrC368VL+B:b6C+jDQWkC3uB |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\CHINESET.SHX | 649.58 KB |
MD5:
f339f26ccc36bdc6f174b060f2563e45
SHA1: 285c506ff1328dd6a0bd5385a31d6b64b192e78b SHA256: 8bb8f16a889eff39135212dfacde1ce56f192b479f0dd0fd83b3a41554370d04 SSDeep: 12288:TTyT8oGb3jBDqXUTXlRFHT7xKmMWRKMXYOdZL0dHEWcDqhR:aTCbYY39tzYrak |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHGDTXT.SHX | 218.51 KB |
MD5:
a300443f9b530d77b1afed2a336dead9
SHA1: e5a76d6069232b5bcbab60ab2d8d055fe8c77ec0 SHA256: d4c81917a0d2f1fd8a3469bb8f2dc2e5439ba9d9f7c0bdc0497a8246dee01a42 SSDeep: 3072:DwBqExvf4KVrhLc1Or0PD4+LdkVu1EJBLaIvoBDeSF7HBt0Le/Stwdcio+:DwB3l4KVrhY1k07hdQfDvo6+ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM | 107.20 KB |
MD5:
fced9bcc4cef795282830d110594f714
SHA1: bbb2ec9b3f91cf4489fd0c63d8f26ce073b7d632 SHA256: 4217bd2208b739e2141d2a75102cdd844dc5d042b58bf1d0b588e6a6731813cf SSDeep: 3072:xfQbi1r2WP1+K5+J/0IFzYRj7idUHOrpLzt9AIP/rA:xfmQKWP13g0Tj7zkLzt9bE |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM | 70.39 KB |
MD5:
0732b8bd80a6f3e4e2e3fd38d00dd163
SHA1: 3410a335ac14a57bf7e778ca3533a72a1b29406d SHA256: 50313e557bfe79de8b0acc9e24e23caaef5f2698eb431c3146b39b07c5d44de7 SSDeep: 1536:PH+P2ngRSh+p9rJXAUVvqH5PAQhFWZWJBug1zX2XBw83smm74g:PPGnrJXAgvCJAUWZw7d2x3tmr |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\BIGFONT.SHX | 316.78 KB |
MD5:
0bf10f4957b1979271c4a1a60babee18
SHA1: c8501be18e6dfff2645437f71d5285b9b9ac89ac SHA256: 42b59b97754f7e2d7230d96be9e8a8dbdf754046095036a6743776ec2549bd7d SSDeep: 3072:IvRCpr9UO8gmF005x7WXCWawuHk5FvoM6CgUzImj+TtYb3gAcsouq8+WbiXGmQGz:McUuiNhkvBPgUV+6EAcsozJWda |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\WT61FR.LEX | 602.55 KB |
MD5:
5bea008007a2a15112c4d0ef24f368e9
SHA1: 72d666e8b176902c93f09356051387574229a9a0 SHA256: 5315f222833481517aa0089a1d520e8d142bb3175c95abb39f99ba93439ab4d0 SSDeep: 12288:+faF+hGPOEmdFrGt9rNcIlLUI9puhhVwBDvjVhcj:+facwGEmdFrwrqIlbpuzsdhY |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1AR.LEX | 2.02 MB |
MD5:
648252ef2c3ddd420acaa10f1e67f62f
SHA1: 41f41376a0c084395a96158bf4eb58e5d512ac68 SHA256: edd33e346c99c7d8264656753d452661138f6e62b80345fa1e1f26cab322e0d6 SSDeep: 24576:JOyWC8CQCJC8Cy1XULEeJL3fpPp+qM3ZHDwV:6TJLRnM3ZHDwV |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FRAR\MSB1FRAR.ITS | 1.40 MB |
MD5:
79aedec6f288b40ff4f9e0606c054ac0
SHA1: b71a736032808313a7094042222699d3d35c35e2 SHA256: 5ad9f996d7ed12879f124d1f32f03ef4211e1cbfd71238e2db9668e98e45ebbe SSDeep: 24576:o4nHDFqMt8YONscreHzHuzAfBkhUKnImhyoZL3PkTHqaUQYkwlsrmXjAoQEF/duc:FHDFqdYONNeDuzApkhUYIHoV3POFUQw/ |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.DLL | 224.55 KB |
MD5:
8712b6dd7acde77d0ca8962c2fff59ad
SHA1: c495080118641ef242ed70fda33a4776d3cbf990 SHA256: 2c8779884a822daf8905c58f8ac03d99af434441afe187620f6c0763111d751f SSDeep: 3072:MDxniVxZ0r3vBuC3UEgybZfXwSCLX1zSqgIUW2N58J:knCoroC3U/MxXZCLX1zbgI528J |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM | 326.64 KB |
MD5:
a8ff596eee689a2d0724aa5622084e91
SHA1: 6cb8760fef344c401e14ff04f9499d58149c786f SHA256: d576360d70d376dc8fc70ac4c85a4c77e35e0d2338b73c29318fe7c1b17f9dca SSDeep: 6144:W/iCjekFDEFycCdSHbOXHOeV2IWYLXlB5cUC5M+YLhee1D6ihIxfwGvdnK:fCje+sASHbKVPpNxhLheeD6g1KdK |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.DLL | 224.55 KB |
MD5:
475829265285498b7624a7857a6fde35
SHA1: 974b0722400f2b1d2fef3fdaa72ba00aaa5dc298 SHA256: e704ff6f8dec3b0d1fc8b8a45bb8c1905e2c92148802f6848498a174a6bc0b9b SSDeep: 3072:B7rpYxzVNgfFBkbjvpzC34E4S3ZXkwSCvfRfO2U4ks4djN5ij:B7rpGVNykHRC34XIJkZCvfRfzU44pij |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENFR\MSB1ENFR.ITS | 921.26 KB |
MD5:
d5c966d2c2745945bc9e3c6ab623cc13
SHA1: 3036b4ef100f91f69a2208e10e5300ab47b4c7eb SHA256: d01be18228912790646981b2cef41e615285ee1b43c5a21b74283592f2871ce2 SSDeep: 24576:S1YfiG+HPp93oE/tvp9+WYwYyotoeSQyeEH3gL9irpGEX2:S1ONg93oM7YwY5toWgHKEG |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.ITS | 820.72 KB |
MD5:
cf73ac54e4037b3edd040a92608ca30b
SHA1: c74e7fc4ed735c6ae20a75070abb11d6a48a56eb SHA256: 586d39771ee822b8791e84b83197fb2a159fd5b28d4702776bd4d99a8225af64 SSDeep: 24576:QFdvU44SXjoReeW+gTtIlDDYilCdIJcVp9D:WvU44SXjon2tI98XSmH9D |
|
|
| \\?\C:\Program Files\Internet Explorer\SIGNUP\install.ins | 0.50 KB |
MD5:
b8e82d26383c0b0c5a0360c0c4bbd0f8
SHA1: 3a895598d69adfd4c906b5c6f6a0b1a00d1111e8 SHA256: 5144d0d8e3d04b6c1e62c400ea8c3d520663f83ca1e9912f5d8261a611ac0adf SSDeep: 12:f+ydMoOLJP6Nw1UinkROnNXUEN7YZ7mO3emTsXvezzYs:fDMoOLl6e1lnSOZUi67RiezUs |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENES\MSB1ENES.ITS | 955.33 KB |
MD5:
aaebac7f0013bc1075d846cc8710785d
SHA1: 5653fd4ba1da61046d5b94aee9d6f8c88197a282 SHA256: 2ae0091d9cfd61684841730aab854b8a9dbcda5914b481e7ee2efca11586dc45 SSDeep: 24576:RU6Expo2lu5EQudFB06VArUC4N6O8FIl0:RUBxq28563rA4N6O8FI6 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.ITS | 1.00 MB |
MD5:
653496689ed3abc558de4eca29d05ac3
SHA1: ef503679742fc5ccce205fdb6d482ed2ff3c7e3c SHA256: 3181fd82ae2007748320ad2d99ffd4923406ad864257aa89604f15889f199ef6 SSDeep: 24576:QIbUWwGqywx1TnO/faPRrBJPnSLqY+rgC4qf8sme+:QIbUWjDw7O/UeL0eqUF1 |
|
|
| \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\WT61ES.LEX | 663.05 KB |
MD5:
15d792867739f476ec9b9dff7e176fcf
SHA1: 121ec96798824ecb1e8c2b427975af5805cec89e SHA256: a009545d0b28e45b8e4324c5a2e42a2d3431a1a98036a39d9412b5b48b8872e3 SSDeep: 12288:eoZZLNBBpU2LWmsNQuiIIBuRZy0KvUt/Rm3+mUQNaidUj4W9pX:eIZDpUxrlXZy0btJm3BHEo2X |
|
|
Host Behavior
File (4062)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_uninstalling_.png | desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\_uninstalling_.png | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_HIDDEN, FILE_ATTRIBUTE_SYSTEM, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\DESIGNER\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\PerfLogs\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\PerfLogs\Admin\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\pagefile.sys | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\DW\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSPTLS.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ODBCMON.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUOPTIN.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUAUTH.CAB | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSSOAP30.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSetupPS.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSETUP.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_FR.LEX | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_ES.LEX | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_EN.LEX | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\IMCONTACT.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\IETAG.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FSTOCK.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FPLACE.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Source Engine\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\SmartTagInstall.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\MSTAG.TLB | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\MOFL.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT632.CNV | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT532.CNV | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\Wks9Pxy.cnv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\RECOVR32.CNV | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.INF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.ELM | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.INF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.ELM | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\ICE.INF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\JOURNAL.INF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\NETWORK.INF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\SKY.INF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\SKY.ELM | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\SPRING.INF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\SPRING.ELM | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\STRTEDGE.ELM | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\THEMES.INF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\WTSP61MS.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1XTOR.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Triedit\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1STAR.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1CORE.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1CACH.LEX | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\VBE7.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VGX\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VC\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHTMTXT.SHX | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHTGTXT.SHX | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHGTXT.SHX | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msador15.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msadrh15.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msadox28.tlb | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msadox.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msadomd28.tlb | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msadomd.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado28.tlb | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado27.tlb | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado26.tlb | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado25.tlb | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado21.tlb | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado20.tlb | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado15.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msader15.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\en-US\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adojavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\SpeechEngines\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Services\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\FPWEC.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\en-US\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\en-US\wab32res.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\DirectDB.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\msdfmap.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\msdaremr.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\msdarem.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\msdaprst.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\msdaprsr.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\msaddsr.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\msadds.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\msadcs.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\msadcor.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\msadco.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\msadcfr.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\msadcf.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\msadcer.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\msadce.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\handsafe.reg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\handler.reg | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\en-US\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSOSV.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\MSMAPI\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\MSMAPI\1033\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\MSMAPI\1033\MSMAPI32.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\MSOSVINT.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\SecretST.TTF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\rtstreamsource.ax | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\rtstreamsink.ax | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\PipeTran.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Pipeline.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\OmdProject.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\OmdBase.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\offset.ax | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\fieldswitch.ax | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Eurosti.TTF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\en-US\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\DVDMaker.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\directshowtap.ax | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\bod_r.TTF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\audiodepthconverter.ax | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\wab32res.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\wab32.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\xmlrwbin.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DissolveNoise.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DissolveAnother.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\Common.fxh | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\xmlrw.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\sqloledb.rll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\sqloledb.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledb32r.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledb32.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\msxactps.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\msdatl3.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\msdasql.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\msdaps.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\msdaosp.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\en-US\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Full\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHGDTXT.SHX | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\ICAD.FMP | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\IC-TXT.SHX | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\GBCBIG.SHX | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\EXTFONT.SHX | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\CHINESET.SHX | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\BIGFONT.SHX | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBE7INTL.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Push\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1AR.LEX | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\WT61FR.LEX | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.ITS | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FRAR\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FRAR\MSB1FRAR.ITS | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\WT61ES.LEX | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.ITS | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.DLL | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENFR\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENFR\MSB1ENFR.ITS | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENES\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENES\MSB1ENES.ITS | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\strand.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\sqmapi.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\SIGNUP\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\SIGNUP\install.ins | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\pdm.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\msdbg2.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\jsprofilerui.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\JSProfilerCore.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\jsdebuggeride.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\jsdbgui.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\iexplore.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\IEShims.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\ieproxy.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\ielowutil.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\ieinstal.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\iedvtool.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\iecompat.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\ie8props.propdesc | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\hmmapi.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\en-US\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\en-US\JSProfilerCore.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\en-US\jsdebuggeride.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\en-US\ielowutil.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\WMM2CLIP.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\sonicsptransform.ax | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\soniccolorconverter.ax | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\Parity.fx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\Filters.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Analysis Services\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msolap100.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00224_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01178_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00296_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02115_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00084_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00685_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00343_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099149.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099183.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099182.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099181.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099180.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106208.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107446.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107426.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107480.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107490.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107488.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107484.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145272.JPG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145212.JPG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145168.JPG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0144773.JPG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152716.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0158477.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0171847.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0171685.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185670.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0183574.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187895.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187893.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187883.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187881.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188667.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188587.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02386_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03453_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00610_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00942_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01301_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WNTER_01.MID | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WING2.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WING1.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WHIRL2.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WHIRL1.WMF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02218_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02214_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02201_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02198_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02187_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02134_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02116_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02106_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02097_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02085_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02082_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02077_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Document Themes 14\Thatch.thmx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Document Themes 14\Technic.thmx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Document Themes 14\Solstice.thmx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Document Themes 14\Slipstream.thmx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Document Themes 14\Pushpin.thmx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Document Themes 14\Perspective.thmx | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\$HOWDECRYPT$.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Waveform.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Verve.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Urban.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Trek.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Move | \\?\C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\PTB\StandardBusiness.pdf.spyhunter | source_filename = \\?\C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\PTB\StandardBusiness.pdf |
|
1 | |
| Move | \\?\C:\Program Files (x86)\Mozilla Firefox\xul.dll.spyhunter | source_filename = \\?\C:\Program Files (x86)\Mozilla Firefox\xul.dll |
|
1 | |
| Move | \\?\C:\Program Files (x86)\Mozilla Firefox\webapprt-stub.exe.spyhunter | source_filename = \\?\C:\Program Files (x86)\Mozilla Firefox\webapprt-stub.exe |
|
1 | |
| Read | \\?\C:\Program Files\desktop.ini | size = 10240, size_out = 174 |
|
1 | |
| Read | \\?\C:\Program Files (x86)\desktop.ini | size = 10240, size_out = 174 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\DESIGNER\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\DESIGNER\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\DW\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\DW\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\DW\$HOWDECRYPT$.txt | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\DW\$HOWDECRYPT$.txt | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\$HOWDECRYPT$.txt | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\$HOWDECRYPT$.txt | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\$HOWDECRYPT$.txt | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\DW\$HOWDECRYPT$.txt | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF | size = 7656 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest | size = 566 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll | size = 10240 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll | size = 4 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll | size = 48 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\$HOWDECRYPT$.txt | size = 295 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\$HOWDECRYPT$.txt | size = 684 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\$HOWDECRYPT$.txt | size = 295 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\$HOWDECRYPT$.txt | size = 684 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\MSSOAPR3.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSPTLS.DLL | size = 48 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\OARPMANR.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSPTLS.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSPTLS.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ODBCMON.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ODBCMON.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ODBCMON.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSSOAP30.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSSOAP30.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSSOAP30.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUAUTH.CAB | size = 6747 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUAUTH.CAB | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUAUTH.CAB | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUOPTIN.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MUOPTIN.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\$HOWDECRYPT$.txt | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML | size = 2296 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML | size = 1565 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSETUP.DLL | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSETUP.DLL | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\$HOWDECRYPT$.txt | size = 295 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\$HOWDECRYPT$.txt | size = 684 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSETUP.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSETUP.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSetupPS.dll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSetupPS.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSetupPS.dll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OSETUP.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML | size = 1886 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML | size = 5884 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML | size = 1988 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML | size = 1458 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_FR.LEX | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_FR.LEX | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML | size = 811 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML | size = 8723 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_EN.LEX | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_EN.LEX | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_ES.LEX | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_ES.LEX | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_EN.LEX | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSWDS_ES.LEX | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\IMCONTACT.DLL | size = 48 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FPLACE.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FPLACE.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FPLACE.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Source Engine\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Source Engine\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\IETAG.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\IETAG.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\IETAG.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FSTOCK.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FSTOCK.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\SmartTagInstall.exe | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\SmartTagInstall.exe | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\SmartTagInstall.exe | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FSTOCK.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\MOFL.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\MOFL.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\MSTAG.TLB | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\MSTAG.TLB | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\MSTAG.TLB | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\MOFL.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\IMCONTACT.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\IMCONTACT.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT632.CNV | size = 10240 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT632.CNV | size = 4 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT632.CNV | size = 48 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT532.CNV | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT532.CNV | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\Wks9Pxy.cnv | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\Wks9Pxy.cnv | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT532.CNV | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT532.CNV | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\RECOVR32.CNV | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\RECOVR32.CNV | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\WPFT532.CNV | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\RECOVR32.CNV | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\$HOWDECRYPT$.txt | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\$HOWDECRYPT$.txt | size = 295 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\$HOWDECRYPT$.txt | size = 684 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.INF | size = 529 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.INF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.INF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\$HOWDECRYPT$.txt | size = 2848 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\$HOWDECRYPT$.txt | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\$HOWDECRYPT$.txt | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.ELM | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\AXIS.ELM | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF | size = 1560 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\PREVIEW.GIF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\THMBNAIL.PNG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.INF | size = 486 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.INF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.INF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\THMBNAIL.PNG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.ELM | size = 48 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\THMBNAIL.PNG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.ELM | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.ELM | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF | size = 1293 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\PREVIEW.GIF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\THMBNAIL.PNG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\PREVIEW.GIF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\THMBNAIL.PNG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\$HOWDECRYPT$.txt | size = 3957 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\$HOWDECRYPT$.txt | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\$HOWDECRYPT$.txt | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\THMBNAIL.PNG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\THMBNAIL.PNG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\THMBNAIL.PNG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\$HOWDECRYPT$.txt | size = 5120 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\$HOWDECRYPT$.txt | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\$HOWDECRYPT$.txt | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\THMBNAIL.PNG | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\ICE.INF | size = 429 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\ICE.INF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\ICE.INF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\JOURNAL.INF | size = 499 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\JOURNAL.INF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\JOURNAL.INF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF | size = 1232 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF | size = 4 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF | size = 48 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF | size = 2552 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\PREVIEW.GIF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\NETWORK.INF | size = 585 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\NETWORK.INF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\NETWORK.INF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\THMBNAIL.PNG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF | size = 1364 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\PREVIEW.GIF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\PREVIEW.GIF | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\SKY.INF | size = 444 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\SKY.INF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\SKY.INF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\THMBNAIL.PNG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\SPRING.INF | size = 466 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\SPRING.INF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\SPRING.INF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\SPRING.ELM | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\SPRING.ELM | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\SPRING.ELM | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\SKY.ELM | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\SKY.ELM | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\THMBNAIL.PNG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF | size = 2527 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\PREVIEW.GIF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\STRTEDGE.ELM | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\STRTEDGE.ELM | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\THEMES.INF | size = 7276 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\THEMES.INF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\THEMES.INF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\STRTEDGE.ELM | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\THMBNAIL.PNG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\WATERMAR\THMBNAIL.PNG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\WTSP61MS.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\WTSP61MS.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\WTSP61MS.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Triedit\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Triedit\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\SKY.ELM | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1CORE.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1CORE.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1XTOR.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1XTOR.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1CACH.LEX | size = 1536 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1CACH.LEX | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1CACH.LEX | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1XTOR.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\VBE7.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\VBE7.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1CORE.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\VBE7.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBUI6.CHM | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VGX\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VGX\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VC\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VC\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1STAR.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1STAR.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1STAR.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBOB6.CHM | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBLR6.CHM | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHTMTXT.SHX | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHTMTXT.SHX | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHGTXT.SHX | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHGTXT.SHX | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHTGTXT.SHX | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHTGTXT.SHX | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHGTXT.SHX | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHTMTXT.SHX | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHTGTXT.SHX | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\SpeechEngines\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\SpeechEngines\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Services\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Services\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\FPWEC.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\FPWEC.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\en-US\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\en-US\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\ado\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\ado\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\FPWEC.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\msadc\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\msadc\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\msadc\en-US\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\msadc\en-US\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSOSV.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSOSV.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSOSV.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\MSMAPI\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\MSMAPI\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\MSMAPI\1033\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\MSMAPI\1033\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\MSMAPI\1033\MSMAPI32.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\MSMAPI\1033\MSMAPI32.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\MSMAPI\1033\MSMAPI32.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\en-US\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\en-US\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\desktop.ini | size = 174 |
|
1 | |
| Write | \\?\C:\Program Files\desktop.ini | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\desktop.ini | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\Ole DB\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\Ole DB\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\MSOSVINT.DLL | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\MSOSVINT.DLL | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\MSOSVINT.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\MSOSVINT.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\MSOSVINT.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\Ole DB\xmlrw.dll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\Ole DB\xmlrw.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\Ole DB\xmlrw.dll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\Ole DB\xmlrwbin.dll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\Ole DB\xmlrwbin.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\Ole DB\xmlrwbin.dll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\Ole DB\en-US\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\System\Ole DB\en-US\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\$HOWDECRYPT$.txt | size = 295 |
|
2 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\$HOWDECRYPT$.txt | size = 684 |
|
2 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\$HOWDECRYPT$.txt | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\$HOWDECRYPT$.txt | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Full\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Full\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\$HOWDECRYPT$.txt | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config | size = 48 |
|
2 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll | size = 10080 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config | size = 716 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\ICAD.FMP | size = 326 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\ICAD.FMP | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\ICAD.FMP | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHGDTXT.SHX | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHGDTXT.SHX | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\IC-TXT.SHX | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\IC-TXT.SHX | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\IC-TXT.SHX | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\GBCBIG.SHX | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\GBCBIG.SHX | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\EXTFONT.SHX | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\EXTFONT.SHX | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\GBCBIG.SHX | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\EXTFONT.SHX | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBHW6.CHM | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\WHGDTXT.SHX | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\CHINESET.SHX | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\CHINESET.SHX | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\CHINESET.SHX | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\BIGFONT.SHX | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\BIGFONT.SHX | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBCN6.CHM | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Push\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Push\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBE7INTL.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBE7INTL.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\BIGFONT.SHX | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\VBENDF98.CHM | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\$HOWDECRYPT$.txt | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.ITS | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.ITS | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\WT61FR.LEX | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\WT61FR.LEX | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1AR.LEX | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1AR.LEX | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\WT61FR.LEX | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.ITS | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1AR.LEX | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FRAR\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FRAR\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FRAR\MSB1FRAR.ITS | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FRAR\MSB1FRAR.ITS | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FRAR\MSB1FRAR.ITS | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\WT61ES.LEX | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\WT61ES.LEX | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.ITS | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.ITS | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.DLL | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.DLL | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.DLL | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENFR\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENFR\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENFR\MSB1ENFR.ITS | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENFR\MSB1ENFR.ITS | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENFR\MSB1ENFR.ITS | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENES\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENES\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENES\MSB1ENES.ITS | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENES\MSB1ENES.ITS | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Internet Explorer\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Internet Explorer\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Internet Explorer\SIGNUP\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Internet Explorer\SIGNUP\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Internet Explorer\SIGNUP\install.ins | size = 460 |
|
1 | |
| Write | \\?\C:\Program Files\Internet Explorer\SIGNUP\install.ins | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Internet Explorer\SIGNUP\install.ins | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Internet Explorer\en-US\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Internet Explorer\en-US\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENES\MSB1ENES.ITS | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\$HOWDECRYPT$.txt | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.ITS | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\$HOWDECRYPT$.txt | size = 295 |
|
2 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\$HOWDECRYPT$.txt | size = 684 |
|
2 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msolap100.dll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msolap100.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msolap100.dll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF | size = 48 |
|
2 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF | size = 7804 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF | size = 4955 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF | size = 5315 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00224_.WMF | size = 3378 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00224_.WMF | size = 4 |
|
2 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00224_.WMF | size = 48 |
|
2 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00224_.WMF | size = 1588 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01178_.WMF | size = 1212 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01178_.WMF | size = 4 |
|
2 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01178_.WMF | size = 48 |
|
2 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02115_.WMF | size = 4660 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02115_.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02115_.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00084_.WMF | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00084_.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00084_.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01178_.WMF | size = 3796 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00685_.WMF | size = 2472 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00685_.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00685_.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099149.WMF | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099149.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00343_.WMF | size = 1892 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00343_.WMF | size = 4 |
|
2 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00343_.WMF | size = 48 |
|
2 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00343_.WMF | size = 4032 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099149.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099183.WMF | size = 4946 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099183.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099183.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099182.WMF | size = 3840 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099182.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099182.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099180.WMF | size = 3394 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099180.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099180.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106208.WMF | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106208.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106208.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107446.WMF | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107446.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107426.WMF | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107426.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107426.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107446.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107480.WMF | size = 6024 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107480.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107480.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099181.WMF | size = 1198 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099181.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099181.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107488.WMF | size = 8000 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107488.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107488.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107484.WMF | size = 3040 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107484.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107484.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107490.WMF | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107490.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145168.JPG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145168.JPG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145168.JPG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145212.JPG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145212.JPG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145212.JPG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0144773.JPG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0144773.JPG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145272.JPG | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145272.JPG | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0145272.JPG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152716.WMF | size = 4580 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152716.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152716.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0144773.JPG | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107490.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0158477.WMF | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0158477.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0158477.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185670.WMF | size = 7304 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185670.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185670.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0171847.WMF | size = 6888 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0171847.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0171847.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187895.WMF | size = 3472 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187895.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187895.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0171685.WMF | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0171685.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187893.WMF | size = 5620 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187893.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187893.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0183574.WMF | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0183574.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0171685.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187881.WMF | size = 4696 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187881.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187881.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188587.WMF | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188587.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188667.WMF | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188667.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188667.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0188587.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0183574.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03453_.WMF | size = 2376 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03453_.WMF | size = 4 |
|
2 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03453_.WMF | size = 48 |
|
2 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187883.WMF | size = 2100 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187883.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187883.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE03453_.WMF | size = 7972 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01301_.GIF | size = 681 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01301_.GIF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WB01301_.GIF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00610_.WMF | size = 10240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00610_.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00942_.WMF | size = 4708 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00942_.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00942_.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WNTER_01.MID | size = 6915 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WNTER_01.MID | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WNTER_01.MID | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\$HOWDECRYPT$.txt | size = 295 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\$HOWDECRYPT$.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00610_.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WING1.WMF | size = 2582 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WING1.WMF | size = 4 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WING1.WMF | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\WING2.WMF | size = 2422 |
|
1 | |
|
For performance reasons, the remaining 3000 entries are omitted.
The remaining entries can be found in glog.xml. |
|||||
Process (54)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Windows\sysnative\vssadmin.exe | os_pid = 0xaa8, creation_flags = CREATE_NO_WINDOW, show_window = SW_HIDE |
|
1 | |
| Enumerate Processes | - | - |
|
52 | |
| Enumerate Processes | - | - |
|
1 |
System (78)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Sleep | duration = -1 (infinite) |
|
1 | |
| Sleep | duration = 1000 milliseconds (1.000 seconds) |
|
4 | |
| Sleep | duration = 500 milliseconds (0.500 seconds) |
|
72 | |
| Get Info | type = Hardware Information |
|
1 |
Process #3: vssadmin.exe
0
0
| Information | Value |
|---|---|
| ID | #3 |
| File Name | c:\windows\system32\vssadmin.exe |
| Command Line | delete shadows /all /quiet |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:01:16, Reason: Child Process |
| Unmonitor | End Time: 00:02:30, Reason: Self Terminated |
| Monitor Duration | 00:01:14 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xaa8 |
| Parent PID | 0xa9c (c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
AAC
0x
AD4
0x
AD8
0x
ADC
0x
AE0
|
Process #4: vssvc.exe
3
0
| Information | Value |
|---|---|
| ID | #4 |
| File Name | c:\windows\system32\vssvc.exe |
| Command Line | C:\Windows\system32\vssvc.exe |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:01:22, Reason: RPC Server |
| Unmonitor | End Time: 00:05:03, Reason: Terminated by Timeout |
| Monitor Duration | 00:03:41 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xae8 |
| Parent PID | 0x1cc (c:\windows\system32\services.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
B10
0x
B0C
0x
B04
0x
B00
0x
AFC
0x
AF8
0x
AEC
0x
B28
0x
80C
|
Host Behavior
System (3)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-04-17 09:53:03 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 125237 |
|
1 | |
| Get Time | type = Performance Ctr, time = 18113525906 |
|
1 |
Process #5: rundll32.exe
0
0
| Information | Value |
|---|---|
| ID | #5 |
| File Name | c:\windows\syswow64\rundll32.exe |
| Command Line | "C:\Windows\System32\rundll32.exe" shell32,ShellExecute |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:01:22, Reason: Child Process |
| Unmonitor | End Time: 00:01:27, Reason: Self Terminated |
| Monitor Duration | 00:00:04 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xb14 |
| Parent PID | 0xa44 (c:\users\5p5nrgjn0js halpmcxz\desktop\spyhunter5.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
B18
0x
B40
|
Process #7: System
0
0
| Information | Value |
|---|---|
| ID | #7 |
| File Name | System |
| Command Line | - |
| Initial Working Directory | - |
| Monitor | Start Time: 00:04:23, Reason: Kernel Analysis |
| Unmonitor | End Time: 00:05:03, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:40 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x4 |
| Parent PID | 0x0 (Unknown) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
8
0x
3C
0x
38
0x
30
0x
24
0x
C4
0x
9C
0x
78
0x
C0
0x
28
0x
C8
0x
44
0x
40
0x
5C
0x
34
0x
CC
0x
48
0x
D0
0x
B8
0x
D4
0x
D8
0x
DC
0x
4C
0x
E8
0x
EC
0x
0
0x
2C
0x
FC
0x
100
0x
10C
0x
104
0x
108
0x
110
0x
B4
0x
114
0x
80
0x
98
0x
8C
0x
118
0x
84
0x
11C
0x
B0
0x
90
0x
134
0x
138
0x
13C
0x
140
0x
17C
0x
68
0x
60
0x
74
0x
274
0x
2E4
0x
88
0x
3A0
0x
390
0x
458
0x
4A4
0x
4A8
0x
588
0x
3FC
0x
5A4
0x
3F0
0x
5C4
0x
4AC
0x
628
0x
640
0x
648
0x
64C
0x
654
0x
1C
0x
20
0x
6AC
0x
94
0x
710
0x
768
0x
BC
|
