8ebf2ae4...291e | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Trojan, Dropper, Wiper, Ransomware

8ebf2ae4c362f76d402703efe3dc095901f2d78917f88a520b67584a7d8f291e (SHA256)

LIGMA.exe

Windows Exe (x86-32)

Created at 2018-09-08 08:53:00

...

Notifications (2/3)

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

The overall sleep time of all monitored processes was truncated from "1 minute, 15 seconds" to "30 seconds" to reveal dormant functionality.

The operating system was rebooted during the analysis.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x950 Analysis Target High (Elevated) ligma.exe "C:\Users\CIiHmnxMn6Ps\Desktop\LIGMA.exe" -
#2 0xdf4 Child Process High (Elevated) cmd.exe C:\Windows\system32\cmd.exe /c ""C:\WinWOW32\\work.bat"" #1
#4 0xb04 Child Process High (Elevated) takeown.exe takeown /f logonui.exe #2
#5 0x554 Child Process High (Elevated) icacls.exe icacls logonui.exe /granted CIiHmnxMn6Ps:F #2
#6 0x8d8 Child Process High (Elevated) takeown.exe takeown /f "C:\Windows\System32\en-US" /r /d y #2
#7 0x444 Child Process High (Elevated) icacls.exe icacls "C:\Windows\System32\en-US" /granted CIiHmnxMn6Ps:F /T /C #2

Behavior Information - Grouped by Category

Process #1: ligma.exe
7682 0
»
Information Value
ID #1
File Name c:\users\ciihmnxmn6ps\desktop\ligma.exe
Command Line "C:\Users\CIiHmnxMn6Ps\Desktop\LIGMA.exe"
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:00:31, Reason: Analysis Target
Unmonitor End Time: 00:02:25, Reason: Self Terminated
Monitor Duration 00:01:54
OS Process Information
»
Information Value
PID 0x950
Parent PID 0x820 (c:\windows\explorer.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A70
0x 1A0
0x A44
0x 8CC
0x 848
0x CFC
0x DAC
0x D90
0x D50
0x D4C
0x ED4
0x C8C
0x 2D0
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
ligma.exe 0x00f00000 0x00f13fff Memory Mapped File rwx True True False
...
private_0x0000000000f20000 0x00f20000 0x00f3ffff Private Memory rw True False False -
pagefile_0x0000000000f20000 0x00f20000 0x00f2ffff Pagefile Backed Memory rw True False False -
private_0x0000000000f30000 0x00f30000 0x00f33fff Private Memory rw True False False -
private_0x0000000000f40000 0x00f40000 0x00f40fff Private Memory rw True False False -
private_0x0000000000f40000 0x00f40000 0x00f4ffff Private Memory rw True False False -
pagefile_0x0000000000f50000 0x00f50000 0x00f63fff Pagefile Backed Memory r True False False -
private_0x0000000000f70000 0x00f70000 0x00faffff Private Memory rw True False False -
private_0x0000000000fb0000 0x00fb0000 0x010affff Private Memory rw True False False -
pagefile_0x00000000010b0000 0x010b0000 0x010b3fff Pagefile Backed Memory r True False False -
pagefile_0x00000000010c0000 0x010c0000 0x010c0fff Pagefile Backed Memory r True False False -
private_0x00000000010d0000 0x010d0000 0x010d1fff Private Memory rw True False False -
locale.nls 0x010e0000 0x0119dfff Memory Mapped File r False False False -
private_0x00000000011a0000 0x011a0000 0x011dffff Private Memory rw True False False -
private_0x00000000011e0000 0x011e0000 0x011e0fff Private Memory rw True False False -
private_0x00000000011f0000 0x011f0000 0x011f0fff Private Memory rw True False False -
pagefile_0x0000000001200000 0x01200000 0x01200fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000001210000 0x01210000 0x0121ffff Pagefile Backed Memory rw True False False -
private_0x0000000001220000 0x01220000 0x0122ffff Private Memory - True False False -
private_0x0000000001230000 0x01230000 0x0123ffff Private Memory - True False False -
private_0x0000000001240000 0x01240000 0x0124ffff Private Memory - True False False -
private_0x0000000001250000 0x01250000 0x0125ffff Private Memory - True False False -
private_0x0000000001260000 0x01260000 0x0126ffff Private Memory - True False False -
private_0x0000000001270000 0x01270000 0x0127ffff Private Memory rw True False False -
private_0x0000000001280000 0x01280000 0x0137ffff Private Memory rw True False False -
private_0x0000000001380000 0x01380000 0x01380fff Private Memory rw True False False -
private_0x0000000001390000 0x01390000 0x01390fff Private Memory rw True False False -
private_0x00000000013a0000 0x013a0000 0x013dffff Private Memory rw True False False -
private_0x00000000013e0000 0x013e0000 0x013effff Private Memory - True False False -
private_0x00000000013f0000 0x013f0000 0x013fffff Private Memory rw True False False -
private_0x0000000001400000 0x01400000 0x014fffff Private Memory rw True False False -
pagefile_0x0000000001500000 0x01500000 0x01687fff Pagefile Backed Memory r True False False -
private_0x0000000001690000 0x01690000 0x016cffff Private Memory rw True False False -
private_0x00000000016d0000 0x016d0000 0x016dffff Private Memory rw True False False -
pagefile_0x00000000016e0000 0x016e0000 0x01860fff Pagefile Backed Memory r True False False -
pagefile_0x0000000001870000 0x01870000 0x02c6ffff Pagefile Backed Memory r True False False -
private_0x0000000002c70000 0x02c70000 0x02d6ffff Private Memory rw True False False -
private_0x0000000002d70000 0x02d70000 0x02d9ffff Private Memory - True False False -
private_0x0000000002da0000 0x02da0000 0x02daffff Private Memory rwx True False False -
private_0x0000000002db0000 0x02db0000 0x02dbffff Private Memory - True False False -
private_0x0000000002dc0000 0x02dc0000 0x02dcffff Private Memory - True False False -
private_0x0000000002dd0000 0x02dd0000 0x02ddffff Private Memory - True False False -
private_0x0000000002de0000 0x02de0000 0x02deffff Private Memory rw True False False -
private_0x0000000002df0000 0x02df0000 0x04deffff Private Memory rw True False False -
private_0x0000000004df0000 0x04df0000 0x04e8ffff Private Memory rw True False False -
private_0x0000000004e90000 0x04e90000 0x04f8ffff Private Memory rw True False False -
sortdefault.nls 0x04f90000 0x052c6fff Memory Mapped File r False False False -
private_0x00000000052d0000 0x052d0000 0x054cffff Private Memory rw True False False -
pagefile_0x00000000052d0000 0x052d0000 0x052d0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000052d0000 0x052d0000 0x052d1fff Pagefile Backed Memory r True False False -
private_0x00000000052e0000 0x052e0000 0x052effff Private Memory - True False False -
private_0x00000000052f0000 0x052f0000 0x052fffff Private Memory - True False False -
pagefile_0x0000000005300000 0x05300000 0x05300fff Pagefile Backed Memory r True False False -
pagefile_0x0000000005300000 0x05300000 0x05303fff Pagefile Backed Memory r True False False -
user32.dll.mui 0x05310000 0x05314fff Memory Mapped File r False False False -
windowsshell.manifest 0x05320000 0x05320fff Memory Mapped File r False False False -
private_0x0000000005320000 0x05320000 0x05323fff Private Memory rw True False False -
pagefile_0x0000000005330000 0x05330000 0x05331fff Pagefile Backed Memory r True False False -
imageres.dll.mui 0x05340000 0x05340fff Memory Mapped File r False False False -
pagefile_0x0000000005350000 0x05350000 0x05350fff Pagefile Backed Memory r True False False -
pagefile_0x0000000005360000 0x05360000 0x05360fff Pagefile Backed Memory r True False False -
private_0x0000000005360000 0x05360000 0x0536ffff Private Memory - True False False -
private_0x0000000005370000 0x05370000 0x0537ffff Private Memory - True False False -
system.drawing.dll 0x05380000 0x0540ffff Memory Mapped File rwx True False False -
private_0x0000000005410000 0x05410000 0x0548ffff Private Memory rw True False False -
private_0x0000000005490000 0x05490000 0x0549ffff Private Memory rwx True False False -
private_0x00000000054a0000 0x054a0000 0x054affff Private Memory rw True False False -
private_0x00000000054b0000 0x054b0000 0x054bffff Private Memory rw True False False -
accessibility.dll 0x054b0000 0x054b9fff Memory Mapped File rwx True False False -
private_0x00000000054c0000 0x054c0000 0x054cffff Private Memory rw True False False -
pagefile_0x00000000054d0000 0x054d0000 0x05587fff Pagefile Backed Memory r True False False -
pagefile_0x0000000005590000 0x05590000 0x055e5fff Pagefile Backed Memory rw True False False -
comctl32.dll 0x05590000 0x0561efff Memory Mapped File r False False False -
private_0x0000000005590000 0x05590000 0x0564ffff Private Memory rw True False False -
private_0x0000000005590000 0x05590000 0x0559ffff Private Memory rw True False False -
private_0x00000000055a0000 0x055a0000 0x055affff Private Memory rw True False False -
private_0x00000000055a0000 0x055a0000 0x0563ffff Private Memory rw True False False -
private_0x00000000055a0000 0x055a0000 0x055dffff Private Memory rw True False False -
private_0x00000000055e0000 0x055e0000 0x055e3fff Private Memory rw True False False -
private_0x00000000055f0000 0x055f0000 0x055f3fff Private Memory rw True False False -
private_0x0000000005600000 0x05600000 0x0560ffff Private Memory - True False False -
private_0x0000000005630000 0x05630000 0x0563ffff Private Memory rw True False False -
private_0x0000000005640000 0x05640000 0x0564ffff Private Memory rw True False False -
private_0x0000000005650000 0x05650000 0x0574ffff Private Memory rw True False False -
~fontcache-system.dat 0x05750000 0x057c5fff Memory Mapped File r False False False -
private_0x00000000057d0000 0x057d0000 0x058cffff Private Memory rw True False False -
system.windows.forms.dll 0x05970000 0x05e07fff Memory Mapped File rwx True False False -
pagefile_0x0000000005e10000 0x05e10000 0x06301fff Pagefile Backed Memory rw True False False -
staticcache.dat 0x06310000 0x0734ffff Memory Mapped File r False False False -
imageres.dll 0x07350000 0x09f62fff Memory Mapped File r False False False -
~fontcache-fontface.dat 0x09f70000 0x0af6ffff Memory Mapped File r False False False -
private_0x000000000af70000 0x0af70000 0x0b06ffff Private Memory rw True False False -
system.core.ni.dll 0x714f0000 0x71c02fff Memory Mapped File rwx True False False -
dwrite.dll 0x71c10000 0x71dfffff Memory Mapped File rwx False False False -
mscorlib.ni.dll 0x71e00000 0x7302afff Memory Mapped File rwx True False False -
wow64cpu.dll 0x73030000 0x73037fff Memory Mapped File rwx False False False -
wow64.dll 0x73040000 0x7308efff Memory Mapped File rwx False False False -
wow64win.dll 0x73090000 0x73102fff Memory Mapped File rwx False False False -
payloads.dll 0x73180000 0x73187fff Memory Mapped File rwx True True False
...
gdiplus.dll 0x73200000 0x7336afff Memory Mapped File rwx False False False -
comctl32.dll 0x73370000 0x73401fff Memory Mapped File rwx False False False -
comctl32.dll 0x73410000 0x73618fff Memory Mapped File rwx False False False -
system.ni.dll 0x73620000 0x73fccfff Memory Mapped File rwx True False False -
clrjit.dll 0x73fd0000 0x7404cfff Memory Mapped File rwx True False False -
msvcr120_clr0400.dll 0x74050000 0x74144fff Memory Mapped File rwx False False False -
clr.dll 0x74150000 0x747f7fff Memory Mapped File rwx True False False -
version.dll 0x74800000 0x74807fff Memory Mapped File rwx False False False -
mscoreei.dll 0x74810000 0x74887fff Memory Mapped File rwx True False False -
mscoree.dll 0x74890000 0x748e8fff Memory Mapped File rwx True False False -
dwmapi.dll 0x748f0000 0x7490cfff Memory Mapped File rwx False False False -
uxtheme.dll 0x74910000 0x74984fff Memory Mapped File rwx False False False -
apphelp.dll 0x74990000 0x74a20fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74a30000 0x74a88fff Memory Mapped File rwx False False False -
cryptbase.dll 0x74a90000 0x74a99fff Memory Mapped File rwx False False False -
sspicli.dll 0x74aa0000 0x74abdfff Memory Mapped File rwx False False False -
user32.dll 0x74ad0000 0x74c0ffff Memory Mapped File rwx False False False -
shlwapi.dll 0x74c10000 0x74c53fff Memory Mapped File rwx False False False -
advapi32.dll 0x74c60000 0x74cdafff Memory Mapped File rwx False False False -
powrprof.dll 0x74ce0000 0x74d23fff Memory Mapped File rwx False False False -
kernelbase.dll 0x74d30000 0x74ea5fff Memory Mapped File rwx False False False -
combase.dll 0x74f70000 0x75129fff Memory Mapped File rwx False False False -
kernel32.dll 0x75130000 0x7521ffff Memory Mapped File rwx False False False -
imm32.dll 0x75220000 0x7524afff Memory Mapped File rwx False False False -
kernel.appcore.dll 0x752b0000 0x752bbfff Memory Mapped File rwx False False False -
shell32.dll 0x752c0000 0x7667efff Memory Mapped File rwx False False False -
windows.storage.dll 0x76800000 0x76cdcfff Memory Mapped File rwx False False False -
oleaut32.dll 0x76ce0000 0x76d71fff Memory Mapped File rwx False False False -
msctf.dll 0x76da0000 0x76ebffff Memory Mapped File rwx False False False -
ole32.dll 0x76f30000 0x77019fff Memory Mapped File rwx False False False -
sechost.dll 0x770b0000 0x770f2fff Memory Mapped File rwx False False False -
profapi.dll 0x77100000 0x7710efff Memory Mapped File rwx False False False -
shcore.dll 0x771d0000 0x7725cfff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772c0000 0x7736bfff Memory Mapped File rwx False False False -
gdi32.dll 0x77370000 0x774bcfff Memory Mapped File rwx False False False -
msvcrt.dll 0x778d0000 0x7798dfff Memory Mapped File rwx False False False -
ntdll.dll 0x77990000 0x77b08fff Memory Mapped File rwx False False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7fffffff Private Memory - True False False -
private_0x0000000080000000 0x80000000 0x8000ffff Private Memory - True False False -
private_0x00000000fec1a000 0xfec1a000 0xfec1cfff Private Memory rw True False False -
private_0x00000000fec1d000 0xfec1d000 0xfec1ffff Private Memory rw True False False -
pagefile_0x00000000fec20000 0xfec20000 0xfed1ffff Pagefile Backed Memory r True False False -
pagefile_0x00000000fed20000 0xfed20000 0xfed42fff Pagefile Backed Memory r True False False -
private_0x00000000fed45000 0xfed45000 0xfed47fff Private Memory rw True False False -
private_0x00000000fed48000 0xfed48000 0xfed48fff Private Memory rw True False False -
private_0x00000000fed49000 0xfed49000 0xfed4bfff Private Memory rw True False False -
private_0x00000000fed4c000 0xfed4c000 0xfed4efff Private Memory rw True False False -
private_0x00000000fed4f000 0xfed4f000 0xfed4ffff Private Memory rw True False False -
private_0x00000000fffe0000 0xfffe0000 0x7ffaf7a0ffff Private Memory r True False False -
ntdll.dll 0x7ffaf7a10000 0x7ffaf7bd1fff Memory Mapped File rwx False False False -
private_0x00007ffaf7bd2000 0x7ffaf7bd2000 0x7ffffffeffff Private Memory r True False False -
For performance reasons, the remaining 26 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
»
Filename File Size Hash Values YARA Match Actions
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeBackgroundTaskHandlerRegistration.xml.ForgiveME 2.94 KB MD5: e867729a36210750c21419ba51950b48
SHA1: 70363669ceee640d92824337faf37f9ffaff9428
SHA256: 81f513af1306c24d7fb7e79bb03c6514f2ee20559c6122b789d77d571b40bc3d
SSDeep: 48:c/8nA3YkIOSYCoPbWEEqJ90iDRlbExsbiRT5tysBr9yKK9PQZ8Yz6ep3qXBmE5bf:c/8nA3fr6oJ90IRlIx7qnazjJEluXJxs 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeBackgroundTaskHandlerLogon.xml.ForgiveME 2.77 KB MD5: 7491a0177771535ebe4947b4e011592c
SHA1: deb6bea6c49d60fe958cb747016813fd1fdd7ab5
SHA256: 9e721b6a9c69187a3bc84e0e4b0482cd30cc4e985dc32b3e5d9e759a4f42ffe6
SSDeep: 48:EuAEenbxlpVFNb+1o/0lcogrAJ8n+nL0UPyRQmdeAJa2y+F6PKVZJinb5VxAUoxf:EuAR9h7b+u/0le3n+nI0yWmva2y6mrnO 		False
...
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\en-us.16\Stream.Platform.Culture.man.xml.ForgiveME 1.73 MB MD5: 505b56f5b9c6a74bf29d2f3146bca577
SHA1: 922f42151f69e4fc5c0606b1bade31c3f1c7e4d1
SHA256: 7c2a1623fdc1244c0c07b03d8e038c70178f8b82e6b3b1f95ea60a2cd506e26f
SSDeep: 49152:fNrFEjLvERUP8lvzvJU7kMLU3nDk3DqPuDw:lruZ89zvJUXU3Q3D5w 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeOsfInstaller.xml.ForgiveME 3.52 KB MD5: 49c358d29d2cc7a850bc5c3d76fba9ec
SHA1: 37b266b5524f1d7f0ced1cf2c1e75b1896eec311
SHA256: bc92c1c4e497592b747f692ed4c2fa9b33806deed96e2f391f1bd66b2f439d8c
SSDeep: 96:CYKfopIvFUPxiW1FvmDfWFhErwIQRaKsQ8W:CDdvFUPxTH6WPIsH 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\8DAs79 _K.doc.ForgiveME 34.89 KB MD5: 4bc6a57ee31c96a6ecb004284a0858dc
SHA1: 5a15d938d564aa002b2df3b30dece1848df6b9d0
SHA256: 44dabfafc06081694952896b5594e67f2575d3abb461bab236e8075177c93d85
SSDeep: 768:b8M8gvJ4mai6fi9g5uhKozRZWdGSgfdGZbEdUD:bZxvvajfGg5uhjzzHdswA 		False
...
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\-v8NyVF6Hq8N 4.flv.ForgiveME 4.42 KB MD5: b33449b261d27bafe96de10115d7f274
SHA1: 793c4d6122fe59c75734373c7c766e43789046ab
SHA256: 408bcef2390829e52d49bce9f829256c627e53f0da215d31f4c330935ca07d6d
SSDeep: 96:uuih5AL82wdthVyq/DFe4yN2C+dAJIklTmiugxPT9BqG+emLd8A7xN:uua577/Aw7gIklTmoPTKp3d8AH 		False
...
C:\WinWOW32\icon.ico 7.51 KB MD5: 95517dfad14dfb29e883df2e94f901bc
SHA1: 9625e5ad8aed308b686dc544a6a37eb064a08527
SHA256: 8d38171ee9927844d2abf2f77685f6ad4dd877fbfdccc1c969da7e3d13340a60
SSDeep: 192:xs3n7O1cWLZ6LyDcpZoLygjmUtWTbDx7hUh:uX7JiSyDc7omAmnTbDxNUh 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\dIzOux_V.png.ForgiveME 50.33 KB MD5: 79638dbd69aa8868a01ece88642465ba
SHA1: a0e12563f5bc9afcc28ec8e3cd73bf933f6b1ef4
SHA256: fba6a9a5dee5f261bfd96a3cc5d60a6aaedf35b2637c8b05da942376e61d6934
SSDeep: 1536:R/ZFkrmNnywmeXIvtCcrNPaxHx3QD6CKxPiHR:R/Lpyw9ytCsNPSH+6LxPIR 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.visiomui.msi.16.en-us.xml.ForgiveME 1.10 MB MD5: a1a5f8c37b9eb80caa9777379e375447
SHA1: c39184ae75054526b066a946f384ec30e5b8dc96
SHA256: daf65ccacc7460b68661aa233023948a010a14e85d372705fb5f5027f62fa877
SSDeep: 24576:BG9+eCSzRwf0v7CEq10Ol2kyXdzEao7n105NtBK3aIVTrIKEJCO6WG:Bg+twRDnq10OutzEao7105NrB8TstG 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml.ForgiveME 123.88 KB MD5: caf69a92f4a787c028ee8aea7d82cead
SHA1: 02439351a79e47b6e05a0409dd5f23f4363763a0
SHA256: 4be59941e6bab182f7d606816c49413440718eda7170f6693183764b44d5c91e
SSDeep: 3072:wNWZTYPQzpHnMlfk/JZgecsgNf2R+DV/xfGB1ewpQCr/:YiYPQ1Hn2s/JSecdw+DbmBGU 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\CZiQMWk.avi.ForgiveME 53.33 KB MD5: ad53ef0e762040b8f9b2879892f04cf9
SHA1: 3096830822957b06bdc2228d6f36a2fa00030f80
SHA256: 2968bedb499b161735757be411b0f9f929d8a8942171c4ea4ae34c3122586117
SSDeep: 1536:k1aifg3Ks5cMp0/xebK8rGFQvrvlSD+AWZB9:QaYg3ZCR2GUksr9 		False
...
C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml.ForgiveME 5.77 MB MD5: 0c7fc54b273e2d86874247a8c42abd95
SHA1: 8f62c756d83373ffffc4961dcf31ccb234cc9f8a
SHA256: 8b581ba17fa336b728825808232300975fc8efd7f6014acc3ba6d26d8c080a66
SSDeep: 98304:AcSpr+s+uKVczSCcE/e3cH0sumAB1rnyjW9JKcF3EBSykCV1cK7eweOLzRSlQ:b2r+XuKVczh/QcIryaTHFmS1KKweO5Z 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.ForgiveME 96.14 KB MD5: 95fc3205577226aa97c445e15373e8e9
SHA1: 79f59b466e28a9dce46371ed1ea4b634c99efab2
SHA256: 5bc0677a7fcdae9add9cde1df94333458981698aadb66d68be78ac8d3ec54027
SSDeep: 1536:speVMwYzrWE0UChSGIbZlA23kQ6IOJQmuy+7hdFxF1UYWCjLGTis5BNXBer66:speJV9UC5IVT6p+r3PjCGsb3p6 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ED8z5hvaRbfKFmQSj.mp3.ForgiveME 84.33 KB MD5: 4198c1753b472e53bdafaf4e10d6455c
SHA1: b9679883ca089bf89a59b2f3715745985bc7cde8
SHA256: 3e76b7be7caba54b34adefca637c0ca57fb62a251e5ee44dba8c9c28d4101e67
SSDeep: 1536:13MI6kJo9f3PckZ3TdashzcPiNAG4cQVa6xkuqshqOC5ZnGroVZb+P4kwoN68:Juqo9/E0jka46Sauqsh3oTe7Rt 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.ForgiveME 103.61 KB MD5: c8b99fb9a65ae9d00cf9885fad2de561
SHA1: 4996ac5d325ba76829be644f141c76e4f94335f4
SHA256: b49012069861a2f47b2b8a47478b3c66f62a28be4540d3058f60cbcfb4d6a4a2
SSDeep: 1536:a/I+MRHM+dTFlkUAHCIEm76+k+EmDri6ROxfelnYzKaO+Zoh0lAca:abAR7AF2L/mLEVK63Cca 		False
...
C:\ProgramData\Microsoft\ClickToRun\9D76938C-943D-439F-A135-26D02821EE05\en-us.16\stream.x64.en-us.man.dat.ForgiveME 861.95 KB MD5: 5cf2582d9c520a2d2ea214b7cb695442
SHA1: b2dd51670f74605649dfec0edbcfcde99aab9fed
SHA256: 51c2ce23bc5149ab908e5971fcb012c29955eebd97ac46b6a86fb231184b6bfe
SSDeep: 24576:l/rUrsnwXPNxvCJ5S9hVo/Z9AV1BtG9Az:ZUrYwXlxI5S9TEHI1Cyz 		False
...
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\x-none.16\stream.x64.x-none.man.dat.ForgiveME 5.07 MB MD5: e18e45d0fa1e0ab370146c63414192d5
SHA1: 481bc2a6c4ce9049cd8d8b561d3fd4ced18bee12
SHA256: dc2316f3597f94e1554afcab05510895eae54e9890880f9fd9e8e9d3c946d0a6
SSDeep: 98304:kaq3/9czv8QwuYNx4rl5kRdSgIwHwDe/GKdHeSH9U6uBccGwB977Q6ZVvT:u98v8bxAlSBIx0GKNwXB9nQ6r 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.ForgiveME 794.55 KB MD5: 43988012562c29b4900e5dd018ff8e67
SHA1: 1f47589b94f6ec89fc9eff3ebba51048b0f55655
SHA256: 33cd8f01c03d51083a4b5e3c45fc6556a182a0f06fb9e1722567e5296e091add
SSDeep: 12288:FBOX4C+guBhNhsrmYnVFVSdyz2pHGIGtu8SdrCTZeGlJJw+vMOr+Ju:CX49NhNyrmeqiEmc8SNCTjo+vUJu 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml.ForgiveME 94.62 KB MD5: a1f7c67ee6e4cf94de52c98a934d7fe2
SHA1: 3fd3177323ed41912c6a529b74777db1fb544ccd
SHA256: 356e1d0f01aaa2f5b9709ad871b095ae6157163b427ada9cbeebfd065c4060b7
SSDeep: 1536:MDFZuUkMuDXrAXah5Vs1bAfuGlmLHQWO5dMrc59yAb73CE+qTuhOn:MykubrQa14cu00HiX5/b7lTz 		False
...
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\EDA58A0B-AD79-496A-8530-618D08767E60\x-none.16\stream.Platform.x-none.man.xml.ForgiveME 10.00 MB MD5: e509aab2e5ed4d2ed6ac0f9fe1a7beb7
SHA1: 4ab403dc710bfe386fdf6bc8f95d4cc1c36b4230
SHA256: ff7d2ab6fc10fc60c6229b5c6c6083f3455a6ff473420543967f54b8b553eb3f
SSDeep: 196608:cnu03cRFzJW/c8/L76GXPy5X7InGGB5DfG512tIanN/1kXuXkobXTvJN35:ET3cRDW08TetIGGDDFIanc2bjbPp 		False
...
C:\WinWOW32\work.bat 0.78 KB MD5: c02c8d9ca4ddd23a8a8f606410114164
SHA1: 185a3bd73be1b99a73a7f78922b6f8fc3a6ab3ec
SHA256: 38e2a3524b7ba05729037911be32598a324eb99c6857cfd93b28115804d089ee
SSDeep: 24:CLJepAC4PwxOi+flYtTH4UV4Qh9iwubER4ul8aLZ+c:yJeKC48+fl6TH4M4wYwuwxlhLZ+c 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.ForgiveME 188.36 KB MD5: 3876150dada949f27028ab5d87164f61
SHA1: 60587cb00b089f7bc5261adbb6dbcea6cccda815
SHA256: 5c659864f1e058740513a5a32b6eb135829f17b64ca9f9f7f89aca470c909534
SSDeep: 3072:nBInJWVH1Pi9r3TOg/Dh+Oo/9BVORxLSLN/iydXvlRTzB0+uz/0cyW829rjzPWX+:nGnJWVH1P6zKmh+OwBESLXl1mpvyWFr5 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\3nApnpXou.rtf.ForgiveME 22.78 KB MD5: b6a0fa89b87588189578de2531ab9e91
SHA1: 9ffe3e188310a243e9fbd3b09fc2a67b5c7991fd
SHA256: c35a8695d4b69b45b0844e8bb6288fe08209735cb38c70e60c211ee1643ab10f
SSDeep: 384:Crq8k9IZjHGwbiV9LQ+sGxIzd9T1WAq32+vtUYsbDy856HvVwnzBL:C+ZQHRbiV90+JIzD1WAq37tUYsbm856e 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\4tl50FkWgJm.bmp.ForgiveME 28.23 KB MD5: aeca23349eca4d8522f6dc82ef649e02
SHA1: 6a34e855bb52290a364c9a08c9f7cfa0770e4111
SHA256: 32a3a5cf7be4299e9011d7fae90e18918c93f9f2f0cd4e7fcfb1f3839ada4eb8
SSDeep: 768:vQYn2AybuP4YNzcT+inDjOkdGzxoAkCiriHc/MqEFR9wG:YgUuvMpDfczxoAkntZEFRT 		False
...
C:\WinWOW32\mbr.bin 0.50 KB MD5: 4efb0f32bf5badbfe4bafad794384600
SHA1: dc02ea8204956a486ed7fa0ad00b265a2a88fc8c
SHA256: 18d91faaaba711c880cacbf87ccb9874fe4b9225aa15c91905d90fec3fe9ee05
SSDeep: 6:M00XVih+SF1AfncBu2WUuaP7U06Ko+FDsXC1mCez:gXV01AfcBZWU1A0zD2Pz 		False
...
C:\ProgramData\Microsoft\ClickToRun\9D76938C-943D-439F-A135-26D02821EE05\x-none.16\stream.x64.x-none.man.dat.ForgiveME 3.52 MB MD5: ddf2029436068f0e32264a63e8107274
SHA1: 5c5560144d7dd58b84638ee0431632915ee31960
SHA256: e55e01e2e680924ae340175b73252d358c1d10b27377a298fccbb599994af36d
SSDeep: 98304:p46ErQyP3dT8i0XW4UnyQF5Bbgj4LqtLRzulv27hGzTM3Sd:p46EvhG+Ffgrd18v2EHgSd 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\4D-RXRdL_2N.mp3.ForgiveME 19.36 KB MD5: 53328c6c835ca779280f3f9f6846e761
SHA1: 5d7e34f0d98122316f2a8186f07e1ebbd65ec88a
SHA256: d98716c50494cc482bd8f0ed81b595e02ef997dd705f90a342fb18c927938799
SSDeep: 384:Q0SZZqJjBp2NVTsaOE8VqeDLCddEHRxmhlr3ZoH3GUJ4dKiNWi:Q0Sr8jBp2/PeDLCdK7mGXrZwF 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\CnWmKSFK768cf2Qzf.m4a.ForgiveME 35.03 KB MD5: 64717b8d532540487415529c68726417
SHA1: 24dc20a44849918e8f359519badae3108f1126e8
SHA256: a26375b635d2c34ad28ac4e06fe17a92bb4f91d3a1b6277cac2c2a674d422e79
SSDeep: 768:kKrZfOvVqC58RYlrongvBOtlriyeV1lWsWA2Dh1+msj95kWW/XK3VCdOb:XrZmvVq08RYVerifVPWjL+98P/XKlSC 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.ForgiveME 95.69 KB MD5: d5463fc03939b9f4098557b6d5817a15
SHA1: f8638bee90898f7d4c770732edf8645d9ee49270
SHA256: a099a7d71fcc0ee2586c68f400eafadba59a6a4182bb8ba90ec481b28af01568
SSDeep: 1536:sscpe4fZPJ37GshyGEDBsYuITD1xOXfRTiAqezzsBN2b4HcfpxkacTxWn4:Zcpe0VVGshuP7DDKRmvdIbXRxk1TxWn4 		False
...
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\EDA58A0B-AD79-496A-8530-618D08767E60\en-us.16\stream.x64.en-us.man.dat.ForgiveME 1.07 MB MD5: cd0d5a17d13786081fccf23cd4c38311
SHA1: a1da4ba278aae7e8886ec824422e10fc4582094c
SHA256: f17719dc85a3408dc84e6a3e358e7de9e64eb9e2d5f5daf4adbef989327d77e0
SSDeep: 24576:icWlh0Qn2dTSIsqLBYqDRBsMaL5aSdKTjNC7PU+b580bpi89BQC5G:iln2ku4NhcjNC7BbTpz40G 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office32ww.msi.16.x-none.xml.ForgiveME 335.83 KB MD5: 8ea789f982b5fee45490e4e109427bd0
SHA1: 5287a99892dc8fc348bd3a74f4ecc58525e63899
SHA256: 537d28fe6ed2de62b33ddab8f8e6a392b8b31c1d23b61e03a81ce5b7bf246809
SSDeep: 6144:8STadE2gePrizUM0rA/mG4yxdzICl1RPqZAKKWI2P7TOsD1JE8Y0UzfR5MSpbZ/V:8SGvgxzUMmWT46wZAKUs5m50gRZzJ 		False
...
C:\WinWOW32\Payloads.dll 14.00 KB MD5: d476188465a17118dbfedf72189f8240
SHA1: 570398ef3b4a5a07f054c9a7da96a6e708c2bcf2
SHA256: 1a7d479053a05c167a9d79222582d6a4f45f65bfc3689d7ef2084f7366963dcb
SSDeep: 192:u4uqCRNBCuYsXYUhE4oUe0a8EW5ZnJlbh/v3hrnT41DDVv9N5dAFjN:JcFhhOUexwFJv3hr81fVL5d+ 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml.ForgiveME 76.36 KB MD5: 8eaa7045f17eafe853f20b19ed179294
SHA1: 8baf54c61922eb2e04c032194e30d8940701d641
SHA256: e5a5f01f5821ee46be56814430ef627fd77ada1aa9b8a3e74ba4db15665f4c0b
SSDeep: 1536:Dew7U8rl0xw5pFL1ILWOe3kdcrJ+7sz9V3hDSAm4nJ3S0uqgo1M7JEJHWUCsk:Dew7/reS5p11IXwrc7+JSA/3VNgahCsk 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.ForgiveME 89.92 KB MD5: c56a6198571e95f3543aa691b42941b7
SHA1: 7a4751a939caf247d1a815f151e4862ed6015efb
SHA256: d9cbda78053c39d338d3fd1b3b52d7dd078cc31a3693ca836f6cf8d5831bcc2a
SSDeep: 1536:+REDL9kjvj2iGV3UwL4DShrJCf+iGdIsUlKOPmQ2LbaNTDvGHr:+6VkloLCStJ47GqsUMjnaNXGHr 		False
...
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\EDA58A0B-AD79-496A-8530-618D08767E60\x-none.16\stream.x64.x-none.man.dat.ForgiveME 5.83 MB MD5: a7cb5ec8620af864f0362693742b1841
SHA1: 02d61ab0fc3c61ff8b4b38d466e5a86f27973c74
SHA256: b5fb6e0a2a75846002a32b9dd5f3f9876345d4438c2ead8d22679734c580be32
SSDeep: 98304:xz4V0QB+EMhUgaXBgUEKXNXwNZsvcOsr5Fj8c9pYgUDFnQ92LdGp8YGNIr0zGwvw:xz4V4UXJvcOuP3jYgUDu92g8Y6IJwvCl 		False
...
C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\folder.ico.ForgiveME 29.23 KB MD5: 8caf9364d863630e25da1dcc70603525
SHA1: 60db4ceff40d46300cff3d9350e7b3cb784f2641
SHA256: 65dd605668ac3acc6c49aaf8d32090ec6bd2e4832711119f88913eb032738f3f
SSDeep: 768:jT52gN96sjGFrlUkrdNklONzA5aTLj8HL7kb3VtKrhNLVhlh03pfiH:jT5xH6GGFrlUkP/9lTLj8HL7kbltihNr 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\-hrD ctZ_IvrK7s.gif.ForgiveME 2.61 KB MD5: 427c6703ea65f2f90b79ee2a826d8178
SHA1: 42afe7cbac735ee85c1da4269b41aebcb57270fa
SHA256: b8bed6746283b6ba27f9e921d67aabb0e673c196ff77bcd66f015ff2e45668b4
SSDeep: 48:lZuyZtRlVeFnLkKkw2hFJImEPB4US3Fp7vuNtjwEy7NAku+3MKhKN0pusbATJCrN:iKERiJImoYh+Bjy5npusbATJoN 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.ForgiveME 540.14 KB MD5: 95a78a2faab0c9e91980544fc41456dd
SHA1: b4eb33f75782a1158152e3ccfafed72b3646d024
SHA256: 84ebe7624535b52a6234441a1bb001ff38c238c3b9ee1840eb50aac449734dc5
SSDeep: 12288:+v50BY5rOPEMufJGV+NeRKZGxzpZ6gRQriLz0Hd:+v5YY56PEnhGANepx1ZDRQr9d 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.ForgiveME 3.17 KB MD5: 91368a78b9605d02b10f8b8b756abbb3
SHA1: 0f9937b88192ef79096f2f981605ae8a1ed8b09c
SHA256: c4523de913ae16c20d0f8d9d3e567edb864b2d0911413c29e960628a52460a27
SSDeep: 48:ERnx55Flr+BAtsxsHAqpRoC0Y820YENl/pSReXil8WRw8jpGhDhHM9NAQnAVr1Df:mx3ntACpREUQORNK8bpGLHguQn+f 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\EB G6qCWqieCGCoHg.ppt.ForgiveME 14.98 KB MD5: 982d9992975a9bc58dd97cd3944dc9da
SHA1: 9639c83601343f147ff12adc448f129da73f1d25
SHA256: 6adfac9e4b0a810f1606ebebc403656d974a33be05c3acb4d37a78cbb81cb765
SSDeep: 384:Ij+eUvVsWexowatEBwKP0tNmNAFjXrjIqAR2hnKbmFi:LeKvwjBwImNmexrjfAAsbmE 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.ForgiveME 3.23 KB MD5: 965ecd8d87b623e9d3e5c0d8fa91db89
SHA1: ee7adb3e8d6feeb9ea604409db0993e35e60a8c4
SHA256: 8c84f2b463ae26e98e15c5b46f93243eb5bc5b692a3d1b1ed3843ef9238919b5
SSDeep: 96:FtHkIpPGvgaWUpAwtn1ectoPAA+pxu+ALgrZb3:FlpPGvvty61TaYAF+xVL 		False
...
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\en-us.16\stream.x64.en-us.man.dat.ForgiveME 0.99 MB MD5: 8403598b02b23453cfdbe4b645962d22
SHA1: 87fc5b5e032ccef48da39828e81aae48a638969b
SHA256: 72afc3a945c02477ba7a3277baee9306e0c6d172cad55c21ce522ac216d106ff
SSDeep: 24576:FNgB4QAmhQPsRH0aSsEy/ZQUWUYSIC70gT40s1OqTHE:sBRtesbsMT4r1OUHE 		False
...
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\EDA58A0B-AD79-496A-8530-618D08767E60\en-us.16\stream.Platform.Culture.man.xml.ForgiveME 2.00 MB MD5: c1ffb6363216778d0521b459d09695ee
SHA1: 3e2a9859bab20c222f9149ad668b0d0ad1666391
SHA256: d49fe1667a697ab7ed420c78ed15a79f94fd5c3b811e70837f4ed7bb2bb15db3
SSDeep: 49152:QvN5Tva+c0LAKNqyHkB+JpukNYv27e7S4LQKYLz9/eHLe:sYuAKEyEB+dGv27uLIP1QLe 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.ForgiveME 106.41 KB MD5: fd24f9466566443bcdfb2c43a58e20f1
SHA1: 157702ea0c10a7c4930a545133df8e4c584183c6
SHA256: d2090d04349ed137c43abb56e3feb89db08a48d76557b960e24d9dfc2fc62b91
SSDeep: 1536:HUn52WxGixvrOw2iTr+3s0MnsH1Cm5iewQWuowwlVSKkpTgqRepuv2AcMK7alNWh:HUwadOpD80osV/ZowNpTFRepMc4lEaNA 		False
...
Host Behavior
File (2375)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\CIiHmnxMn6Ps\Desktop\-hrD ctZ_IvrK7s.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\-hrD ctZ_IvrK7s.gif.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\3nApnpXou.rtf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\3nApnpXou.rtf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4D-RXRdL_2N.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4D-RXRdL_2N.mp3.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4tl50FkWgJm.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\4tl50FkWgJm.bmp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\8DAs79 _K.doc desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\8DAs79 _K.doc.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CnWmKSFK768cf2Qzf.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CnWmKSFK768cf2Qzf.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CZiQMWk.avi desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\CZiQMWk.avi.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\dIzOux_V.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\dIzOux_V.png.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\EB G6qCWqieCGCoHg.ppt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\EB G6qCWqieCGCoHg.ppt.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ED8z5hvaRbfKFmQSj.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ED8z5hvaRbfKFmQSj.mp3.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\EHha1E7xs59mBr.avi desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\EHha1E7xs59mBr.avi.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\enSgx.swf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\enSgx.swf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\FtOvEI.csv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\FtOvEI.csv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Gz3fVmm7.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Gz3fVmm7.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\h_hQxIcKkK0ptnyAnpx.odp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\h_hQxIcKkK0ptnyAnpx.odp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\IoxULA_CkfpP.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\IoxULA_CkfpP.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\kSP1cnB2hxU7y.rtf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\kSP1cnB2hxU7y.rtf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Ll-GR eAmm.mp4 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Ll-GR eAmm.mp4.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\MhC1R.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\MhC1R.jpg.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\qwV3dIWBMjgPTO.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\qwV3dIWBMjgPTO.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\rTh9rihBLxNHPHI.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\rTh9rihBLxNHPHI.bmp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\TKL9477z_W6f.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\TKL9477z_W6f.png.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Tydyi381sT.pps desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\Tydyi381sT.pps.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ujVrUJfY.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ujVrUJfY.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ux9WveoSYImE35ldZ SV.xls desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ux9WveoSYImE35ldZ SV.xls.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\WjCsoy9NSK3WEc-jHGV.swf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\WjCsoy9NSK3WEc-jHGV.swf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\YI3AzfSP2ixzlug.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\YI3AzfSP2ixzlug.xlsx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\0KKG5-_dyLtLLib.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\0KKG5-_dyLtLLib.png.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\3OIfE3JyXSDyFI.odt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\3OIfE3JyXSDyFI.odt.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\a0be8GHMAJr.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\a0be8GHMAJr.bmp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\EG0aXcwV-hr.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\EG0aXcwV-hr.gif.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\jcIT590X8g5jj.mkv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\jcIT590X8g5jj.mkv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\kTmaVKlwQCa2r.swf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\kTmaVKlwQCa2r.swf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\LDq5roCjgTApRvRJvB.pps desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\LDq5roCjgTApRvRJvB.pps.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\S3OcoaMO.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\S3OcoaMO.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\tLmYU7SeZ.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\tLmYU7SeZ.mp3.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\yLa77.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\yLa77.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\w4xbjxkK.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\w4xbjxkK.mp3.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\4xViYgP AP.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\4xViYgP AP.mp3.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\BlGhpVFW.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\BlGhpVFW.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\fYRG.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\fYRG.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\G5IptOuLk0Yb.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\G5IptOuLk0Yb.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\ggVeB8Y.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\ggVeB8Y.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\Gx9alYUWzq.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\Gx9alYUWzq.mp3.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\gzRkU9mQLTHPoK.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\gzRkU9mQLTHPoK.mp3.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\k_T 8.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\k_T 8.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\oOsJ.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\oOsJ.mp3.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\QOU0VF.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\QOU0VF.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\1gkubuOd.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\1gkubuOd.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\niRPdsG WED6kqVJAVlt.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\niRPdsG WED6kqVJAVlt.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\JymdOLTsgEfF6EKJCZf6.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\JymdOLTsgEfF6EKJCZf6.mp3.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\tTtDXoPeBaEVZd.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\tTtDXoPeBaEVZd.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\-pP6wHj6F9fqzpkS.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\-pP6wHj6F9fqzpkS.mp3.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\dR7lwIGs0Z.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\dR7lwIGs0Z.mp3.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\iZK-yr.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\iZK-yr.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\RGDQGWbIKXeY0JuzB.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\RGDQGWbIKXeY0JuzB.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\YIWVXn.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\YIWVXn.mp3.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\8hj-wT Vmm6RSkDVjsF.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\8hj-wT Vmm6RSkDVjsF.gif.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\8IwuY0yq7.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\8IwuY0yq7.jpg.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rfSBEsMiOiNX8geU.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\rfSBEsMiOiNX8geU.bmp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\V2XpokArQEslR4XPpUN.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\V2XpokArQEslR4XPpUN.jpg.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\5KVbuoX6C7I.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\5KVbuoX6C7I.gif.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\a GgqEm.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\a GgqEm.gif.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\Cp5m9ui.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\Cp5m9ui.png.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\EfciVDOoFpXajDNdowI.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\EfciVDOoFpXajDNdowI.png.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\JYt B5eu2DQSpvUXEbj.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\JYt B5eu2DQSpvUXEbj.jpg.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\V9ilU.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\V9ilU.bmp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\x8sFphIUh2ONQFW.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\x8sFphIUh2ONQFW.png.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\1GK2iwe7p.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\1GK2iwe7p.jpg.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\fETx.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\fETx.bmp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\lesA3Ej.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\lesA3Ej.jpg.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\PmRRRaM0.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\PmRRRaM0.jpg.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\vS5aAlhJ.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\vS5aAlhJ.png.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\xr d6XROhOsECFoi.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\xr d6XROhOsECFoi.gif.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\7EZ4GtS3eucc.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\7EZ4GtS3eucc.gif.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\FWIZqvAtIpB.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\FWIZqvAtIpB.bmp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\v9-w8Y.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\v9-w8Y.gif.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\0Elckohhrs6BzmQizNDC.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\0Elckohhrs6BzmQizNDC.gif.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\jj7t4P-k.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\jj7t4P-k.gif.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\-eDPrTR\-pO iFu69ZDsH.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\-eDPrTR\-pO iFu69ZDsH.png.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\1R-gVDqQyZ-z0tidUvhb.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\1R-gVDqQyZ-z0tidUvhb.bmp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\2zm67v1dYDdfQe.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\2zm67v1dYDdfQe.png.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\fV9gs2uPtrSIMKeAHGmD.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\fV9gs2uPtrSIMKeAHGmD.jpg.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\KDaf1EJeF5D5 RP5J.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\KDaf1EJeF5D5 RP5J.png.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\ppuAT.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\ppuAT.jpg.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\rkgbPk.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\rkgbPk.gif.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\g_IdIecJjIpqXVu1uaF.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\g_IdIecJjIpqXVu1uaF.gif.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\38CkYWeudH.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\38CkYWeudH.gif.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\kqXVmhFl.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\kqXVmhFl.bmp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\o gHeJ.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\o gHeJ.jpg.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\gXUk6zGjZyC.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\gXUk6zGjZyC.jpg.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\K0Oi0qu6JV.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\K0Oi0qu6JV.jpg.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\nXFYUX1LdFo.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\nXFYUX1LdFo.gif.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\AAah3NdNBaxj.mp4 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\AAah3NdNBaxj.mp4.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\i70c4 jL.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\i70c4 jL.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\T0bhNVzVYc.mp4 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\T0bhNVzVYc.mp4.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\TetGFUxS.mp4 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\TetGFUxS.mp4.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\x6R9Ff0rW.swf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\x6R9Ff0rW.swf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\ZsnT4CE2i.swf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\ZsnT4CE2i.swf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\_Q-erkcMEj49z d2se8u.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\_Q-erkcMEj49z d2se8u.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\-9k1Pp.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\-9k1Pp.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\4tHxHXTTn_.swf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\4tHxHXTTn_.swf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\atxemqhw.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\atxemqhw.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\aVDOWsEaj8PL.mp4 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\aVDOWsEaj8PL.mp4.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\Dyrf.swf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\Dyrf.swf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\g8J7qL XZbbi3Xz7Ub.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\g8J7qL XZbbi3Xz7Ub.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\iA9Xe-aPj5db.avi desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\iA9Xe-aPj5db.avi.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\JJdT3P6bu5i.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\JJdT3P6bu5i.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\ldIDPJKczA_q8p.mkv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\ldIDPJKczA_q8p.mkv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\o19yd3KxSY3.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\o19yd3KxSY3.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\4_rAxaFg1.swf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\4_rAxaFg1.swf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\A5Ar0nVRt__m.mp4 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\A5Ar0nVRt__m.mp4.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\aCMrQM_63.mkv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\aCMrQM_63.mkv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\caJUViiH8J-NNmdDGq.mkv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\caJUViiH8J-NNmdDGq.mkv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\F8gFrq6IWg-T.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\F8gFrq6IWg-T.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\IUW6-rLdvTO6DR2.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\IUW6-rLdvTO6DR2.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\KNPt4Gm.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\KNPt4Gm.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\TctoFGOt_9l.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\TctoFGOt_9l.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\v zXqlE7_5RW0Ol.swf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\v zXqlE7_5RW0Ol.swf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\z_9nlp1Ozu.swf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\z_9nlp1Ozu.swf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\02cYYkEK8IzC.swf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\02cYYkEK8IzC.swf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\1_Mbsa5OD.avi desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\1_Mbsa5OD.avi.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\GsWbzkiCj91tplEo.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\GsWbzkiCj91tplEo.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\LyFh.swf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\LyFh.swf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\nocuTy_hMJBgr8.swf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\nocuTy_hMJBgr8.swf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\TwziikiGxp.mp4 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\TwziikiGxp.mp4.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\ZcHrAt.mp4 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\ZcHrAt.mp4.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\1PVXIHxYSn.pptx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\1PVXIHxYSn.pptx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\2ZJo.odp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\2ZJo.odp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\6iEtKnvzXA3NILr.odp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\6iEtKnvzXA3NILr.odp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\alf9WvNZZhe.pptx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\alf9WvNZZhe.pptx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\ASTYhT3_-KErSuEO.pptx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\ASTYhT3_-KErSuEO.pptx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\AXWzIZ XtfZeI7.pptx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\AXWzIZ XtfZeI7.pptx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\GBG4znVzrwk7dXMug.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\GBG4znVzrwk7dXMug.docx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\GYGdW1MQkx5vJ.pptx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\GYGdW1MQkx5vJ.pptx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\HRQl3qsS4DH.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\HRQl3qsS4DH.xlsx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\iUFFUwpA1J.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\iUFFUwpA1J.xlsx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\jBLr-FEHfL8MBj 678p.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\jBLr-FEHfL8MBj 678p.docx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\JFqgi.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\JFqgi.xlsx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\jmKrommVXMPs.pptx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\jmKrommVXMPs.pptx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\OWCI8VPPCALiOrXC.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\OWCI8VPPCALiOrXC.docx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\P0D0-WsgkffXuDW.rtf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\P0D0-WsgkffXuDW.rtf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\qErym4KglNw.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\qErym4KglNw.docx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\RGMA2.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\RGMA2.docx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\RS-xsaOLj5rgX61.pdf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\RS-xsaOLj5rgX61.pdf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\sLaf8w7OVg.doc desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\sLaf8w7OVg.doc.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\TelL5MpYPjO.rtf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\TelL5MpYPjO.rtf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\tLAmXjU3.odt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\tLAmXjU3.odt.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\wENJH2J2udWqojBqky.odt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\wENJH2J2udWqojBqky.odt.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WhR2YGHKw6JqJ4o1.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\WhR2YGHKw6JqJ4o1.xlsx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\wsXh9kZhV.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\wsXh9kZhV.xlsx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Yb_bG3OgzzBcVHOss.pps desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Yb_bG3OgzzBcVHOss.pps.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Zae0.doc desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\Zae0.doc.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\zEWzYJBfZKH68.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\zEWzYJBfZKH68.xlsx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\Fo8-.xls desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\Fo8-.xls.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\frNMq.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\frNMq.docx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\RkDQuv59W tYRw4EPy.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\RkDQuv59W tYRw4EPy.xlsx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\X9FPcVHoENtd.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\X9FPcVHoENtd.docx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\y F6C5d6r41imKRrNTOD.pptx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\y F6C5d6r41imKRrNTOD.pptx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\1BbnSx.csv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\1BbnSx.csv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\arSGYMgWT HKZJ1G.doc desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\arSGYMgWT HKZJ1G.doc.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\HiEmRFvSq.xls desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\HiEmRFvSq.xls.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\musy.doc desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\musy.doc.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\OBFGJ0bztapq0816UG9F.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\OBFGJ0bztapq0816UG9F.xlsx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\oC6ovdu3E4B.rtf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\oC6ovdu3E4B.rtf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\PV8 ISy6wTR2.doc desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\PV8 ISy6wTR2.doc.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\vOUWp70l.docx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\vOUWp70l.docx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\folder.ico desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\folder.ico.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\-v8NyVF6Hq8N 4.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\-v8NyVF6Hq8N 4.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\17eykEheY.rtf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\17eykEheY.rtf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3haeIb.doc desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3haeIb.doc.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3smmnKCEcJDj6_ RTfaY.mp4 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3smmnKCEcJDj6_ RTfaY.mp4.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\5J MtzDz55CsqSu.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\5J MtzDz55CsqSu.mp3.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\6g6Tu-mG89sgywJ-Y.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\6g6Tu-mG89sgywJ-Y.jpg.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\7XuUFJRJ.swf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\7XuUFJRJ.swf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\8Hs0N-sb7ZG.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\8Hs0N-sb7ZG.bmp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\9c7whM0Y2A.swf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\9c7whM0Y2A.swf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\9dx1aYv7.mkv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\9dx1aYv7.mkv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Auh9h1.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Auh9h1.mp3.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\cQQm2Dw6.ppt desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\cQQm2Dw6.ppt.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\dNli6PfdKcu.pps desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\dNli6PfdKcu.pps.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\EPaG YyKvHjNiubBMW.gif desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\EPaG YyKvHjNiubBMW.gif.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\fNQMm1datx 9EskaR6.swf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\fNQMm1datx 9EskaR6.swf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\HVzjHTIsAHo0uBqX3uQ.rtf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\HVzjHTIsAHo0uBqX3uQ.rtf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\IosxXJYbUxIWxskr7.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\IosxXJYbUxIWxskr7.png.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\IrJUSoID3NrK4M4p.xlsx desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\IrJUSoID3NrK4M4p.xlsx.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\jBwwXiPpsFe.rtf desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\jBwwXiPpsFe.rtf.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\MyZQ-8-oWHz4CqldC.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\MyZQ-8-oWHz4CqldC.mp3.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\O9y_A.avi desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\O9y_A.avi.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RZqQo4EQ.mp4 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RZqQo4EQ.mp4.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\r_EWMUxqWb.flv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\r_EWMUxqWb.flv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\tvK 9LMrcP7mW.avi desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\tvK 9LMrcP7mW.avi.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\U02OZDEeDuoch K8x.avi desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\U02OZDEeDuoch K8x.avi.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\upLOI.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\upLOI.jpg.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\v BbMvYkEg_.mp3 desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\v BbMvYkEg_.mp3.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\v8okskjg.mkv desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\v8okskjg.mkv.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\vhqP-0CDpL.odp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\vhqP-0CDpL.odp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\VhZFr1blgTrXMot_-KSH.avi desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\VhZFr1blgTrXMot_-KSH.avi.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\WXDiq5.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\WXDiq5.bmp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\X6uS7E.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\X6uS7E.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\xQrUrmMl6.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\xQrUrmMl6.bmp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\xy2HcWdpce0vnT X6.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\xy2HcWdpce0vnT X6.jpg.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\YiN4EYoyu.bmp desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\YiN4EYoyu.bmp.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\yLqDCyMJNAeWmoQu9D.m4a desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\yLqDCyMJNAeWmoQu9D.m4a.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\_fS117FO.jpg desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\_fS117FO.jpg.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\AccessCache.accdb desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\AccessCache.accdb.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\9D76938C-943D-439F-A135-26D02821EE05\en-us.16\stream.x64.en-us.man.dat.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\9D76938C-943D-439F-A135-26D02821EE05\x-none.16\stream.x64.x-none.man.dat.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\ProductReleases\EDA58A0B-AD79-496A-8530-618D08767E60\en-us.16\stream.Platform.Culture.man.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\ProductReleases\EDA58A0B-AD79-496A-8530-618D08767E60\en-us.16\stream.x64.en-us.man.dat.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\ProductReleases\EDA58A0B-AD79-496A-8530-618D08767E60\x-none.16\stream.Platform.x-none.man.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\ProductReleases\EDA58A0B-AD79-496A-8530-618D08767E60\x-none.16\stream.x64.x-none.man.dat.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\en-us.16\Stream.Platform.Culture.man.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\en-us.16\stream.x64.en-us.man.dat.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\x-none.16\stream.x64.x-none.man.dat.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office32ww.msi.16.x-none.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.visiomui.msi.16.en-us.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeBackgroundTaskHandlerLogon.xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeBackgroundTaskHandlerLogon.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeBackgroundTaskHandlerRegistration.xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeBackgroundTaskHandlerRegistration.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeOsfInstaller.xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeOsfInstaller.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico.ForgiveME desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\ProgramData\Microsoft\Diagnosis\parse.dat desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 1
Fn
Create C:\WinWOW32\work.bat desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\WinWOW32\icon.ico desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\WinWOW32\Payloads.dll desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create C:\WinWOW32\mbr.bin desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
Create \\.\PhysicalDrive0 desired_access = GENERIC_ALL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create C:\WinWOW32\mbr.bin desired_access = GENERIC_READ True 1
Fn
Create Directory C:\WinWOW32 - True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\-hrD ctZ_IvrK7s.gif type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\-hrD ctZ_IvrK7s.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Windows\Microsoft.NET\Framework\v4.0.30319\config\machine.config type = file_attributes True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\-hrD ctZ_IvrK7s.gif.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\3nApnpXou.rtf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\3nApnpXou.rtf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\3nApnpXou.rtf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4D-RXRdL_2N.mp3 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4D-RXRdL_2N.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4D-RXRdL_2N.mp3.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4tl50FkWgJm.bmp type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4tl50FkWgJm.bmp type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\4tl50FkWgJm.bmp.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\8DAs79 _K.doc type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\8DAs79 _K.doc type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\8DAs79 _K.doc.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\CnWmKSFK768cf2Qzf.m4a type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\CnWmKSFK768cf2Qzf.m4a type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\CnWmKSFK768cf2Qzf.m4a.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\CZiQMWk.avi type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\CZiQMWk.avi type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\CZiQMWk.avi.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\dIzOux_V.png type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\dIzOux_V.png type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\dIzOux_V.png.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\EB G6qCWqieCGCoHg.ppt type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\EB G6qCWqieCGCoHg.ppt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\EB G6qCWqieCGCoHg.ppt.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ED8z5hvaRbfKFmQSj.mp3 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ED8z5hvaRbfKFmQSj.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ED8z5hvaRbfKFmQSj.mp3.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\EHha1E7xs59mBr.avi type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\EHha1E7xs59mBr.avi type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\EHha1E7xs59mBr.avi.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\enSgx.swf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\enSgx.swf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\enSgx.swf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\FtOvEI.csv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\FtOvEI.csv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\FtOvEI.csv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\Gz3fVmm7.flv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\Gz3fVmm7.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\Gz3fVmm7.flv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\h_hQxIcKkK0ptnyAnpx.odp type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\h_hQxIcKkK0ptnyAnpx.odp type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\h_hQxIcKkK0ptnyAnpx.odp.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\IoxULA_CkfpP.m4a type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\IoxULA_CkfpP.m4a type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\IoxULA_CkfpP.m4a.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\kSP1cnB2hxU7y.rtf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\kSP1cnB2hxU7y.rtf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\kSP1cnB2hxU7y.rtf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\Ll-GR eAmm.mp4 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\Ll-GR eAmm.mp4 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\Ll-GR eAmm.mp4.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\MhC1R.jpg type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\MhC1R.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\MhC1R.jpg.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\qwV3dIWBMjgPTO.flv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\qwV3dIWBMjgPTO.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\qwV3dIWBMjgPTO.flv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\rTh9rihBLxNHPHI.bmp type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\rTh9rihBLxNHPHI.bmp type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\rTh9rihBLxNHPHI.bmp.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\TKL9477z_W6f.png type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\TKL9477z_W6f.png type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\TKL9477z_W6f.png.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\Tydyi381sT.pps type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\Tydyi381sT.pps type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\Tydyi381sT.pps.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ujVrUJfY.flv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ujVrUJfY.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ujVrUJfY.flv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ux9WveoSYImE35ldZ SV.xls type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ux9WveoSYImE35ldZ SV.xls type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ux9WveoSYImE35ldZ SV.xls.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\WjCsoy9NSK3WEc-jHGV.swf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\WjCsoy9NSK3WEc-jHGV.swf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\WjCsoy9NSK3WEc-jHGV.swf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\YI3AzfSP2ixzlug.xlsx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\YI3AzfSP2ixzlug.xlsx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\YI3AzfSP2ixzlug.xlsx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\0KKG5-_dyLtLLib.png type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\0KKG5-_dyLtLLib.png type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\0KKG5-_dyLtLLib.png.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\3OIfE3JyXSDyFI.odt type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\3OIfE3JyXSDyFI.odt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\3OIfE3JyXSDyFI.odt.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\a0be8GHMAJr.bmp type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\a0be8GHMAJr.bmp type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\a0be8GHMAJr.bmp.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\EG0aXcwV-hr.gif type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\EG0aXcwV-hr.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\EG0aXcwV-hr.gif.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\jcIT590X8g5jj.mkv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\jcIT590X8g5jj.mkv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\jcIT590X8g5jj.mkv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\kTmaVKlwQCa2r.swf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\kTmaVKlwQCa2r.swf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\kTmaVKlwQCa2r.swf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\LDq5roCjgTApRvRJvB.pps type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\LDq5roCjgTApRvRJvB.pps type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\LDq5roCjgTApRvRJvB.pps.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\S3OcoaMO.m4a type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\S3OcoaMO.m4a type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\S3OcoaMO.m4a.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\tLmYU7SeZ.mp3 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\tLmYU7SeZ.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\tLmYU7SeZ.mp3.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\yLa77.m4a type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\yLa77.m4a type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\yLa77.m4a.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\w4xbjxkK.mp3 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\w4xbjxkK.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\w4xbjxkK.mp3.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\4xViYgP AP.mp3 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\4xViYgP AP.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\4xViYgP AP.mp3.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\BlGhpVFW.m4a type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\BlGhpVFW.m4a type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\BlGhpVFW.m4a.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\fYRG.m4a type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\fYRG.m4a type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\fYRG.m4a.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\G5IptOuLk0Yb.m4a type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\G5IptOuLk0Yb.m4a type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\G5IptOuLk0Yb.m4a.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\ggVeB8Y.m4a type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\ggVeB8Y.m4a type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\ggVeB8Y.m4a.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\Gx9alYUWzq.mp3 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\Gx9alYUWzq.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\Gx9alYUWzq.mp3.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\gzRkU9mQLTHPoK.mp3 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\gzRkU9mQLTHPoK.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\gzRkU9mQLTHPoK.mp3.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\k_T 8.m4a type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\k_T 8.m4a type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\k_T 8.m4a.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\oOsJ.mp3 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\oOsJ.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\oOsJ.mp3.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\QOU0VF.m4a type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\QOU0VF.m4a type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\QOU0VF.m4a.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\1gkubuOd.m4a type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\1gkubuOd.m4a type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\1gkubuOd.m4a.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\niRPdsG WED6kqVJAVlt.m4a type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\niRPdsG WED6kqVJAVlt.m4a type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\niRPdsG WED6kqVJAVlt.m4a.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\JymdOLTsgEfF6EKJCZf6.mp3 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\JymdOLTsgEfF6EKJCZf6.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\JymdOLTsgEfF6EKJCZf6.mp3.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\tTtDXoPeBaEVZd.m4a type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\tTtDXoPeBaEVZd.m4a type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\tTtDXoPeBaEVZd.m4a.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\-pP6wHj6F9fqzpkS.mp3 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\-pP6wHj6F9fqzpkS.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\-pP6wHj6F9fqzpkS.mp3.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\dR7lwIGs0Z.mp3 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\dR7lwIGs0Z.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\dR7lwIGs0Z.mp3.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\iZK-yr.m4a type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\iZK-yr.m4a type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\iZK-yr.m4a.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\RGDQGWbIKXeY0JuzB.m4a type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\RGDQGWbIKXeY0JuzB.m4a type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\RGDQGWbIKXeY0JuzB.m4a.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\YIWVXn.mp3 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\YIWVXn.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\YIWVXn.mp3.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\8hj-wT Vmm6RSkDVjsF.gif type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\8hj-wT Vmm6RSkDVjsF.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\8hj-wT Vmm6RSkDVjsF.gif.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\8IwuY0yq7.jpg type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\8IwuY0yq7.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\8IwuY0yq7.jpg.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\rfSBEsMiOiNX8geU.bmp type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\rfSBEsMiOiNX8geU.bmp type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\rfSBEsMiOiNX8geU.bmp.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\V2XpokArQEslR4XPpUN.jpg type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\V2XpokArQEslR4XPpUN.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\V2XpokArQEslR4XPpUN.jpg.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\5KVbuoX6C7I.gif type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\5KVbuoX6C7I.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\5KVbuoX6C7I.gif.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\a GgqEm.gif type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\a GgqEm.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\a GgqEm.gif.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\Cp5m9ui.png type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\Cp5m9ui.png type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\Cp5m9ui.png.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\EfciVDOoFpXajDNdowI.png type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\EfciVDOoFpXajDNdowI.png type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\EfciVDOoFpXajDNdowI.png.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\JYt B5eu2DQSpvUXEbj.jpg type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\JYt B5eu2DQSpvUXEbj.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\JYt B5eu2DQSpvUXEbj.jpg.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\V9ilU.bmp type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\V9ilU.bmp type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\V9ilU.bmp.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\x8sFphIUh2ONQFW.png type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\x8sFphIUh2ONQFW.png type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\x8sFphIUh2ONQFW.png.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\1GK2iwe7p.jpg type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\1GK2iwe7p.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\1GK2iwe7p.jpg.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\fETx.bmp type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\fETx.bmp type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\fETx.bmp.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\lesA3Ej.jpg type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\lesA3Ej.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\lesA3Ej.jpg.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\PmRRRaM0.jpg type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\PmRRRaM0.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\PmRRRaM0.jpg.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\vS5aAlhJ.png type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\vS5aAlhJ.png type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\vS5aAlhJ.png.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\xr d6XROhOsECFoi.gif type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\xr d6XROhOsECFoi.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\xr d6XROhOsECFoi.gif.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\7EZ4GtS3eucc.gif type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\7EZ4GtS3eucc.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\7EZ4GtS3eucc.gif.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\FWIZqvAtIpB.bmp type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\FWIZqvAtIpB.bmp type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\FWIZqvAtIpB.bmp.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\v9-w8Y.gif type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\v9-w8Y.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\v9-w8Y.gif.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\0Elckohhrs6BzmQizNDC.gif type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\0Elckohhrs6BzmQizNDC.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\0Elckohhrs6BzmQizNDC.gif.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\jj7t4P-k.gif type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\jj7t4P-k.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\jj7t4P-k.gif.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\-eDPrTR\-pO iFu69ZDsH.png type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\-eDPrTR\-pO iFu69ZDsH.png type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\-eDPrTR\-pO iFu69ZDsH.png.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\1R-gVDqQyZ-z0tidUvhb.bmp type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\1R-gVDqQyZ-z0tidUvhb.bmp type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\1R-gVDqQyZ-z0tidUvhb.bmp.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\2zm67v1dYDdfQe.png type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\2zm67v1dYDdfQe.png type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\2zm67v1dYDdfQe.png.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\fV9gs2uPtrSIMKeAHGmD.jpg type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\fV9gs2uPtrSIMKeAHGmD.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\fV9gs2uPtrSIMKeAHGmD.jpg.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\KDaf1EJeF5D5 RP5J.png type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\KDaf1EJeF5D5 RP5J.png type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\KDaf1EJeF5D5 RP5J.png.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\ppuAT.jpg type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\ppuAT.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\ppuAT.jpg.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\rkgbPk.gif type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\rkgbPk.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\rkgbPk.gif.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\g_IdIecJjIpqXVu1uaF.gif type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\g_IdIecJjIpqXVu1uaF.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\g_IdIecJjIpqXVu1uaF.gif.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\38CkYWeudH.gif type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\38CkYWeudH.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\38CkYWeudH.gif.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\kqXVmhFl.bmp type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\kqXVmhFl.bmp type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\kqXVmhFl.bmp.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\o gHeJ.jpg type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\o gHeJ.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\o gHeJ.jpg.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\gXUk6zGjZyC.jpg type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\gXUk6zGjZyC.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\gXUk6zGjZyC.jpg.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\K0Oi0qu6JV.jpg type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\K0Oi0qu6JV.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\K0Oi0qu6JV.jpg.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\nXFYUX1LdFo.gif type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\nXFYUX1LdFo.gif type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\nXFYUX1LdFo.gif.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\AAah3NdNBaxj.mp4 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\AAah3NdNBaxj.mp4 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\AAah3NdNBaxj.mp4.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\i70c4 jL.flv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\i70c4 jL.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\i70c4 jL.flv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\T0bhNVzVYc.mp4 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\T0bhNVzVYc.mp4 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\T0bhNVzVYc.mp4.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\TetGFUxS.mp4 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\TetGFUxS.mp4 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\TetGFUxS.mp4.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\x6R9Ff0rW.swf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\x6R9Ff0rW.swf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\x6R9Ff0rW.swf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\ZsnT4CE2i.swf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\ZsnT4CE2i.swf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\ZsnT4CE2i.swf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\_Q-erkcMEj49z d2se8u.flv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\_Q-erkcMEj49z d2se8u.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\_Q-erkcMEj49z d2se8u.flv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\-9k1Pp.flv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\-9k1Pp.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\-9k1Pp.flv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\4tHxHXTTn_.swf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\4tHxHXTTn_.swf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\4tHxHXTTn_.swf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\atxemqhw.flv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\atxemqhw.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\atxemqhw.flv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\aVDOWsEaj8PL.mp4 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\aVDOWsEaj8PL.mp4 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\aVDOWsEaj8PL.mp4.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\Dyrf.swf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\Dyrf.swf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\Dyrf.swf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\g8J7qL XZbbi3Xz7Ub.flv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\g8J7qL XZbbi3Xz7Ub.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\g8J7qL XZbbi3Xz7Ub.flv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\iA9Xe-aPj5db.avi type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\iA9Xe-aPj5db.avi type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\iA9Xe-aPj5db.avi.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\JJdT3P6bu5i.flv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\JJdT3P6bu5i.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\JJdT3P6bu5i.flv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\ldIDPJKczA_q8p.mkv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\ldIDPJKczA_q8p.mkv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\ldIDPJKczA_q8p.mkv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\o19yd3KxSY3.flv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\o19yd3KxSY3.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\o19yd3KxSY3.flv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\4_rAxaFg1.swf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\4_rAxaFg1.swf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\4_rAxaFg1.swf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\A5Ar0nVRt__m.mp4 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\A5Ar0nVRt__m.mp4 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\A5Ar0nVRt__m.mp4.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\aCMrQM_63.mkv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\aCMrQM_63.mkv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\aCMrQM_63.mkv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\caJUViiH8J-NNmdDGq.mkv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\caJUViiH8J-NNmdDGq.mkv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\caJUViiH8J-NNmdDGq.mkv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\F8gFrq6IWg-T.flv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\F8gFrq6IWg-T.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\F8gFrq6IWg-T.flv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\IUW6-rLdvTO6DR2.flv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\IUW6-rLdvTO6DR2.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\IUW6-rLdvTO6DR2.flv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\KNPt4Gm.flv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\KNPt4Gm.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\KNPt4Gm.flv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\TctoFGOt_9l.flv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\TctoFGOt_9l.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\TctoFGOt_9l.flv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\v zXqlE7_5RW0Ol.swf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\v zXqlE7_5RW0Ol.swf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\v zXqlE7_5RW0Ol.swf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\z_9nlp1Ozu.swf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\z_9nlp1Ozu.swf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\z_9nlp1Ozu.swf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\02cYYkEK8IzC.swf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\02cYYkEK8IzC.swf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\02cYYkEK8IzC.swf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\1_Mbsa5OD.avi type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\1_Mbsa5OD.avi type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\1_Mbsa5OD.avi.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\GsWbzkiCj91tplEo.flv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\GsWbzkiCj91tplEo.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\GsWbzkiCj91tplEo.flv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\LyFh.swf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\LyFh.swf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\LyFh.swf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\nocuTy_hMJBgr8.swf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\nocuTy_hMJBgr8.swf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\nocuTy_hMJBgr8.swf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\TwziikiGxp.mp4 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\TwziikiGxp.mp4 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\TwziikiGxp.mp4.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\ZcHrAt.mp4 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\ZcHrAt.mp4 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\ZcHrAt.mp4.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\1PVXIHxYSn.pptx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\1PVXIHxYSn.pptx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\1PVXIHxYSn.pptx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\2ZJo.odp type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\2ZJo.odp type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\2ZJo.odp.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\6iEtKnvzXA3NILr.odp type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\6iEtKnvzXA3NILr.odp type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\6iEtKnvzXA3NILr.odp.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\alf9WvNZZhe.pptx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\alf9WvNZZhe.pptx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\alf9WvNZZhe.pptx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\ASTYhT3_-KErSuEO.pptx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\ASTYhT3_-KErSuEO.pptx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\ASTYhT3_-KErSuEO.pptx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\AXWzIZ XtfZeI7.pptx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\AXWzIZ XtfZeI7.pptx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\AXWzIZ XtfZeI7.pptx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\GBG4znVzrwk7dXMug.docx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\GBG4znVzrwk7dXMug.docx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\GBG4znVzrwk7dXMug.docx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\GYGdW1MQkx5vJ.pptx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\GYGdW1MQkx5vJ.pptx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\GYGdW1MQkx5vJ.pptx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\HRQl3qsS4DH.xlsx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\HRQl3qsS4DH.xlsx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\HRQl3qsS4DH.xlsx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\iUFFUwpA1J.xlsx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\iUFFUwpA1J.xlsx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\iUFFUwpA1J.xlsx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\jBLr-FEHfL8MBj 678p.docx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\jBLr-FEHfL8MBj 678p.docx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\jBLr-FEHfL8MBj 678p.docx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\JFqgi.xlsx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\JFqgi.xlsx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\JFqgi.xlsx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\jmKrommVXMPs.pptx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\jmKrommVXMPs.pptx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\jmKrommVXMPs.pptx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\OWCI8VPPCALiOrXC.docx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\OWCI8VPPCALiOrXC.docx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\OWCI8VPPCALiOrXC.docx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\P0D0-WsgkffXuDW.rtf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\P0D0-WsgkffXuDW.rtf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\P0D0-WsgkffXuDW.rtf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\qErym4KglNw.docx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\qErym4KglNw.docx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\qErym4KglNw.docx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\RGMA2.docx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\RGMA2.docx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\RGMA2.docx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\RS-xsaOLj5rgX61.pdf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\RS-xsaOLj5rgX61.pdf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\RS-xsaOLj5rgX61.pdf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\sLaf8w7OVg.doc type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\sLaf8w7OVg.doc type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\sLaf8w7OVg.doc.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\TelL5MpYPjO.rtf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\TelL5MpYPjO.rtf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\TelL5MpYPjO.rtf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\tLAmXjU3.odt type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\tLAmXjU3.odt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\tLAmXjU3.odt.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\wENJH2J2udWqojBqky.odt type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\wENJH2J2udWqojBqky.odt type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\wENJH2J2udWqojBqky.odt.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\WhR2YGHKw6JqJ4o1.xlsx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\WhR2YGHKw6JqJ4o1.xlsx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\WhR2YGHKw6JqJ4o1.xlsx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\wsXh9kZhV.xlsx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\wsXh9kZhV.xlsx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\wsXh9kZhV.xlsx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\Yb_bG3OgzzBcVHOss.pps type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\Yb_bG3OgzzBcVHOss.pps type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\Yb_bG3OgzzBcVHOss.pps.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\Zae0.doc type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\Zae0.doc type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\Zae0.doc.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\zEWzYJBfZKH68.xlsx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\zEWzYJBfZKH68.xlsx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\zEWzYJBfZKH68.xlsx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\Fo8-.xls type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\Fo8-.xls type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\Fo8-.xls.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\frNMq.docx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\frNMq.docx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\frNMq.docx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\RkDQuv59W tYRw4EPy.xlsx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\RkDQuv59W tYRw4EPy.xlsx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\RkDQuv59W tYRw4EPy.xlsx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\X9FPcVHoENtd.docx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\X9FPcVHoENtd.docx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\X9FPcVHoENtd.docx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\y F6C5d6r41imKRrNTOD.pptx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\y F6C5d6r41imKRrNTOD.pptx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\y F6C5d6r41imKRrNTOD.pptx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\1BbnSx.csv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\1BbnSx.csv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\1BbnSx.csv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\arSGYMgWT HKZJ1G.doc type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\arSGYMgWT HKZJ1G.doc type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\arSGYMgWT HKZJ1G.doc.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\HiEmRFvSq.xls type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\HiEmRFvSq.xls type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\HiEmRFvSq.xls.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\musy.doc type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\musy.doc type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\musy.doc.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\OBFGJ0bztapq0816UG9F.xlsx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\OBFGJ0bztapq0816UG9F.xlsx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\OBFGJ0bztapq0816UG9F.xlsx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\oC6ovdu3E4B.rtf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\oC6ovdu3E4B.rtf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\oC6ovdu3E4B.rtf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\PV8 ISy6wTR2.doc type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\PV8 ISy6wTR2.doc type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\PV8 ISy6wTR2.doc.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\vOUWp70l.docx type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\vOUWp70l.docx type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\fhaya\valz3-3cOWwPU0u8La\vOUWp70l.docx.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\folder.ico type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\folder.ico type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\folder.ico.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\-v8NyVF6Hq8N 4.flv type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\-v8NyVF6Hq8N 4.flv type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\-v8NyVF6Hq8N 4.flv.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\17eykEheY.rtf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\17eykEheY.rtf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\17eykEheY.rtf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3haeIb.doc type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3haeIb.doc type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3haeIb.doc.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3smmnKCEcJDj6_ RTfaY.mp4 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3smmnKCEcJDj6_ RTfaY.mp4 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3smmnKCEcJDj6_ RTfaY.mp4.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\5J MtzDz55CsqSu.mp3 type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\5J MtzDz55CsqSu.mp3 type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\5J MtzDz55CsqSu.mp3.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\6g6Tu-mG89sgywJ-Y.jpg type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\6g6Tu-mG89sgywJ-Y.jpg type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\6g6Tu-mG89sgywJ-Y.jpg.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\7XuUFJRJ.swf type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\7XuUFJRJ.swf type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\7XuUFJRJ.swf.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\8Hs0N-sb7ZG.bmp type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\8Hs0N-sb7ZG.bmp type = size, size_out = 0 True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\8Hs0N-sb7ZG.bmp.ForgiveME type = file_type True 2
Fn
Get Info C:\Users\CIiHmnxMn6Ps\AppData\Roaming\9c7whM0Y2A.swf type = file_type True 2
Fn
Delete C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\G5IptOuLk0Yb.m4a - True 1
Fn
For performance reasons, the remaining 909 entries are omitted.
The remaining entries can be found in glog.xml.
Registry (81)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer - True 1
Fn
Create Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System - True 1
Fn
Create Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\MobilityCenter - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer - True 5
Fn
Open Key HKEY_CLASSES_ROOT\txtfile\DefaultIcon - True 1
Fn
Open Key HKEY_CLASSES_ROOT\exefile\DefaultIcon - True 1
Fn
Open Key HKEY_CLASSES_ROOT\VBSFile\DefaultIcon - True 1
Fn
Open Key HKEY_CLASSES_ROOT\batfile\DefaultIcon - True 1
Fn
Open Key HKEY_CLASSES_ROOT\dllfile\DefaultIcon - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon - True 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System - True 4
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\MobilityCenter - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework value_name = DbgJITDebugLaunchSetting, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework value_name = DbgManagedDebugger, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoDesktop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System value_name = DisableTaskMgr, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System value_name = DisableCMD, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoControlPanel, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = HideClock, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoLogoff, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoWindowsUpdate, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoDrives, type = REG_NONE False 1
Fn
Read Value HKEY_CLASSES_ROOT\txtfile\DefaultIcon data = 0, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CLASSES_ROOT\exefile\DefaultIcon data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_CLASSES_ROOT\VBSFile\DefaultIcon data = 0, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CLASSES_ROOT\batfile\DefaultIcon data = 0, type = REG_EXPAND_SZ True 1
Fn
Read Value HKEY_CLASSES_ROOT\dllfile\DefaultIcon data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon value_name = AutoRestartShell, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System value_name = EnableLUA, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender value_name = DisableAntiSpyware, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System value_name = ConsentPromptBehaviorAdmin, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\MobilityCenter value_name = NoMobilityCenter, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoFolderOptions, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced value_name = Hidden, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced value_name = ShowSuperHidden, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced value_name = HideFileExt, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System value_name = DisableRegistryTools, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System value_name = legalnoticecaption, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System value_name = legalnoticetext, data = 0, type = REG_SZ True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoDesktop, data = 1, size = 4, type = REG_SZ True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System value_name = DisableTaskMgr, data = 1, size = 4, type = REG_SZ True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System value_name = DisableCMD, data = 1, size = 4, type = REG_SZ True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoControlPanel, data = 1, size = 4, type = REG_SZ True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = HideClock, data = 1, size = 4, type = REG_SZ True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoLogoff, data = 1, size = 4, type = REG_SZ True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoWindowsUpdate, data = 1, size = 4, type = REG_SZ True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoDrives, data = 1, size = 4, type = REG_SZ True 1
Fn
Write Value HKEY_CLASSES_ROOT\txtfile\DefaultIcon data = C:\WinWOW32\\icon.ico, size = 44, type = REG_SZ True 1
Fn
Write Value HKEY_CLASSES_ROOT\exefile\DefaultIcon data = C:\WinWOW32\\icon.ico, size = 44, type = REG_SZ True 1
Fn
Write Value HKEY_CLASSES_ROOT\VBSFile\DefaultIcon data = C:\WinWOW32\\icon.ico, size = 44, type = REG_SZ True 1
Fn
Write Value HKEY_CLASSES_ROOT\batfile\DefaultIcon data = C:\WinWOW32\\icon.ico, size = 44, type = REG_SZ True 1
Fn
Write Value HKEY_CLASSES_ROOT\dllfile\DefaultIcon data = C:\WinWOW32\\icon.ico, size = 44, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon value_name = AutoRestartShell, data = 0, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System value_name = EnableLUA, data = 0, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender value_name = DisableAntiSpyware, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System value_name = ConsentPromptBehaviorAdmin, data = 0, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\MobilityCenter value_name = NoMobilityCenter, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer value_name = NoFolderOptions, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced value_name = Hidden, data = 2, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced value_name = ShowSuperHidden, data = 0, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced value_name = HideFileExt, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System value_name = DisableRegistryTools, data = 1, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System value_name = legalnoticecaption, data = LIGMA, size = 12, type = REG_SZ True 1
Fn
Write Value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System value_name = legalnoticetext, data = Your Computer Got FUCKED By LIGMA!, size = 70, type = REG_SZ True 1
Fn
Process (1)
»
Operation Process Additional Information Success Count Logfile
Create "C:\WinWOW32\\work.bat" os_pid = 0xdf4, creation_flags = CREATE_NO_WINDOW, show_window = SW_HIDE True 1
Fn
Module (15)
»
Operation Module Additional Information Success Count Logfile
Load shell32.dll base_address = 0x752c0000 True 1
Fn
Load comctl32.dll base_address = 0x73370000 True 1
Fn
Get Handle shell32.dll base_address = 0x0 False 1
Fn
Get Handle c:\windows\syswow64\shell32.dll base_address = 0x752c0000 True 1
Fn
Get Handle comctl32.dll base_address = 0x0 False 1
Fn
Get Handle c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\comctl32.dll base_address = 0x73410000 True 1
Fn
Get Handle c:\windows\syswow64\user32.dll base_address = 0x74ad0000 True 1
Fn
Get Handle c:\users\ciihmnxmn6ps\desktop\ligma.exe base_address = 0xf00000 True 2
Fn
Get Handle c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_49c02355cf03478c\comctl32.dll base_address = 0x73370000 True 5
Fn
Get Address c:\windows\syswow64\user32.dll function = DefWindowProcW, address_out = 0x77a0caa0 True 1
Fn
User (1)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
Window (5)
»
Operation Window Name Additional Information Success Count Logfile
Create - - True 1
Fn
Create - - True 1
Fn
Create - class_name = WindowsForms10.Window.8.app.0.141b42a_r12_ad1, wndproc_parameter = 0 True 1
Fn
Set Attribute - class_name = WindowsForms10.Window.8.app.0.141b42a_r12_ad1, index = 18446744073709551612, new_long = 2007026336 True 1
Fn
Set Attribute - class_name = WindowsForms10.Window.8.app.0.141b42a_r12_ad1, index = 18446744073709551612, new_long = 88671902 True 1
Fn
System (5152)
»
Operation Additional Information Success Count Logfile
Get Cursor x_out = 535, y_out = 873 True 1
Fn
Get Cursor x_out = 830, y_out = 558 True 7
Fn
Get Cursor x_out = 169, y_out = 746 True 11
Fn
Sleep duration = 1 milliseconds (0.001 seconds) True 1
Fn
Sleep duration = 45000 milliseconds (45.000 seconds) True 1
Fn
Sleep duration = 15000 milliseconds (15.000 seconds) True 1
Fn
Sleep duration = 1000 milliseconds (1.000 seconds) True 11
Fn
Sleep duration = 15000 milliseconds (15.000 seconds) True 1
Fn
Sleep duration = 500 milliseconds (0.500 seconds) True 8
Fn
Get Info type = SYSTEM_PROCESS_INFORMATION True 5110
Fn
Process #2: cmd.exe
177 0
»
Information Value
ID #2
File Name c:\windows\syswow64\cmd.exe
Command Line C:\Windows\system32\cmd.exe /c ""C:\WinWOW32\\work.bat""
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:01:59, Reason: Child Process
Unmonitor End Time: 00:02:25, Reason: Self Terminated
Monitor Duration 00:00:26
OS Process Information
»
Information Value
PID 0xdf4
Parent PID 0x950 (c:\users\ciihmnxmn6ps\desktop\ligma.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x DFC
0x EB0
0x CD4
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x00000000009b0000 0x009b0000 0x009cffff Private Memory rw True False False -
pagefile_0x00000000009b0000 0x009b0000 0x009bffff Pagefile Backed Memory rw True False False -
private_0x00000000009c0000 0x009c0000 0x009c3fff Private Memory rw True False False -
private_0x00000000009d0000 0x009d0000 0x009d1fff Private Memory rw True False False -
private_0x00000000009d0000 0x009d0000 0x009d3fff Private Memory rw True False False -
pagefile_0x00000000009e0000 0x009e0000 0x009f3fff Pagefile Backed Memory r True False False -
private_0x0000000000a00000 0x00a00000 0x00a3ffff Private Memory rw True False False -
private_0x0000000000a40000 0x00a40000 0x00b3ffff Private Memory rw True False False -
pagefile_0x0000000000b40000 0x00b40000 0x00b43fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000b50000 0x00b50000 0x00b50fff Pagefile Backed Memory r True False False -
private_0x0000000000b60000 0x00b60000 0x00b61fff Private Memory rw True False False -
private_0x0000000000b70000 0x00b70000 0x00b7ffff Private Memory rw True False False -
private_0x0000000000ba0000 0x00ba0000 0x00baffff Private Memory rw True False False -
locale.nls 0x00bb0000 0x00c6dfff Memory Mapped File r False False False -
private_0x0000000000c70000 0x00c70000 0x00caffff Private Memory rw True False False -
private_0x0000000000d60000 0x00d60000 0x00e5ffff Private Memory rw True False False -
cmd.exe 0x00e70000 0x00ebffff Memory Mapped File rwx True False False -
pagefile_0x0000000000ec0000 0x00ec0000 0x04ebffff Pagefile Backed Memory - True False False -
private_0x0000000004ec0000 0x04ec0000 0x04fbffff Private Memory rw True False False -
private_0x0000000005070000 0x05070000 0x0507ffff Private Memory rw True False False -
sortdefault.nls 0x05080000 0x053b6fff Memory Mapped File r False False False -
wow64cpu.dll 0x73030000 0x73037fff Memory Mapped File rwx False False False -
wow64.dll 0x73040000 0x7308efff Memory Mapped File rwx False False False -
wow64win.dll 0x73090000 0x73102fff Memory Mapped File rwx False False False -
cmdext.dll 0x73150000 0x73157fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74a30000 0x74a88fff Memory Mapped File rwx False False False -
cryptbase.dll 0x74a90000 0x74a99fff Memory Mapped File rwx False False False -
sspicli.dll 0x74aa0000 0x74abdfff Memory Mapped File rwx False False False -
advapi32.dll 0x74c60000 0x74cdafff Memory Mapped File rwx False False False -
kernelbase.dll 0x74d30000 0x74ea5fff Memory Mapped File rwx False False False -
kernel32.dll 0x75130000 0x7521ffff Memory Mapped File rwx False False False -
sechost.dll 0x770b0000 0x770f2fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772c0000 0x7736bfff Memory Mapped File rwx False False False -
msvcrt.dll 0x778d0000 0x7798dfff Memory Mapped File rwx False False False -
ntdll.dll 0x77990000 0x77b08fff Memory Mapped File rwx False False False -
pagefile_0x000000007eb50000 0x7eb50000 0x7ec4ffff Pagefile Backed Memory r True False False -
pagefile_0x000000007ec50000 0x7ec50000 0x7ec72fff Pagefile Backed Memory r True False False -
private_0x000000007ec76000 0x7ec76000 0x7ec78fff Private Memory rw True False False -
private_0x000000007ec79000 0x7ec79000 0x7ec7bfff Private Memory rw True False False -
private_0x000000007ec7c000 0x7ec7c000 0x7ec7cfff Private Memory rw True False False -
private_0x000000007ec7f000 0x7ec7f000 0x7ec7ffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfaf7a0ffff Private Memory r True False False -
pagefile_0x00007dfaf7a10000 0x7dfaf7a10000 0x7ffaf7a0ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffaf7a10000 0x7ffaf7bd1fff Memory Mapped File rwx False False False -
private_0x00007ffaf7bd2000 0x7ffaf7bd2000 0x7ffffffeffff Private Memory r True False False -
Host Behavior
File (92)
»
Operation Filename Additional Information Success Count Logfile
Create C:\WinWOW32\work.bat desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 5
Fn
Create C:\WinWOW32\work.bat desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 2
Fn
Create C:\WinWOW32\work.bat desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Get Info C:\Users\CIiHmnxMn6Ps\Desktop type = file_attributes True 2
Fn
Get Info "C:\WinWOW32\\work.bat" type = file_attributes False 1
Fn
Get Info - type = file_type True 6
Fn
Get Info - type = size True 1
Fn
Get Info cd\ type = file_attributes False 1
Fn
Get Info C:\ type = file_attributes True 2
Fn
Get Info C:\Windows\System32 type = file_attributes True 2
Fn
Get Info - type = file_type True 2
Fn
Get Info - type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 15
Fn
Open STD_INPUT_HANDLE - True 8
Fn
Open - - True 22
Fn
Open - - True 8
Fn
Open - - True 4
Fn
Read - size = 8191, size_out = 802 True 1
Fn
Data
Read - size = 8191, size_out = 791 True 1
Fn
Data
Read - size = 512, size_out = 512 True 2
Fn
Data
Read - size = 8191, size_out = 771 True 1
Fn
Data
Read - size = 8191, size_out = 746 True 1
Fn
Data
Read - size = 8191, size_out = 722 True 1
Fn
Data
Read - size = 8191, size_out = 680 True 1
Fn
Data
Read - size = 8191, size_out = 632 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 120, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (4)
»
Operation Process Additional Information Success Count Logfile
Create C:\Windows\System32\takeown.exe os_pid = 0xb04, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Windows\System32\icacls.exe os_pid = 0x554, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Windows\System32\takeown.exe os_pid = 0x8d8, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Create C:\Windows\System32\icacls.exe os_pid = 0x444, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0xe70000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x75130000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x75172780 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x7514fa80 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x7514a790 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x74e435c0 True 1
Fn
Environment (54)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 16
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 9
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 10
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Get Environment String name = username, result_out = CIiHmnxMn6Ps True 2
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Users\CIiHmnxMn6Ps\Desktop True 1
Fn
Set Environment String name = =C:, value = C:\ True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 4
Fn
Set Environment String name = =ExitCode, value = 00000001 True 1
Fn
Set Environment String name = =ExitCodeAscii True 3
Fn
Set Environment String name = =ExitCode, value = 00000002 True 1
Fn
Set Environment String name = =ExitCode, value = 40010004 True 1
Fn
Process #4: takeown.exe
0 0
»
Information Value
ID #4
File Name c:\windows\syswow64\takeown.exe
Command Line takeown /f logonui.exe
Initial Working Directory C:\Windows\System32\
Monitor Start Time: 00:02:05, Reason: Child Process
Unmonitor End Time: 00:02:07, Reason: Self Terminated
Monitor Duration 00:00:02
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xb04
Parent PID 0xdf4 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 92C
0x 388
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000210000 0x00210000 0x0022ffff Private Memory rw True False False -
pagefile_0x0000000000210000 0x00210000 0x0021ffff Pagefile Backed Memory rw True False False -
private_0x0000000000220000 0x00220000 0x00223fff Private Memory rw True False False -
private_0x0000000000230000 0x00230000 0x00231fff Private Memory rw True False False -
takeown.exe.mui 0x00230000 0x00234fff Memory Mapped File r False False False -
pagefile_0x0000000000240000 0x00240000 0x00253fff Pagefile Backed Memory r True False False -
private_0x0000000000260000 0x00260000 0x0029ffff Private Memory rw True False False -
private_0x00000000002a0000 0x002a0000 0x002dffff Private Memory rw True False False -
pagefile_0x00000000002e0000 0x002e0000 0x002e3fff Pagefile Backed Memory r True False False -
pagefile_0x00000000002f0000 0x002f0000 0x002f0fff Pagefile Backed Memory r True False False -
private_0x0000000000300000 0x00300000 0x00301fff Private Memory rw True False False -
private_0x0000000000310000 0x00310000 0x0034ffff Private Memory rw True False False -
private_0x0000000000350000 0x00350000 0x0038ffff Private Memory rw True False False -
private_0x0000000000390000 0x00390000 0x00390fff Private Memory rw True False False -
private_0x00000000003a0000 0x003a0000 0x003a0fff Private Memory rw True False False -
takeown.exe 0x003c0000 0x003cffff Memory Mapped File rwx False False False -
pagefile_0x00000000003d0000 0x003d0000 0x043cffff Pagefile Backed Memory - True False False -
locale.nls 0x043d0000 0x0448dfff Memory Mapped File r False False False -
private_0x00000000044a0000 0x044a0000 0x044affff Private Memory rw True False False -
private_0x00000000045a0000 0x045a0000 0x045affff Private Memory rw True False False -
private_0x00000000045d0000 0x045d0000 0x046cffff Private Memory rw True False False -
pagefile_0x00000000046d0000 0x046d0000 0x04857fff Pagefile Backed Memory r True False False -
pagefile_0x0000000004860000 0x04860000 0x049e0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000049f0000 0x049f0000 0x05deffff Pagefile Backed Memory r True False False -
wow64cpu.dll 0x73030000 0x73037fff Memory Mapped File rwx False False False -
wow64.dll 0x73040000 0x7308efff Memory Mapped File rwx False False False -
wow64win.dll 0x73090000 0x73102fff Memory Mapped File rwx False False False -
version.dll 0x74800000 0x74807fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74a30000 0x74a88fff Memory Mapped File rwx False False False -
cryptbase.dll 0x74a90000 0x74a99fff Memory Mapped File rwx False False False -
sspicli.dll 0x74aa0000 0x74abdfff Memory Mapped File rwx False False False -
user32.dll 0x74ad0000 0x74c0ffff Memory Mapped File rwx False False False -
shlwapi.dll 0x74c10000 0x74c53fff Memory Mapped File rwx False False False -
kernelbase.dll 0x74d30000 0x74ea5fff Memory Mapped File rwx False False False -
combase.dll 0x74f70000 0x75129fff Memory Mapped File rwx False False False -
kernel32.dll 0x75130000 0x7521ffff Memory Mapped File rwx False False False -
imm32.dll 0x75220000 0x7524afff Memory Mapped File rwx False False False -
msctf.dll 0x76da0000 0x76ebffff Memory Mapped File rwx False False False -
sechost.dll 0x770b0000 0x770f2fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772c0000 0x7736bfff Memory Mapped File rwx False False False -
gdi32.dll 0x77370000 0x774bcfff Memory Mapped File rwx False False False -
msvcrt.dll 0x778d0000 0x7798dfff Memory Mapped File rwx False False False -
ntdll.dll 0x77990000 0x77b08fff Memory Mapped File rwx False False False -
pagefile_0x000000007f0c0000 0x7f0c0000 0x7f1bffff Pagefile Backed Memory r True False False -
pagefile_0x000000007f1c0000 0x7f1c0000 0x7f1e2fff Pagefile Backed Memory r True False False -
private_0x000000007f1e4000 0x7f1e4000 0x7f1e4fff Private Memory rw True False False -
private_0x000000007f1e9000 0x7f1e9000 0x7f1ebfff Private Memory rw True False False -
private_0x000000007f1ec000 0x7f1ec000 0x7f1eefff Private Memory rw True False False -
private_0x000000007f1ef000 0x7f1ef000 0x7f1effff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfaf7a0ffff Private Memory r True False False -
pagefile_0x00007dfaf7a10000 0x7dfaf7a10000 0x7ffaf7a0ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffaf7a10000 0x7ffaf7bd1fff Memory Mapped File rwx False False False -
private_0x00007ffaf7bd2000 0x7ffaf7bd2000 0x7ffffffeffff Private Memory r True False False -
Process #5: icacls.exe
0 0
»
Information Value
ID #5
File Name c:\windows\syswow64\icacls.exe
Command Line icacls logonui.exe /granted CIiHmnxMn6Ps:F
Initial Working Directory C:\Windows\System32\
Monitor Start Time: 00:02:06, Reason: Child Process
Unmonitor End Time: 00:02:08, Reason: Self Terminated
Monitor Duration 00:00:02
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x554
Parent PID 0xdf4 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 2C4
0x B34
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000100000 0x00100000 0x0011ffff Private Memory rw True False False -
pagefile_0x0000000000100000 0x00100000 0x0010ffff Pagefile Backed Memory rw True False False -
private_0x0000000000110000 0x00110000 0x00113fff Private Memory rw True False False -
private_0x0000000000120000 0x00120000 0x00121fff Private Memory rw True False False -
pagefile_0x0000000000130000 0x00130000 0x00143fff Pagefile Backed Memory r True False False -
private_0x0000000000150000 0x00150000 0x0018ffff Private Memory rw True False False -
private_0x0000000000190000 0x00190000 0x001cffff Private Memory rw True False False -
pagefile_0x00000000001d0000 0x001d0000 0x001d3fff Pagefile Backed Memory r True False False -
pagefile_0x00000000001e0000 0x001e0000 0x001e0fff Pagefile Backed Memory r True False False -
private_0x00000000001f0000 0x001f0000 0x001f1fff Private Memory rw True False False -
private_0x0000000000200000 0x00200000 0x0023ffff Private Memory rw True False False -
private_0x0000000000240000 0x00240000 0x0027ffff Private Memory rw True False False -
private_0x0000000000280000 0x00280000 0x0028ffff Private Memory rw True False False -
locale.nls 0x00290000 0x0034dfff Memory Mapped File r False False False -
private_0x0000000000380000 0x00380000 0x0038ffff Private Memory rw True False False -
private_0x00000000003c0000 0x003c0000 0x004bffff Private Memory rw True False False -
icacls.exe 0x013d0000 0x013d9fff Memory Mapped File rwx False False False -
pagefile_0x00000000013e0000 0x013e0000 0x053dffff Pagefile Backed Memory - True False False -
wow64cpu.dll 0x73030000 0x73037fff Memory Mapped File rwx False False False -
wow64.dll 0x73040000 0x7308efff Memory Mapped File rwx False False False -
wow64win.dll 0x73090000 0x73102fff Memory Mapped File rwx False False False -
ntmarta.dll 0x73120000 0x73147fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74a30000 0x74a88fff Memory Mapped File rwx False False False -
cryptbase.dll 0x74a90000 0x74a99fff Memory Mapped File rwx False False False -
sspicli.dll 0x74aa0000 0x74abdfff Memory Mapped File rwx False False False -
advapi32.dll 0x74c60000 0x74cdafff Memory Mapped File rwx False False False -
kernelbase.dll 0x74d30000 0x74ea5fff Memory Mapped File rwx False False False -
kernel32.dll 0x75130000 0x7521ffff Memory Mapped File rwx False False False -
sechost.dll 0x770b0000 0x770f2fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772c0000 0x7736bfff Memory Mapped File rwx False False False -
msvcrt.dll 0x778d0000 0x7798dfff Memory Mapped File rwx False False False -
ntdll.dll 0x77990000 0x77b08fff Memory Mapped File rwx False False False -
pagefile_0x000000007e870000 0x7e870000 0x7e96ffff Pagefile Backed Memory r True False False -
pagefile_0x000000007e970000 0x7e970000 0x7e992fff Pagefile Backed Memory r True False False -
private_0x000000007e993000 0x7e993000 0x7e993fff Private Memory rw True False False -
private_0x000000007e999000 0x7e999000 0x7e99bfff Private Memory rw True False False -
private_0x000000007e99c000 0x7e99c000 0x7e99efff Private Memory rw True False False -
private_0x000000007e99f000 0x7e99f000 0x7e99ffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfaf7a0ffff Private Memory r True False False -
pagefile_0x00007dfaf7a10000 0x7dfaf7a10000 0x7ffaf7a0ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffaf7a10000 0x7ffaf7bd1fff Memory Mapped File rwx False False False -
private_0x00007ffaf7bd2000 0x7ffaf7bd2000 0x7ffffffeffff Private Memory r True False False -
Process #6: takeown.exe
0 0
»
Information Value
ID #6
File Name c:\windows\syswow64\takeown.exe
Command Line takeown /f "C:\Windows\System32\en-US" /r /d y
Initial Working Directory C:\Windows\System32\
Monitor Start Time: 00:02:08, Reason: Child Process
Unmonitor End Time: 00:02:24, Reason: Self Terminated
Monitor Duration 00:00:16
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x8d8
Parent PID 0xdf4 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x C10
0x C28
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
takeown.exe 0x003c0000 0x003cffff Memory Mapped File rwx False False False -
pagefile_0x0000000000fe0000 0x00fe0000 0x04fdffff Pagefile Backed Memory - True False False -
private_0x0000000004fe0000 0x04fe0000 0x04ffffff Private Memory rw True False False -
pagefile_0x0000000004fe0000 0x04fe0000 0x04feffff Pagefile Backed Memory rw True False False -
private_0x0000000004ff0000 0x04ff0000 0x04ff3fff Private Memory rw True False False -
private_0x0000000005000000 0x05000000 0x05001fff Private Memory rw True False False -
takeown.exe.mui 0x05000000 0x05004fff Memory Mapped File r False False False -
pagefile_0x0000000005010000 0x05010000 0x05023fff Pagefile Backed Memory r True False False -
private_0x0000000005030000 0x05030000 0x0506ffff Private Memory rw True False False -
private_0x0000000005070000 0x05070000 0x050affff Private Memory rw True False False -
pagefile_0x00000000050b0000 0x050b0000 0x050b3fff Pagefile Backed Memory r True False False -
pagefile_0x00000000050c0000 0x050c0000 0x050c0fff Pagefile Backed Memory r True False False -
private_0x00000000050d0000 0x050d0000 0x050d1fff Private Memory rw True False False -
private_0x00000000050e0000 0x050e0000 0x050effff Private Memory rw True False False -
locale.nls 0x050f0000 0x051adfff Memory Mapped File r False False False -
private_0x00000000051b0000 0x051b0000 0x051effff Private Memory rw True False False -
private_0x00000000051f0000 0x051f0000 0x0522ffff Private Memory rw True False False -
private_0x0000000005230000 0x05230000 0x05230fff Private Memory rw True False False -
private_0x0000000005240000 0x05240000 0x05240fff Private Memory rw True False False -
private_0x0000000005270000 0x05270000 0x0536ffff Private Memory rw True False False -
private_0x00000000054d0000 0x054d0000 0x054dffff Private Memory rw True False False -
pagefile_0x00000000054e0000 0x054e0000 0x05667fff Pagefile Backed Memory r True False False -
pagefile_0x0000000005670000 0x05670000 0x057f0fff Pagefile Backed Memory r True False False -
pagefile_0x0000000005800000 0x05800000 0x06bfffff Pagefile Backed Memory r True False False -
sortdefault.nls 0x06c00000 0x06f36fff Memory Mapped File r False False False -
wow64cpu.dll 0x73030000 0x73037fff Memory Mapped File rwx False False False -
wow64.dll 0x73040000 0x7308efff Memory Mapped File rwx False False False -
wow64win.dll 0x73090000 0x73102fff Memory Mapped File rwx False False False -
ntmarta.dll 0x73120000 0x73147fff Memory Mapped File rwx False False False -
version.dll 0x74800000 0x74807fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74a30000 0x74a88fff Memory Mapped File rwx False False False -
cryptbase.dll 0x74a90000 0x74a99fff Memory Mapped File rwx False False False -
sspicli.dll 0x74aa0000 0x74abdfff Memory Mapped File rwx False False False -
user32.dll 0x74ad0000 0x74c0ffff Memory Mapped File rwx False False False -
shlwapi.dll 0x74c10000 0x74c53fff Memory Mapped File rwx False False False -
advapi32.dll 0x74c60000 0x74cdafff Memory Mapped File rwx False False False -
kernelbase.dll 0x74d30000 0x74ea5fff Memory Mapped File rwx False False False -
combase.dll 0x74f70000 0x75129fff Memory Mapped File rwx False False False -
kernel32.dll 0x75130000 0x7521ffff Memory Mapped File rwx False False False -
imm32.dll 0x75220000 0x7524afff Memory Mapped File rwx False False False -
msctf.dll 0x76da0000 0x76ebffff Memory Mapped File rwx False False False -
sechost.dll 0x770b0000 0x770f2fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772c0000 0x7736bfff Memory Mapped File rwx False False False -
gdi32.dll 0x77370000 0x774bcfff Memory Mapped File rwx False False False -
msvcrt.dll 0x778d0000 0x7798dfff Memory Mapped File rwx False False False -
ntdll.dll 0x77990000 0x77b08fff Memory Mapped File rwx False False False -
pagefile_0x000000007e590000 0x7e590000 0x7e68ffff Pagefile Backed Memory r True False False -
pagefile_0x000000007e690000 0x7e690000 0x7e6b2fff Pagefile Backed Memory r True False False -
private_0x000000007e6b7000 0x7e6b7000 0x7e6b9fff Private Memory rw True False False -
private_0x000000007e6ba000 0x7e6ba000 0x7e6bafff Private Memory rw True False False -
private_0x000000007e6bc000 0x7e6bc000 0x7e6befff Private Memory rw True False False -
private_0x000000007e6bf000 0x7e6bf000 0x7e6bffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfaf7a0ffff Private Memory r True False False -
pagefile_0x00007dfaf7a10000 0x7dfaf7a10000 0x7ffaf7a0ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffaf7a10000 0x7ffaf7bd1fff Memory Mapped File rwx False False False -
private_0x00007ffaf7bd2000 0x7ffaf7bd2000 0x7ffffffeffff Private Memory r True False False -
Process #7: icacls.exe
0 0
»
Information Value
ID #7
File Name c:\windows\syswow64\icacls.exe
Command Line icacls "C:\Windows\System32\en-US" /granted CIiHmnxMn6Ps:F /T /C
Initial Working Directory C:\Windows\System32\
Monitor Start Time: 00:02:24, Reason: Child Process
Unmonitor End Time: 00:02:25, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x444
Parent PID 0xdf4 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x D7C
0x 548
0x 534
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000eb0000 0x00eb0000 0x00ecffff Private Memory rw True False False -
pagefile_0x0000000000eb0000 0x00eb0000 0x00ebffff Pagefile Backed Memory rw True False False -
private_0x0000000000ec0000 0x00ec0000 0x00ec3fff Private Memory rw True False False -
private_0x0000000000ed0000 0x00ed0000 0x00ed1fff Private Memory rw True False False -
pagefile_0x0000000000ee0000 0x00ee0000 0x00ef3fff Pagefile Backed Memory r True False False -
private_0x0000000000f00000 0x00f00000 0x00f3ffff Private Memory rw True False False -
private_0x0000000000f40000 0x00f40000 0x00f7ffff Private Memory rw True False False -
pagefile_0x0000000000f80000 0x00f80000 0x00f83fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000f90000 0x00f90000 0x00f90fff Pagefile Backed Memory r True False False -
private_0x0000000000fa0000 0x00fa0000 0x00fa1fff Private Memory rw True False False -
locale.nls 0x00fb0000 0x0106dfff Memory Mapped File r False False False -
private_0x0000000001070000 0x01070000 0x010affff Private Memory rw True False False -
private_0x00000000010b0000 0x010b0000 0x010effff Private Memory rw True False False -
private_0x00000000010f0000 0x010f0000 0x0112ffff Private Memory rw True False False -
private_0x0000000001130000 0x01130000 0x0116ffff Private Memory rw True False False -
private_0x0000000001190000 0x01190000 0x0119ffff Private Memory rw True False False -
private_0x00000000012c0000 0x012c0000 0x013bffff Private Memory rw True False False -
icacls.exe 0x013d0000 0x013d9fff Memory Mapped File rwx False False False -
pagefile_0x00000000013e0000 0x013e0000 0x053dffff Pagefile Backed Memory - True False False -
private_0x0000000005520000 0x05520000 0x0552ffff Private Memory rw True False False -
wow64cpu.dll 0x73030000 0x73037fff Memory Mapped File rwx False False False -
wow64.dll 0x73040000 0x7308efff Memory Mapped File rwx False False False -
wow64win.dll 0x73090000 0x73102fff Memory Mapped File rwx False False False -
ntmarta.dll 0x74a00000 0x74a27fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74a30000 0x74a88fff Memory Mapped File rwx False False False -
cryptbase.dll 0x74a90000 0x74a99fff Memory Mapped File rwx False False False -
sspicli.dll 0x74aa0000 0x74abdfff Memory Mapped File rwx False False False -
advapi32.dll 0x74c60000 0x74cdafff Memory Mapped File rwx False False False -
kernelbase.dll 0x74d30000 0x74ea5fff Memory Mapped File rwx False False False -
kernel32.dll 0x75130000 0x7521ffff Memory Mapped File rwx False False False -
sechost.dll 0x770b0000 0x770f2fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772c0000 0x7736bfff Memory Mapped File rwx False False False -
msvcrt.dll 0x778d0000 0x7798dfff Memory Mapped File rwx False False False -
ntdll.dll 0x77990000 0x77b08fff Memory Mapped File rwx False False False -
pagefile_0x000000007f160000 0x7f160000 0x7f25ffff Pagefile Backed Memory r True False False -
pagefile_0x000000007f260000 0x7f260000 0x7f282fff Pagefile Backed Memory r True False False -
private_0x000000007f283000 0x7f283000 0x7f285fff Private Memory rw True False False -
private_0x000000007f286000 0x7f286000 0x7f288fff Private Memory rw True False False -
private_0x000000007f289000 0x7f289000 0x7f289fff Private Memory rw True False False -
private_0x000000007f28c000 0x7f28c000 0x7f28cfff Private Memory rw True False False -
private_0x000000007f28d000 0x7f28d000 0x7f28ffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfaf7a0ffff Private Memory r True False False -
pagefile_0x00007dfaf7a10000 0x7dfaf7a10000 0x7ffaf7a0ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffaf7a10000 0x7ffaf7bd1fff Memory Mapped File rwx False False False -
private_0x00007ffaf7bd2000 0x7ffaf7bd2000 0x7ffffffeffff Private Memory r True False False -
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image