8ebf2ae4...291e | Sequential Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Trojan, Dropper, Wiper, Ransomware

8ebf2ae4c362f76d402703efe3dc095901f2d78917f88a520b67584a7d8f291e (SHA256)

LIGMA.exe

Windows Exe (x86-32)

Created at 2018-09-08 08:53:00

...

Notifications (2/3)

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

The overall sleep time of all monitored processes was truncated from "1 minute, 15 seconds" to "30 seconds" to reveal dormant functionality.

The operating system was rebooted during the analysis.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x950 Analysis Target High (Elevated) ligma.exe "C:\Users\CIiHmnxMn6Ps\Desktop\LIGMA.exe" -
#2 0xdf4 Child Process High (Elevated) cmd.exe C:\Windows\system32\cmd.exe /c ""C:\WinWOW32\\work.bat"" #1
#4 0xb04 Child Process High (Elevated) takeown.exe takeown /f logonui.exe #2
#5 0x554 Child Process High (Elevated) icacls.exe icacls logonui.exe /granted CIiHmnxMn6Ps:F #2
#6 0x8d8 Child Process High (Elevated) takeown.exe takeown /f "C:\Windows\System32\en-US" /r /d y #2
#7 0x444 Child Process High (Elevated) icacls.exe icacls "C:\Windows\System32\en-US" /granted CIiHmnxMn6Ps:F /T /C #2

Behavior Information - Sequential View

Process #1: ligma.exe
7682 0
»
Information Value
ID #1
File Name c:\users\ciihmnxmn6ps\desktop\ligma.exe
Command Line "C:\Users\CIiHmnxMn6Ps\Desktop\LIGMA.exe"
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:00:31, Reason: Analysis Target
Unmonitor End Time: 00:02:25, Reason: Self Terminated
Monitor Duration 00:01:54
OS Process Information
»
Information Value
PID 0x950
Parent PID 0x820 (c:\windows\explorer.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A70
0x 1A0
0x A44
0x 8CC
0x 848
0x CFC
0x DAC
0x D90
0x D50
0x D4C
0x ED4
0x C8C
0x 2D0
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
ligma.exe 0x00f00000 0x00f13fff Memory Mapped File rwx True True False
...
private_0x0000000000f20000 0x00f20000 0x00f3ffff Private Memory rw True False False -
pagefile_0x0000000000f20000 0x00f20000 0x00f2ffff Pagefile Backed Memory rw True False False -
private_0x0000000000f30000 0x00f30000 0x00f33fff Private Memory rw True False False -
private_0x0000000000f40000 0x00f40000 0x00f40fff Private Memory rw True False False -
private_0x0000000000f40000 0x00f40000 0x00f4ffff Private Memory rw True False False -
pagefile_0x0000000000f50000 0x00f50000 0x00f63fff Pagefile Backed Memory r True False False -
private_0x0000000000f70000 0x00f70000 0x00faffff Private Memory rw True False False -
private_0x0000000000fb0000 0x00fb0000 0x010affff Private Memory rw True False False -
pagefile_0x00000000010b0000 0x010b0000 0x010b3fff Pagefile Backed Memory r True False False -
pagefile_0x00000000010c0000 0x010c0000 0x010c0fff Pagefile Backed Memory r True False False -
private_0x00000000010d0000 0x010d0000 0x010d1fff Private Memory rw True False False -
locale.nls 0x010e0000 0x0119dfff Memory Mapped File r False False False -
private_0x00000000011a0000 0x011a0000 0x011dffff Private Memory rw True False False -
private_0x00000000011e0000 0x011e0000 0x011e0fff Private Memory rw True False False -
private_0x00000000011f0000 0x011f0000 0x011f0fff Private Memory rw True False False -
pagefile_0x0000000001200000 0x01200000 0x01200fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000001210000 0x01210000 0x0121ffff Pagefile Backed Memory rw True False False -
private_0x0000000001220000 0x01220000 0x0122ffff Private Memory - True False False -
private_0x0000000001230000 0x01230000 0x0123ffff Private Memory - True False False -
private_0x0000000001240000 0x01240000 0x0124ffff Private Memory - True False False -
private_0x0000000001250000 0x01250000 0x0125ffff Private Memory - True False False -
private_0x0000000001260000 0x01260000 0x0126ffff Private Memory - True False False -
private_0x0000000001270000 0x01270000 0x0127ffff Private Memory rw True False False -
private_0x0000000001280000 0x01280000 0x0137ffff Private Memory rw True False False -
private_0x0000000001380000 0x01380000 0x01380fff Private Memory rw True False False -
private_0x0000000001390000 0x01390000 0x01390fff Private Memory rw True False False -
private_0x00000000013a0000 0x013a0000 0x013dffff Private Memory rw True False False -
private_0x00000000013e0000 0x013e0000 0x013effff Private Memory - True False False -
private_0x00000000013f0000 0x013f0000 0x013fffff Private Memory rw True False False -
private_0x0000000001400000 0x01400000 0x014fffff Private Memory rw True False False -
pagefile_0x0000000001500000 0x01500000 0x01687fff Pagefile Backed Memory r True False False -
private_0x0000000001690000 0x01690000 0x016cffff Private Memory rw True False False -
private_0x00000000016d0000 0x016d0000 0x016dffff Private Memory rw True False False -
pagefile_0x00000000016e0000 0x016e0000 0x01860fff Pagefile Backed Memory r True False False -
pagefile_0x0000000001870000 0x01870000 0x02c6ffff Pagefile Backed Memory r True False False -
private_0x0000000002c70000 0x02c70000 0x02d6ffff Private Memory rw True False False -
private_0x0000000002d70000 0x02d70000 0x02d9ffff Private Memory - True False False -
private_0x0000000002da0000 0x02da0000 0x02daffff Private Memory rwx True False False -
private_0x0000000002db0000 0x02db0000 0x02dbffff Private Memory - True False False -
private_0x0000000002dc0000 0x02dc0000 0x02dcffff Private Memory - True False False -
private_0x0000000002dd0000 0x02dd0000 0x02ddffff Private Memory - True False False -
private_0x0000000002de0000 0x02de0000 0x02deffff Private Memory rw True False False -
private_0x0000000002df0000 0x02df0000 0x04deffff Private Memory rw True False False -
private_0x0000000004df0000 0x04df0000 0x04e8ffff Private Memory rw True False False -
private_0x0000000004e90000 0x04e90000 0x04f8ffff Private Memory rw True False False -
sortdefault.nls 0x04f90000 0x052c6fff Memory Mapped File r False False False -
private_0x00000000052d0000 0x052d0000 0x054cffff Private Memory rw True False False -
pagefile_0x00000000052d0000 0x052d0000 0x052d0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000052d0000 0x052d0000 0x052d1fff Pagefile Backed Memory r True False False -
private_0x00000000052e0000 0x052e0000 0x052effff Private Memory - True False False -
private_0x00000000052f0000 0x052f0000 0x052fffff Private Memory - True False False -
pagefile_0x0000000005300000 0x05300000 0x05300fff Pagefile Backed Memory r True False False -
pagefile_0x0000000005300000 0x05300000 0x05303fff Pagefile Backed Memory r True False False -
user32.dll.mui 0x05310000 0x05314fff Memory Mapped File r False False False -
windowsshell.manifest 0x05320000 0x05320fff Memory Mapped File r False False False -
private_0x0000000005320000 0x05320000 0x05323fff Private Memory rw True False False -
pagefile_0x0000000005330000 0x05330000 0x05331fff Pagefile Backed Memory r True False False -
imageres.dll.mui 0x05340000 0x05340fff Memory Mapped File r False False False -
pagefile_0x0000000005350000 0x05350000 0x05350fff Pagefile Backed Memory r True False False -
pagefile_0x0000000005360000 0x05360000 0x05360fff Pagefile Backed Memory r True False False -
private_0x0000000005360000 0x05360000 0x0536ffff Private Memory - True False False -
private_0x0000000005370000 0x05370000 0x0537ffff Private Memory - True False False -
system.drawing.dll 0x05380000 0x0540ffff Memory Mapped File rwx True False False -
private_0x0000000005410000 0x05410000 0x0548ffff Private Memory rw True False False -
private_0x0000000005490000 0x05490000 0x0549ffff Private Memory rwx True False False -
private_0x00000000054a0000 0x054a0000 0x054affff Private Memory rw True False False -
private_0x00000000054b0000 0x054b0000 0x054bffff Private Memory rw True False False -
accessibility.dll 0x054b0000 0x054b9fff Memory Mapped File rwx True False False -
private_0x00000000054c0000 0x054c0000 0x054cffff Private Memory rw True False False -
pagefile_0x00000000054d0000 0x054d0000 0x05587fff Pagefile Backed Memory r True False False -
pagefile_0x0000000005590000 0x05590000 0x055e5fff Pagefile Backed Memory rw True False False -
comctl32.dll 0x05590000 0x0561efff Memory Mapped File r False False False -
private_0x0000000005590000 0x05590000 0x0564ffff Private Memory rw True False False -
private_0x0000000005590000 0x05590000 0x0559ffff Private Memory rw True False False -
private_0x00000000055a0000 0x055a0000 0x055affff Private Memory rw True False False -
private_0x00000000055a0000 0x055a0000 0x0563ffff Private Memory rw True False False -
private_0x00000000055a0000 0x055a0000 0x055dffff Private Memory rw True False False -
private_0x00000000055e0000 0x055e0000 0x055e3fff Private Memory rw True False False -
private_0x00000000055f0000 0x055f0000 0x055f3fff Private Memory rw True False False -
private_0x0000000005600000 0x05600000 0x0560ffff Private Memory - True False False -
private_0x0000000005630000 0x05630000 0x0563ffff Private Memory rw True False False -
private_0x0000000005640000 0x05640000 0x0564ffff Private Memory rw True False False -
private_0x0000000005650000 0x05650000 0x0574ffff Private Memory rw True False False -
~fontcache-system.dat 0x05750000 0x057c5fff Memory Mapped File r False False False -
private_0x00000000057d0000 0x057d0000 0x058cffff Private Memory rw True False False -
system.windows.forms.dll 0x05970000 0x05e07fff Memory Mapped File rwx True False False -
pagefile_0x0000000005e10000 0x05e10000 0x06301fff Pagefile Backed Memory rw True False False -
staticcache.dat 0x06310000 0x0734ffff Memory Mapped File r False False False -
imageres.dll 0x07350000 0x09f62fff Memory Mapped File r False False False -
~fontcache-fontface.dat 0x09f70000 0x0af6ffff Memory Mapped File r False False False -
private_0x000000000af70000 0x0af70000 0x0b06ffff Private Memory rw True False False -
system.core.ni.dll 0x714f0000 0x71c02fff Memory Mapped File rwx True False False -
dwrite.dll 0x71c10000 0x71dfffff Memory Mapped File rwx False False False -
mscorlib.ni.dll 0x71e00000 0x7302afff Memory Mapped File rwx True False False -
wow64cpu.dll 0x73030000 0x73037fff Memory Mapped File rwx False False False -
wow64.dll 0x73040000 0x7308efff Memory Mapped File rwx False False False -
wow64win.dll 0x73090000 0x73102fff Memory Mapped File rwx False False False -
payloads.dll 0x73180000 0x73187fff Memory Mapped File rwx True True False
...
gdiplus.dll 0x73200000 0x7336afff Memory Mapped File rwx False False False -
comctl32.dll 0x73370000 0x73401fff Memory Mapped File rwx False False False -
comctl32.dll 0x73410000 0x73618fff Memory Mapped File rwx False False False -
system.ni.dll 0x73620000 0x73fccfff Memory Mapped File rwx True False False -
clrjit.dll 0x73fd0000 0x7404cfff Memory Mapped File rwx True False False -
msvcr120_clr0400.dll 0x74050000 0x74144fff Memory Mapped File rwx False False False -
clr.dll 0x74150000 0x747f7fff Memory Mapped File rwx True False False -
version.dll 0x74800000 0x74807fff Memory Mapped File rwx False False False -
mscoreei.dll 0x74810000 0x74887fff Memory Mapped File rwx True False False -
mscoree.dll 0x74890000 0x748e8fff Memory Mapped File rwx True False False -
dwmapi.dll 0x748f0000 0x7490cfff Memory Mapped File rwx False False False -
uxtheme.dll 0x74910000 0x74984fff Memory Mapped File rwx False False False -
apphelp.dll 0x74990000 0x74a20fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74a30000 0x74a88fff Memory Mapped File rwx False False False -
cryptbase.dll 0x74a90000 0x74a99fff Memory Mapped File rwx False False False -
sspicli.dll 0x74aa0000 0x74abdfff Memory Mapped File rwx False False False -
user32.dll 0x74ad0000 0x74c0ffff Memory Mapped File rwx False False False -
shlwapi.dll 0x74c10000 0x74c53fff Memory Mapped File rwx False False False -
advapi32.dll 0x74c60000 0x74cdafff Memory Mapped File rwx False False False -
powrprof.dll 0x74ce0000 0x74d23fff Memory Mapped File rwx False False False -
kernelbase.dll 0x74d30000 0x74ea5fff Memory Mapped File rwx False False False -
combase.dll 0x74f70000 0x75129fff Memory Mapped File rwx False False False -
kernel32.dll 0x75130000 0x7521ffff Memory Mapped File rwx False False False -
imm32.dll 0x75220000 0x7524afff Memory Mapped File rwx False False False -
kernel.appcore.dll 0x752b0000 0x752bbfff Memory Mapped File rwx False False False -
shell32.dll 0x752c0000 0x7667efff Memory Mapped File rwx False False False -
windows.storage.dll 0x76800000 0x76cdcfff Memory Mapped File rwx False False False -
oleaut32.dll 0x76ce0000 0x76d71fff Memory Mapped File rwx False False False -
msctf.dll 0x76da0000 0x76ebffff Memory Mapped File rwx False False False -
ole32.dll 0x76f30000 0x77019fff Memory Mapped File rwx False False False -
sechost.dll 0x770b0000 0x770f2fff Memory Mapped File rwx False False False -
profapi.dll 0x77100000 0x7710efff Memory Mapped File rwx False False False -
shcore.dll 0x771d0000 0x7725cfff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772c0000 0x7736bfff Memory Mapped File rwx False False False -
gdi32.dll 0x77370000 0x774bcfff Memory Mapped File rwx False False False -
msvcrt.dll 0x778d0000 0x7798dfff Memory Mapped File rwx False False False -
ntdll.dll 0x77990000 0x77b08fff Memory Mapped File rwx False False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7fffffff Private Memory - True False False -
private_0x0000000080000000 0x80000000 0x8000ffff Private Memory - True False False -
private_0x00000000fec1a000 0xfec1a000 0xfec1cfff Private Memory rw True False False -
private_0x00000000fec1d000 0xfec1d000 0xfec1ffff Private Memory rw True False False -
pagefile_0x00000000fec20000 0xfec20000 0xfed1ffff Pagefile Backed Memory r True False False -
pagefile_0x00000000fed20000 0xfed20000 0xfed42fff Pagefile Backed Memory r True False False -
private_0x00000000fed45000 0xfed45000 0xfed47fff Private Memory rw True False False -
private_0x00000000fed48000 0xfed48000 0xfed48fff Private Memory rw True False False -
private_0x00000000fed49000 0xfed49000 0xfed4bfff Private Memory rw True False False -
private_0x00000000fed4c000 0xfed4c000 0xfed4efff Private Memory rw True False False -
private_0x00000000fed4f000 0xfed4f000 0xfed4ffff Private Memory rw True False False -
private_0x00000000fffe0000 0xfffe0000 0x7ffaf7a0ffff Private Memory r True False False -
ntdll.dll 0x7ffaf7a10000 0x7ffaf7bd1fff Memory Mapped File rwx False False False -
private_0x00007ffaf7bd2000 0x7ffaf7bd2000 0x7ffffffeffff Private Memory r True False False -
For performance reasons, the remaining 26 entries are omitted.
The remaining entries can be found in flog.txt.
Created Files
»
Filename File Size Hash Values YARA Match Actions
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeBackgroundTaskHandlerRegistration.xml.ForgiveME 2.94 KB MD5: e867729a36210750c21419ba51950b48
SHA1: 70363669ceee640d92824337faf37f9ffaff9428
SHA256: 81f513af1306c24d7fb7e79bb03c6514f2ee20559c6122b789d77d571b40bc3d
SSDeep: 48:c/8nA3YkIOSYCoPbWEEqJ90iDRlbExsbiRT5tysBr9yKK9PQZ8Yz6ep3qXBmE5bf:c/8nA3fr6oJ90IRlIx7qnazjJEluXJxs 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeBackgroundTaskHandlerLogon.xml.ForgiveME 2.77 KB MD5: 7491a0177771535ebe4947b4e011592c
SHA1: deb6bea6c49d60fe958cb747016813fd1fdd7ab5
SHA256: 9e721b6a9c69187a3bc84e0e4b0482cd30cc4e985dc32b3e5d9e759a4f42ffe6
SSDeep: 48:EuAEenbxlpVFNb+1o/0lcogrAJ8n+nL0UPyRQmdeAJa2y+F6PKVZJinb5VxAUoxf:EuAR9h7b+u/0le3n+nI0yWmva2y6mrnO 		False
...
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\en-us.16\Stream.Platform.Culture.man.xml.ForgiveME 1.73 MB MD5: 505b56f5b9c6a74bf29d2f3146bca577
SHA1: 922f42151f69e4fc5c0606b1bade31c3f1c7e4d1
SHA256: 7c2a1623fdc1244c0c07b03d8e038c70178f8b82e6b3b1f95ea60a2cd506e26f
SSDeep: 49152:fNrFEjLvERUP8lvzvJU7kMLU3nDk3DqPuDw:lruZ89zvJUXU3Q3D5w 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeOsfInstaller.xml.ForgiveME 3.52 KB MD5: 49c358d29d2cc7a850bc5c3d76fba9ec
SHA1: 37b266b5524f1d7f0ced1cf2c1e75b1896eec311
SHA256: bc92c1c4e497592b747f692ed4c2fa9b33806deed96e2f391f1bd66b2f439d8c
SSDeep: 96:CYKfopIvFUPxiW1FvmDfWFhErwIQRaKsQ8W:CDdvFUPxTH6WPIsH 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\8DAs79 _K.doc.ForgiveME 34.89 KB MD5: 4bc6a57ee31c96a6ecb004284a0858dc
SHA1: 5a15d938d564aa002b2df3b30dece1848df6b9d0
SHA256: 44dabfafc06081694952896b5594e67f2575d3abb461bab236e8075177c93d85
SSDeep: 768:b8M8gvJ4mai6fi9g5uhKozRZWdGSgfdGZbEdUD:bZxvvajfGg5uhjzzHdswA 		False
...
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\-v8NyVF6Hq8N 4.flv.ForgiveME 4.42 KB MD5: b33449b261d27bafe96de10115d7f274
SHA1: 793c4d6122fe59c75734373c7c766e43789046ab
SHA256: 408bcef2390829e52d49bce9f829256c627e53f0da215d31f4c330935ca07d6d
SSDeep: 96:uuih5AL82wdthVyq/DFe4yN2C+dAJIklTmiugxPT9BqG+emLd8A7xN:uua577/Aw7gIklTmoPTKp3d8AH 		False
...
C:\WinWOW32\icon.ico 7.51 KB MD5: 95517dfad14dfb29e883df2e94f901bc
SHA1: 9625e5ad8aed308b686dc544a6a37eb064a08527
SHA256: 8d38171ee9927844d2abf2f77685f6ad4dd877fbfdccc1c969da7e3d13340a60
SSDeep: 192:xs3n7O1cWLZ6LyDcpZoLygjmUtWTbDx7hUh:uX7JiSyDc7omAmnTbDxNUh 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\dIzOux_V.png.ForgiveME 50.33 KB MD5: 79638dbd69aa8868a01ece88642465ba
SHA1: a0e12563f5bc9afcc28ec8e3cd73bf933f6b1ef4
SHA256: fba6a9a5dee5f261bfd96a3cc5d60a6aaedf35b2637c8b05da942376e61d6934
SSDeep: 1536:R/ZFkrmNnywmeXIvtCcrNPaxHx3QD6CKxPiHR:R/Lpyw9ytCsNPSH+6LxPIR 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.visiomui.msi.16.en-us.xml.ForgiveME 1.10 MB MD5: a1a5f8c37b9eb80caa9777379e375447
SHA1: c39184ae75054526b066a946f384ec30e5b8dc96
SHA256: daf65ccacc7460b68661aa233023948a010a14e85d372705fb5f5027f62fa877
SSDeep: 24576:BG9+eCSzRwf0v7CEq10Ol2kyXdzEao7n105NtBK3aIVTrIKEJCO6WG:Bg+twRDnq10OutzEao7105NrB8TstG 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml.ForgiveME 123.88 KB MD5: caf69a92f4a787c028ee8aea7d82cead
SHA1: 02439351a79e47b6e05a0409dd5f23f4363763a0
SHA256: 4be59941e6bab182f7d606816c49413440718eda7170f6693183764b44d5c91e
SSDeep: 3072:wNWZTYPQzpHnMlfk/JZgecsgNf2R+DV/xfGB1ewpQCr/:YiYPQ1Hn2s/JSecdw+DbmBGU 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\CZiQMWk.avi.ForgiveME 53.33 KB MD5: ad53ef0e762040b8f9b2879892f04cf9
SHA1: 3096830822957b06bdc2228d6f36a2fa00030f80
SHA256: 2968bedb499b161735757be411b0f9f929d8a8942171c4ea4ae34c3122586117
SSDeep: 1536:k1aifg3Ks5cMp0/xebK8rGFQvrvlSD+AWZB9:QaYg3ZCR2GUksr9 		False
...
C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml.ForgiveME 5.77 MB MD5: 0c7fc54b273e2d86874247a8c42abd95
SHA1: 8f62c756d83373ffffc4961dcf31ccb234cc9f8a
SHA256: 8b581ba17fa336b728825808232300975fc8efd7f6014acc3ba6d26d8c080a66
SSDeep: 98304:AcSpr+s+uKVczSCcE/e3cH0sumAB1rnyjW9JKcF3EBSykCV1cK7eweOLzRSlQ:b2r+XuKVczh/QcIryaTHFmS1KKweO5Z 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.ForgiveME 96.14 KB MD5: 95fc3205577226aa97c445e15373e8e9
SHA1: 79f59b466e28a9dce46371ed1ea4b634c99efab2
SHA256: 5bc0677a7fcdae9add9cde1df94333458981698aadb66d68be78ac8d3ec54027
SSDeep: 1536:speVMwYzrWE0UChSGIbZlA23kQ6IOJQmuy+7hdFxF1UYWCjLGTis5BNXBer66:speJV9UC5IVT6p+r3PjCGsb3p6 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\ED8z5hvaRbfKFmQSj.mp3.ForgiveME 84.33 KB MD5: 4198c1753b472e53bdafaf4e10d6455c
SHA1: b9679883ca089bf89a59b2f3715745985bc7cde8
SHA256: 3e76b7be7caba54b34adefca637c0ca57fb62a251e5ee44dba8c9c28d4101e67
SSDeep: 1536:13MI6kJo9f3PckZ3TdashzcPiNAG4cQVa6xkuqshqOC5ZnGroVZb+P4kwoN68:Juqo9/E0jka46Sauqsh3oTe7Rt 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.ForgiveME 103.61 KB MD5: c8b99fb9a65ae9d00cf9885fad2de561
SHA1: 4996ac5d325ba76829be644f141c76e4f94335f4
SHA256: b49012069861a2f47b2b8a47478b3c66f62a28be4540d3058f60cbcfb4d6a4a2
SSDeep: 1536:a/I+MRHM+dTFlkUAHCIEm76+k+EmDri6ROxfelnYzKaO+Zoh0lAca:abAR7AF2L/mLEVK63Cca 		False
...
C:\ProgramData\Microsoft\ClickToRun\9D76938C-943D-439F-A135-26D02821EE05\en-us.16\stream.x64.en-us.man.dat.ForgiveME 861.95 KB MD5: 5cf2582d9c520a2d2ea214b7cb695442
SHA1: b2dd51670f74605649dfec0edbcfcde99aab9fed
SHA256: 51c2ce23bc5149ab908e5971fcb012c29955eebd97ac46b6a86fb231184b6bfe
SSDeep: 24576:l/rUrsnwXPNxvCJ5S9hVo/Z9AV1BtG9Az:ZUrYwXlxI5S9TEHI1Cyz 		False
...
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\x-none.16\stream.x64.x-none.man.dat.ForgiveME 5.07 MB MD5: e18e45d0fa1e0ab370146c63414192d5
SHA1: 481bc2a6c4ce9049cd8d8b561d3fd4ced18bee12
SHA256: dc2316f3597f94e1554afcab05510895eae54e9890880f9fd9e8e9d3c946d0a6
SSDeep: 98304:kaq3/9czv8QwuYNx4rl5kRdSgIwHwDe/GKdHeSH9U6uBccGwB977Q6ZVvT:u98v8bxAlSBIx0GKNwXB9nQ6r 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.ForgiveME 794.55 KB MD5: 43988012562c29b4900e5dd018ff8e67
SHA1: 1f47589b94f6ec89fc9eff3ebba51048b0f55655
SHA256: 33cd8f01c03d51083a4b5e3c45fc6556a182a0f06fb9e1722567e5296e091add
SSDeep: 12288:FBOX4C+guBhNhsrmYnVFVSdyz2pHGIGtu8SdrCTZeGlJJw+vMOr+Ju:CX49NhNyrmeqiEmc8SNCTjo+vUJu 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml.ForgiveME 94.62 KB MD5: a1f7c67ee6e4cf94de52c98a934d7fe2
SHA1: 3fd3177323ed41912c6a529b74777db1fb544ccd
SHA256: 356e1d0f01aaa2f5b9709ad871b095ae6157163b427ada9cbeebfd065c4060b7
SSDeep: 1536:MDFZuUkMuDXrAXah5Vs1bAfuGlmLHQWO5dMrc59yAb73CE+qTuhOn:MykubrQa14cu00HiX5/b7lTz 		False
...
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\EDA58A0B-AD79-496A-8530-618D08767E60\x-none.16\stream.Platform.x-none.man.xml.ForgiveME 10.00 MB MD5: e509aab2e5ed4d2ed6ac0f9fe1a7beb7
SHA1: 4ab403dc710bfe386fdf6bc8f95d4cc1c36b4230
SHA256: ff7d2ab6fc10fc60c6229b5c6c6083f3455a6ff473420543967f54b8b553eb3f
SSDeep: 196608:cnu03cRFzJW/c8/L76GXPy5X7InGGB5DfG512tIanN/1kXuXkobXTvJN35:ET3cRDW08TetIGGDDFIanc2bjbPp 		False
...
C:\WinWOW32\work.bat 0.78 KB MD5: c02c8d9ca4ddd23a8a8f606410114164
SHA1: 185a3bd73be1b99a73a7f78922b6f8fc3a6ab3ec
SHA256: 38e2a3524b7ba05729037911be32598a324eb99c6857cfd93b28115804d089ee
SSDeep: 24:CLJepAC4PwxOi+flYtTH4UV4Qh9iwubER4ul8aLZ+c:yJeKC48+fl6TH4M4wYwuwxlhLZ+c 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.ForgiveME 188.36 KB MD5: 3876150dada949f27028ab5d87164f61
SHA1: 60587cb00b089f7bc5261adbb6dbcea6cccda815
SHA256: 5c659864f1e058740513a5a32b6eb135829f17b64ca9f9f7f89aca470c909534
SSDeep: 3072:nBInJWVH1Pi9r3TOg/Dh+Oo/9BVORxLSLN/iydXvlRTzB0+uz/0cyW829rjzPWX+:nGnJWVH1P6zKmh+OwBESLXl1mpvyWFr5 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\3nApnpXou.rtf.ForgiveME 22.78 KB MD5: b6a0fa89b87588189578de2531ab9e91
SHA1: 9ffe3e188310a243e9fbd3b09fc2a67b5c7991fd
SHA256: c35a8695d4b69b45b0844e8bb6288fe08209735cb38c70e60c211ee1643ab10f
SSDeep: 384:Crq8k9IZjHGwbiV9LQ+sGxIzd9T1WAq32+vtUYsbDy856HvVwnzBL:C+ZQHRbiV90+JIzD1WAq37tUYsbm856e 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\4tl50FkWgJm.bmp.ForgiveME 28.23 KB MD5: aeca23349eca4d8522f6dc82ef649e02
SHA1: 6a34e855bb52290a364c9a08c9f7cfa0770e4111
SHA256: 32a3a5cf7be4299e9011d7fae90e18918c93f9f2f0cd4e7fcfb1f3839ada4eb8
SSDeep: 768:vQYn2AybuP4YNzcT+inDjOkdGzxoAkCiriHc/MqEFR9wG:YgUuvMpDfczxoAkntZEFRT 		False
...
C:\WinWOW32\mbr.bin 0.50 KB MD5: 4efb0f32bf5badbfe4bafad794384600
SHA1: dc02ea8204956a486ed7fa0ad00b265a2a88fc8c
SHA256: 18d91faaaba711c880cacbf87ccb9874fe4b9225aa15c91905d90fec3fe9ee05
SSDeep: 6:M00XVih+SF1AfncBu2WUuaP7U06Ko+FDsXC1mCez:gXV01AfcBZWU1A0zD2Pz 		False
...
C:\ProgramData\Microsoft\ClickToRun\9D76938C-943D-439F-A135-26D02821EE05\x-none.16\stream.x64.x-none.man.dat.ForgiveME 3.52 MB MD5: ddf2029436068f0e32264a63e8107274
SHA1: 5c5560144d7dd58b84638ee0431632915ee31960
SHA256: e55e01e2e680924ae340175b73252d358c1d10b27377a298fccbb599994af36d
SSDeep: 98304:p46ErQyP3dT8i0XW4UnyQF5Bbgj4LqtLRzulv27hGzTM3Sd:p46EvhG+Ffgrd18v2EHgSd 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\4D-RXRdL_2N.mp3.ForgiveME 19.36 KB MD5: 53328c6c835ca779280f3f9f6846e761
SHA1: 5d7e34f0d98122316f2a8186f07e1ebbd65ec88a
SHA256: d98716c50494cc482bd8f0ed81b595e02ef997dd705f90a342fb18c927938799
SSDeep: 384:Q0SZZqJjBp2NVTsaOE8VqeDLCddEHRxmhlr3ZoH3GUJ4dKiNWi:Q0Sr8jBp2/PeDLCdK7mGXrZwF 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\CnWmKSFK768cf2Qzf.m4a.ForgiveME 35.03 KB MD5: 64717b8d532540487415529c68726417
SHA1: 24dc20a44849918e8f359519badae3108f1126e8
SHA256: a26375b635d2c34ad28ac4e06fe17a92bb4f91d3a1b6277cac2c2a674d422e79
SSDeep: 768:kKrZfOvVqC58RYlrongvBOtlriyeV1lWsWA2Dh1+msj95kWW/XK3VCdOb:XrZmvVq08RYVerifVPWjL+98P/XKlSC 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.ForgiveME 95.69 KB MD5: d5463fc03939b9f4098557b6d5817a15
SHA1: f8638bee90898f7d4c770732edf8645d9ee49270
SHA256: a099a7d71fcc0ee2586c68f400eafadba59a6a4182bb8ba90ec481b28af01568
SSDeep: 1536:sscpe4fZPJ37GshyGEDBsYuITD1xOXfRTiAqezzsBN2b4HcfpxkacTxWn4:Zcpe0VVGshuP7DDKRmvdIbXRxk1TxWn4 		False
...
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\EDA58A0B-AD79-496A-8530-618D08767E60\en-us.16\stream.x64.en-us.man.dat.ForgiveME 1.07 MB MD5: cd0d5a17d13786081fccf23cd4c38311
SHA1: a1da4ba278aae7e8886ec824422e10fc4582094c
SHA256: f17719dc85a3408dc84e6a3e358e7de9e64eb9e2d5f5daf4adbef989327d77e0
SSDeep: 24576:icWlh0Qn2dTSIsqLBYqDRBsMaL5aSdKTjNC7PU+b580bpi89BQC5G:iln2ku4NhcjNC7BbTpz40G 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office32ww.msi.16.x-none.xml.ForgiveME 335.83 KB MD5: 8ea789f982b5fee45490e4e109427bd0
SHA1: 5287a99892dc8fc348bd3a74f4ecc58525e63899
SHA256: 537d28fe6ed2de62b33ddab8f8e6a392b8b31c1d23b61e03a81ce5b7bf246809
SSDeep: 6144:8STadE2gePrizUM0rA/mG4yxdzICl1RPqZAKKWI2P7TOsD1JE8Y0UzfR5MSpbZ/V:8SGvgxzUMmWT46wZAKUs5m50gRZzJ 		False
...
C:\WinWOW32\Payloads.dll 14.00 KB MD5: d476188465a17118dbfedf72189f8240
SHA1: 570398ef3b4a5a07f054c9a7da96a6e708c2bcf2
SHA256: 1a7d479053a05c167a9d79222582d6a4f45f65bfc3689d7ef2084f7366963dcb
SSDeep: 192:u4uqCRNBCuYsXYUhE4oUe0a8EW5ZnJlbh/v3hrnT41DDVv9N5dAFjN:JcFhhOUexwFJv3hr81fVL5d+ 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml.ForgiveME 76.36 KB MD5: 8eaa7045f17eafe853f20b19ed179294
SHA1: 8baf54c61922eb2e04c032194e30d8940701d641
SHA256: e5a5f01f5821ee46be56814430ef627fd77ada1aa9b8a3e74ba4db15665f4c0b
SSDeep: 1536:Dew7U8rl0xw5pFL1ILWOe3kdcrJ+7sz9V3hDSAm4nJ3S0uqgo1M7JEJHWUCsk:Dew7/reS5p11IXwrc7+JSA/3VNgahCsk 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.ForgiveME 89.92 KB MD5: c56a6198571e95f3543aa691b42941b7
SHA1: 7a4751a939caf247d1a815f151e4862ed6015efb
SHA256: d9cbda78053c39d338d3fd1b3b52d7dd078cc31a3693ca836f6cf8d5831bcc2a
SSDeep: 1536:+REDL9kjvj2iGV3UwL4DShrJCf+iGdIsUlKOPmQ2LbaNTDvGHr:+6VkloLCStJ47GqsUMjnaNXGHr 		False
...
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\EDA58A0B-AD79-496A-8530-618D08767E60\x-none.16\stream.x64.x-none.man.dat.ForgiveME 5.83 MB MD5: a7cb5ec8620af864f0362693742b1841
SHA1: 02d61ab0fc3c61ff8b4b38d466e5a86f27973c74
SHA256: b5fb6e0a2a75846002a32b9dd5f3f9876345d4438c2ead8d22679734c580be32
SSDeep: 98304:xz4V0QB+EMhUgaXBgUEKXNXwNZsvcOsr5Fj8c9pYgUDFnQ92LdGp8YGNIr0zGwvw:xz4V4UXJvcOuP3jYgUDu92g8Y6IJwvCl 		False
...
C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\folder.ico.ForgiveME 29.23 KB MD5: 8caf9364d863630e25da1dcc70603525
SHA1: 60db4ceff40d46300cff3d9350e7b3cb784f2641
SHA256: 65dd605668ac3acc6c49aaf8d32090ec6bd2e4832711119f88913eb032738f3f
SSDeep: 768:jT52gN96sjGFrlUkrdNklONzA5aTLj8HL7kb3VtKrhNLVhlh03pfiH:jT5xH6GGFrlUkP/9lTLj8HL7kbltihNr 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\-hrD ctZ_IvrK7s.gif.ForgiveME 2.61 KB MD5: 427c6703ea65f2f90b79ee2a826d8178
SHA1: 42afe7cbac735ee85c1da4269b41aebcb57270fa
SHA256: b8bed6746283b6ba27f9e921d67aabb0e673c196ff77bcd66f015ff2e45668b4
SSDeep: 48:lZuyZtRlVeFnLkKkw2hFJImEPB4US3Fp7vuNtjwEy7NAku+3MKhKN0pusbATJCrN:iKERiJImoYh+Bjy5npusbATJoN 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.ForgiveME 540.14 KB MD5: 95a78a2faab0c9e91980544fc41456dd
SHA1: b4eb33f75782a1158152e3ccfafed72b3646d024
SHA256: 84ebe7624535b52a6234441a1bb001ff38c238c3b9ee1840eb50aac449734dc5
SSDeep: 12288:+v50BY5rOPEMufJGV+NeRKZGxzpZ6gRQriLz0Hd:+v5YY56PEnhGANepx1ZDRQr9d 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.ForgiveME 3.17 KB MD5: 91368a78b9605d02b10f8b8b756abbb3
SHA1: 0f9937b88192ef79096f2f981605ae8a1ed8b09c
SHA256: c4523de913ae16c20d0f8d9d3e567edb864b2d0911413c29e960628a52460a27
SSDeep: 48:ERnx55Flr+BAtsxsHAqpRoC0Y820YENl/pSReXil8WRw8jpGhDhHM9NAQnAVr1Df:mx3ntACpREUQORNK8bpGLHguQn+f 		False
...
C:\Users\CIiHmnxMn6Ps\Desktop\EB G6qCWqieCGCoHg.ppt.ForgiveME 14.98 KB MD5: 982d9992975a9bc58dd97cd3944dc9da
SHA1: 9639c83601343f147ff12adc448f129da73f1d25
SHA256: 6adfac9e4b0a810f1606ebebc403656d974a33be05c3acb4d37a78cbb81cb765
SSDeep: 384:Ij+eUvVsWexowatEBwKP0tNmNAFjXrjIqAR2hnKbmFi:LeKvwjBwImNmexrjfAAsbmE 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.ForgiveME 3.23 KB MD5: 965ecd8d87b623e9d3e5c0d8fa91db89
SHA1: ee7adb3e8d6feeb9ea604409db0993e35e60a8c4
SHA256: 8c84f2b463ae26e98e15c5b46f93243eb5bc5b692a3d1b1ed3843ef9238919b5
SSDeep: 96:FtHkIpPGvgaWUpAwtn1ectoPAA+pxu+ALgrZb3:FlpPGvvty61TaYAF+xVL 		False
...
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\F227E87A-B6B1-42DD-93D7-CC66C1F69C7E\en-us.16\stream.x64.en-us.man.dat.ForgiveME 0.99 MB MD5: 8403598b02b23453cfdbe4b645962d22
SHA1: 87fc5b5e032ccef48da39828e81aae48a638969b
SHA256: 72afc3a945c02477ba7a3277baee9306e0c6d172cad55c21ce522ac216d106ff
SSDeep: 24576:FNgB4QAmhQPsRH0aSsEy/ZQUWUYSIC70gT40s1OqTHE:sBRtesbsMT4r1OUHE 		False
...
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\EDA58A0B-AD79-496A-8530-618D08767E60\en-us.16\stream.Platform.Culture.man.xml.ForgiveME 2.00 MB MD5: c1ffb6363216778d0521b459d09695ee
SHA1: 3e2a9859bab20c222f9149ad668b0d0ad1666391
SHA256: d49fe1667a697ab7ed420c78ed15a79f94fd5c3b811e70837f4ed7bb2bb15db3
SSDeep: 49152:QvN5Tva+c0LAKNqyHkB+JpukNYv27e7S4LQKYLz9/eHLe:sYuAKEyEB+dGv27uLIP1QLe 		False
...
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.ForgiveME 106.41 KB MD5: fd24f9466566443bcdfb2c43a58e20f1
SHA1: 157702ea0c10a7c4930a545133df8e4c584183c6
SHA256: d2090d04349ed137c43abb56e3feb89db08a48d76557b960e24d9dfc2fc62b91
SSDeep: 1536:HUn52WxGixvrOw2iTr+3s0MnsH1Cm5iewQWuowwlVSKkpTgqRepuv2AcMK7alNWh:HUwadOpD80osV/ZowNpTFRepMc4lEaNA 		False
...
Threads
Thread 0xa70
2506 0
»
Category Operation Information Success Count Logfile
Module Get Handle module_name = shell32.dll, base_address = 0x0 False 1
Fn
Module Load module_name = shell32.dll, base_address = 0x752c0000 True 1
Fn
Window Create - True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\shell32.dll, base_address = 0x752c0000 True 1
Fn
Window Create - True 1
Fn
Module Get Handle module_name = comctl32.dll, base_address = 0x0 False 1
Fn
Module Load module_name = comctl32.dll, base_address = 0x73370000 True 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\comctl32.dll, base_address = 0x73410000 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\user32.dll, base_address = 0x74ad0000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\user32.dll, function = DefWindowProcW, address_out = 0x77a0caa0 True 1
Fn
Module Get Handle module_name = c:\users\ciihmnxmn6ps\desktop\ligma.exe, base_address = 0xf00000 True 2
Fn
Window Create class_name = WindowsForms10.Window.8.app.0.141b42a_r12_ad1, wndproc_parameter = 0 True 1
Fn
Window Set Attribute class_name = WindowsForms10.Window.8.app.0.141b42a_r12_ad1, index = 18446744073709551612, new_long = 2007026336 True 1
Fn
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework, value_name = DbgJITDebugLaunchSetting, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework, value_name = DbgManagedDebugger, type = REG_NONE False 1
Fn
Window Set Attribute class_name = WindowsForms10.Window.8.app.0.141b42a_r12_ad1, index = 18446744073709551612, new_long = 88671902 True 1
Fn
Module Get Handle module_name = c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_49c02355cf03478c\comctl32.dll, base_address = 0x73370000 True 5
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\-hrD ctZ_IvrK7s.gif, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\-hrD ctZ_IvrK7s.gif, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\-hrD ctZ_IvrK7s.gif, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\-hrD ctZ_IvrK7s.gif, size = 4096, size_out = 2663 True 1
Fn
Data
File Get Info filename = C:\Windows\Microsoft.NET\Framework\v4.0.30319\config\machine.config, type = file_attributes True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\-hrD ctZ_IvrK7s.gif.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\-hrD ctZ_IvrK7s.gif.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\-hrD ctZ_IvrK7s.gif.ForgiveME, size = 2672 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\-hrD ctZ_IvrK7s.gif True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\3nApnpXou.rtf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\3nApnpXou.rtf, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\3nApnpXou.rtf, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\3nApnpXou.rtf, size = 23321, size_out = 23321 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\3nApnpXou.rtf.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\3nApnpXou.rtf.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\3nApnpXou.rtf.ForgiveME, size = 23328 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\3nApnpXou.rtf True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\4D-RXRdL_2N.mp3, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\4D-RXRdL_2N.mp3, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\4D-RXRdL_2N.mp3, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\4D-RXRdL_2N.mp3, size = 19811, size_out = 19811 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\4D-RXRdL_2N.mp3.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\4D-RXRdL_2N.mp3.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\4D-RXRdL_2N.mp3.ForgiveME, size = 19824 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\4D-RXRdL_2N.mp3 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\4tl50FkWgJm.bmp, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\4tl50FkWgJm.bmp, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\4tl50FkWgJm.bmp, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\4tl50FkWgJm.bmp, size = 28901, size_out = 28901 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\4tl50FkWgJm.bmp.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\4tl50FkWgJm.bmp.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\4tl50FkWgJm.bmp.ForgiveME, size = 28912 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\4tl50FkWgJm.bmp True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\8DAs79 _K.doc, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\8DAs79 _K.doc, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\8DAs79 _K.doc, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\8DAs79 _K.doc, size = 35717, size_out = 35717 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\8DAs79 _K.doc.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\8DAs79 _K.doc.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\8DAs79 _K.doc.ForgiveME, size = 35728 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\8DAs79 _K.doc True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\CnWmKSFK768cf2Qzf.m4a, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\CnWmKSFK768cf2Qzf.m4a, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\CnWmKSFK768cf2Qzf.m4a, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\CnWmKSFK768cf2Qzf.m4a, size = 35865, size_out = 35865 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\CnWmKSFK768cf2Qzf.m4a.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\CnWmKSFK768cf2Qzf.m4a.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\CnWmKSFK768cf2Qzf.m4a.ForgiveME, size = 35872 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\CnWmKSFK768cf2Qzf.m4a True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\CZiQMWk.avi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\CZiQMWk.avi, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\CZiQMWk.avi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\CZiQMWk.avi, size = 54598, size_out = 54598 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\CZiQMWk.avi.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\CZiQMWk.avi.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\CZiQMWk.avi.ForgiveME, size = 54608 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\CZiQMWk.avi True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\dIzOux_V.png, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\dIzOux_V.png, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\dIzOux_V.png, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\dIzOux_V.png, size = 51520, size_out = 51520 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\dIzOux_V.png.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\dIzOux_V.png.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\dIzOux_V.png.ForgiveME, size = 51536 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\dIzOux_V.png True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\EB G6qCWqieCGCoHg.ppt, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\EB G6qCWqieCGCoHg.ppt, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\EB G6qCWqieCGCoHg.ppt, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\EB G6qCWqieCGCoHg.ppt, size = 15342, size_out = 15342 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\EB G6qCWqieCGCoHg.ppt.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\EB G6qCWqieCGCoHg.ppt.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\EB G6qCWqieCGCoHg.ppt.ForgiveME, size = 15344 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\EB G6qCWqieCGCoHg.ppt True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ED8z5hvaRbfKFmQSj.mp3, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ED8z5hvaRbfKFmQSj.mp3, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ED8z5hvaRbfKFmQSj.mp3, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\ED8z5hvaRbfKFmQSj.mp3, size = 86339, size_out = 86339 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ED8z5hvaRbfKFmQSj.mp3.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ED8z5hvaRbfKFmQSj.mp3.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\ED8z5hvaRbfKFmQSj.mp3.ForgiveME, size = 86352 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\ED8z5hvaRbfKFmQSj.mp3 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\EHha1E7xs59mBr.avi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\EHha1E7xs59mBr.avi, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\EHha1E7xs59mBr.avi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\EHha1E7xs59mBr.avi, size = 100835, size_out = 100835 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\EHha1E7xs59mBr.avi.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\EHha1E7xs59mBr.avi.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\EHha1E7xs59mBr.avi.ForgiveME, size = 100848 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\EHha1E7xs59mBr.avi True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\enSgx.swf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\enSgx.swf, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\enSgx.swf, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\enSgx.swf, size = 31057, size_out = 31057 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\enSgx.swf.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\enSgx.swf.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\enSgx.swf.ForgiveME, size = 31072 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\enSgx.swf True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\FtOvEI.csv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\FtOvEI.csv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\FtOvEI.csv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\FtOvEI.csv, size = 50878, size_out = 50878 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\FtOvEI.csv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\FtOvEI.csv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\FtOvEI.csv.ForgiveME, size = 50880 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\FtOvEI.csv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\Gz3fVmm7.flv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\Gz3fVmm7.flv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\Gz3fVmm7.flv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\Gz3fVmm7.flv, size = 56801, size_out = 56801 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\Gz3fVmm7.flv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\Gz3fVmm7.flv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\Gz3fVmm7.flv.ForgiveME, size = 56816 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\Gz3fVmm7.flv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\h_hQxIcKkK0ptnyAnpx.odp, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\h_hQxIcKkK0ptnyAnpx.odp, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\h_hQxIcKkK0ptnyAnpx.odp, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\h_hQxIcKkK0ptnyAnpx.odp, size = 67010, size_out = 67010 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\h_hQxIcKkK0ptnyAnpx.odp.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\h_hQxIcKkK0ptnyAnpx.odp.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\h_hQxIcKkK0ptnyAnpx.odp.ForgiveME, size = 67024 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\h_hQxIcKkK0ptnyAnpx.odp True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\IoxULA_CkfpP.m4a, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\IoxULA_CkfpP.m4a, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\IoxULA_CkfpP.m4a, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\IoxULA_CkfpP.m4a, size = 18498, size_out = 18498 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\IoxULA_CkfpP.m4a.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\IoxULA_CkfpP.m4a.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\IoxULA_CkfpP.m4a.ForgiveME, size = 18512 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\IoxULA_CkfpP.m4a True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\kSP1cnB2hxU7y.rtf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\kSP1cnB2hxU7y.rtf, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\kSP1cnB2hxU7y.rtf, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\kSP1cnB2hxU7y.rtf, size = 61196, size_out = 61196 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\kSP1cnB2hxU7y.rtf.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\kSP1cnB2hxU7y.rtf.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\kSP1cnB2hxU7y.rtf.ForgiveME, size = 61200 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\kSP1cnB2hxU7y.rtf True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\Ll-GR eAmm.mp4, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\Ll-GR eAmm.mp4, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\Ll-GR eAmm.mp4, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\Ll-GR eAmm.mp4, size = 55724, size_out = 55724 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\Ll-GR eAmm.mp4.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\Ll-GR eAmm.mp4.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\Ll-GR eAmm.mp4.ForgiveME, size = 55728 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\Ll-GR eAmm.mp4 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\MhC1R.jpg, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\MhC1R.jpg, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\MhC1R.jpg, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\MhC1R.jpg, size = 4096, size_out = 1346 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\MhC1R.jpg.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\MhC1R.jpg.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\MhC1R.jpg.ForgiveME, size = 1360 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\MhC1R.jpg True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\qwV3dIWBMjgPTO.flv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\qwV3dIWBMjgPTO.flv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\qwV3dIWBMjgPTO.flv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\qwV3dIWBMjgPTO.flv, size = 58289, size_out = 58289 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\qwV3dIWBMjgPTO.flv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\qwV3dIWBMjgPTO.flv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\qwV3dIWBMjgPTO.flv.ForgiveME, size = 58304 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\qwV3dIWBMjgPTO.flv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\rTh9rihBLxNHPHI.bmp, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\rTh9rihBLxNHPHI.bmp, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\rTh9rihBLxNHPHI.bmp, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\rTh9rihBLxNHPHI.bmp, size = 92412, size_out = 92412 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\rTh9rihBLxNHPHI.bmp.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\rTh9rihBLxNHPHI.bmp.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\rTh9rihBLxNHPHI.bmp.ForgiveME, size = 92416 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\rTh9rihBLxNHPHI.bmp True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\TKL9477z_W6f.png, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\TKL9477z_W6f.png, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\TKL9477z_W6f.png, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\TKL9477z_W6f.png, size = 43844, size_out = 43844 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\TKL9477z_W6f.png.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\TKL9477z_W6f.png.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\TKL9477z_W6f.png.ForgiveME, size = 43856 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\TKL9477z_W6f.png True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\Tydyi381sT.pps, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\Tydyi381sT.pps, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\Tydyi381sT.pps, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\Tydyi381sT.pps, size = 96282, size_out = 96282 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\Tydyi381sT.pps.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\Tydyi381sT.pps.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\Tydyi381sT.pps.ForgiveME, size = 96288 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\Tydyi381sT.pps True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ujVrUJfY.flv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ujVrUJfY.flv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ujVrUJfY.flv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\ujVrUJfY.flv, size = 98610, size_out = 98610 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ujVrUJfY.flv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ujVrUJfY.flv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\ujVrUJfY.flv.ForgiveME, size = 98624 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\ujVrUJfY.flv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ux9WveoSYImE35ldZ SV.xls, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ux9WveoSYImE35ldZ SV.xls, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ux9WveoSYImE35ldZ SV.xls, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\ux9WveoSYImE35ldZ SV.xls, size = 70349, size_out = 70349 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ux9WveoSYImE35ldZ SV.xls.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ux9WveoSYImE35ldZ SV.xls.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\ux9WveoSYImE35ldZ SV.xls.ForgiveME, size = 70352 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\ux9WveoSYImE35ldZ SV.xls True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\WjCsoy9NSK3WEc-jHGV.swf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\WjCsoy9NSK3WEc-jHGV.swf, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\WjCsoy9NSK3WEc-jHGV.swf, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\WjCsoy9NSK3WEc-jHGV.swf, size = 50025, size_out = 50025 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\WjCsoy9NSK3WEc-jHGV.swf.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\WjCsoy9NSK3WEc-jHGV.swf.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\WjCsoy9NSK3WEc-jHGV.swf.ForgiveME, size = 50032 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\WjCsoy9NSK3WEc-jHGV.swf True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\YI3AzfSP2ixzlug.xlsx, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\YI3AzfSP2ixzlug.xlsx, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\YI3AzfSP2ixzlug.xlsx, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\YI3AzfSP2ixzlug.xlsx, size = 31325, size_out = 31325 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\YI3AzfSP2ixzlug.xlsx.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\YI3AzfSP2ixzlug.xlsx.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\YI3AzfSP2ixzlug.xlsx.ForgiveME, size = 31328 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\YI3AzfSP2ixzlug.xlsx True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\0KKG5-_dyLtLLib.png, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\0KKG5-_dyLtLLib.png, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\0KKG5-_dyLtLLib.png, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\0KKG5-_dyLtLLib.png, size = 14082, size_out = 14082 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\0KKG5-_dyLtLLib.png.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\0KKG5-_dyLtLLib.png.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\0KKG5-_dyLtLLib.png.ForgiveME, size = 14096 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\0KKG5-_dyLtLLib.png True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\3OIfE3JyXSDyFI.odt, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\3OIfE3JyXSDyFI.odt, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\3OIfE3JyXSDyFI.odt, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\3OIfE3JyXSDyFI.odt, size = 82158, size_out = 82158 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\3OIfE3JyXSDyFI.odt.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\3OIfE3JyXSDyFI.odt.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\3OIfE3JyXSDyFI.odt.ForgiveME, size = 82160 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\3OIfE3JyXSDyFI.odt True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\a0be8GHMAJr.bmp, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\a0be8GHMAJr.bmp, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\a0be8GHMAJr.bmp, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\a0be8GHMAJr.bmp, size = 89792, size_out = 89792 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\a0be8GHMAJr.bmp.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\a0be8GHMAJr.bmp.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\a0be8GHMAJr.bmp.ForgiveME, size = 89808 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\a0be8GHMAJr.bmp True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\EG0aXcwV-hr.gif, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\EG0aXcwV-hr.gif, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\EG0aXcwV-hr.gif, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\EG0aXcwV-hr.gif, size = 27984, size_out = 27984 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\EG0aXcwV-hr.gif.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\EG0aXcwV-hr.gif.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\EG0aXcwV-hr.gif.ForgiveME, size = 28000 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\EG0aXcwV-hr.gif True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\jcIT590X8g5jj.mkv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\jcIT590X8g5jj.mkv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\jcIT590X8g5jj.mkv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\jcIT590X8g5jj.mkv, size = 34165, size_out = 34165 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\jcIT590X8g5jj.mkv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\jcIT590X8g5jj.mkv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\jcIT590X8g5jj.mkv.ForgiveME, size = 34176 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\jcIT590X8g5jj.mkv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\kTmaVKlwQCa2r.swf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\kTmaVKlwQCa2r.swf, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\kTmaVKlwQCa2r.swf, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\kTmaVKlwQCa2r.swf, size = 89041, size_out = 89041 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\kTmaVKlwQCa2r.swf.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\kTmaVKlwQCa2r.swf.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\kTmaVKlwQCa2r.swf.ForgiveME, size = 89056 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\kTmaVKlwQCa2r.swf True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\LDq5roCjgTApRvRJvB.pps, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\LDq5roCjgTApRvRJvB.pps, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\LDq5roCjgTApRvRJvB.pps, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\LDq5roCjgTApRvRJvB.pps, size = 102273, size_out = 102273 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\LDq5roCjgTApRvRJvB.pps.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\LDq5roCjgTApRvRJvB.pps.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\LDq5roCjgTApRvRJvB.pps.ForgiveME, size = 102288 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\LDq5roCjgTApRvRJvB.pps True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\S3OcoaMO.m4a, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\S3OcoaMO.m4a, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\S3OcoaMO.m4a, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\S3OcoaMO.m4a, size = 21527, size_out = 21527 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\S3OcoaMO.m4a.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\S3OcoaMO.m4a.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\S3OcoaMO.m4a.ForgiveME, size = 21536 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\S3OcoaMO.m4a True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\tLmYU7SeZ.mp3, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\tLmYU7SeZ.mp3, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\tLmYU7SeZ.mp3, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\tLmYU7SeZ.mp3, size = 78202, size_out = 78202 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\tLmYU7SeZ.mp3.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\tLmYU7SeZ.mp3.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\tLmYU7SeZ.mp3.ForgiveME, size = 78208 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\tLmYU7SeZ.mp3 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\yLa77.m4a, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\yLa77.m4a, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\yLa77.m4a, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\yLa77.m4a, size = 8415, size_out = 8415 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\yLa77.m4a.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\yLa77.m4a.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\yLa77.m4a.ForgiveME, size = 8416 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Desktop\ZKZx\yLa77.m4a True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\w4xbjxkK.mp3, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\w4xbjxkK.mp3, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\w4xbjxkK.mp3, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\w4xbjxkK.mp3, size = 59876, size_out = 59876 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\w4xbjxkK.mp3.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\w4xbjxkK.mp3.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\w4xbjxkK.mp3.ForgiveME, size = 59888 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\w4xbjxkK.mp3 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\4xViYgP AP.mp3, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\4xViYgP AP.mp3, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\4xViYgP AP.mp3, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\4xViYgP AP.mp3, size = 6499, size_out = 6499 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\4xViYgP AP.mp3.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\4xViYgP AP.mp3.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\4xViYgP AP.mp3.ForgiveME, size = 6512 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\4xViYgP AP.mp3 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\BlGhpVFW.m4a, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\BlGhpVFW.m4a, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\BlGhpVFW.m4a, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\BlGhpVFW.m4a, size = 79386, size_out = 79386 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\BlGhpVFW.m4a.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\BlGhpVFW.m4a.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\BlGhpVFW.m4a.ForgiveME, size = 79392 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\BlGhpVFW.m4a True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\fYRG.m4a, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\fYRG.m4a, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\fYRG.m4a, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\fYRG.m4a, size = 15256, size_out = 15256 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\fYRG.m4a.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\fYRG.m4a.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\fYRG.m4a.ForgiveME, size = 15264 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\fYRG.m4a True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\G5IptOuLk0Yb.m4a, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\G5IptOuLk0Yb.m4a, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\G5IptOuLk0Yb.m4a, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\G5IptOuLk0Yb.m4a, size = 24600, size_out = 24600 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\G5IptOuLk0Yb.m4a.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\G5IptOuLk0Yb.m4a.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\G5IptOuLk0Yb.m4a.ForgiveME, size = 24608 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\G5IptOuLk0Yb.m4a True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\ggVeB8Y.m4a, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\ggVeB8Y.m4a, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\ggVeB8Y.m4a, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\ggVeB8Y.m4a, size = 10031, size_out = 10031 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\ggVeB8Y.m4a.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\ggVeB8Y.m4a.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\ggVeB8Y.m4a.ForgiveME, size = 10032 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\ggVeB8Y.m4a True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\Gx9alYUWzq.mp3, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\Gx9alYUWzq.mp3, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\Gx9alYUWzq.mp3, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\Gx9alYUWzq.mp3, size = 26141, size_out = 26141 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\Gx9alYUWzq.mp3.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\Gx9alYUWzq.mp3.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\Gx9alYUWzq.mp3.ForgiveME, size = 26144 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\Gx9alYUWzq.mp3 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\gzRkU9mQLTHPoK.mp3, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\gzRkU9mQLTHPoK.mp3, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\gzRkU9mQLTHPoK.mp3, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\gzRkU9mQLTHPoK.mp3, size = 33437, size_out = 33437 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\gzRkU9mQLTHPoK.mp3.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\gzRkU9mQLTHPoK.mp3.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\gzRkU9mQLTHPoK.mp3.ForgiveME, size = 33440 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\gzRkU9mQLTHPoK.mp3 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\k_T 8.m4a, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\k_T 8.m4a, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\k_T 8.m4a, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\k_T 8.m4a, size = 25812, size_out = 25812 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\k_T 8.m4a.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\k_T 8.m4a.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\k_T 8.m4a.ForgiveME, size = 25824 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\k_T 8.m4a True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\oOsJ.mp3, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\oOsJ.mp3, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\oOsJ.mp3, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\oOsJ.mp3, size = 72910, size_out = 72910 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\oOsJ.mp3.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\oOsJ.mp3.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\oOsJ.mp3.ForgiveME, size = 72912 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\oOsJ.mp3 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\QOU0VF.m4a, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\QOU0VF.m4a, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\QOU0VF.m4a, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\QOU0VF.m4a, size = 77661, size_out = 77661 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\QOU0VF.m4a.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\QOU0VF.m4a.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\QOU0VF.m4a.ForgiveME, size = 77664 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\QOU0VF.m4a True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\1gkubuOd.m4a, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\1gkubuOd.m4a, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\1gkubuOd.m4a, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\1gkubuOd.m4a, size = 33045, size_out = 33045 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\1gkubuOd.m4a.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\1gkubuOd.m4a.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\1gkubuOd.m4a.ForgiveME, size = 33056 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\1gkubuOd.m4a True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\niRPdsG WED6kqVJAVlt.m4a, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\niRPdsG WED6kqVJAVlt.m4a, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\niRPdsG WED6kqVJAVlt.m4a, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\niRPdsG WED6kqVJAVlt.m4a, size = 7564, size_out = 7564 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\niRPdsG WED6kqVJAVlt.m4a.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\niRPdsG WED6kqVJAVlt.m4a.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\niRPdsG WED6kqVJAVlt.m4a.ForgiveME, size = 7568 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\bpF3ZZPj\niRPdsG WED6kqVJAVlt.m4a True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\JymdOLTsgEfF6EKJCZf6.mp3, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\JymdOLTsgEfF6EKJCZf6.mp3, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\JymdOLTsgEfF6EKJCZf6.mp3, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\JymdOLTsgEfF6EKJCZf6.mp3, size = 58916, size_out = 58916 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\JymdOLTsgEfF6EKJCZf6.mp3.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\JymdOLTsgEfF6EKJCZf6.mp3.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\JymdOLTsgEfF6EKJCZf6.mp3.ForgiveME, size = 58928 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\JymdOLTsgEfF6EKJCZf6.mp3 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\tTtDXoPeBaEVZd.m4a, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\tTtDXoPeBaEVZd.m4a, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\tTtDXoPeBaEVZd.m4a, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\tTtDXoPeBaEVZd.m4a, size = 89442, size_out = 89442 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\tTtDXoPeBaEVZd.m4a.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\tTtDXoPeBaEVZd.m4a.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\tTtDXoPeBaEVZd.m4a.ForgiveME, size = 89456 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lcn6NPeyQ\tTtDXoPeBaEVZd.m4a True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\-pP6wHj6F9fqzpkS.mp3, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\-pP6wHj6F9fqzpkS.mp3, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\-pP6wHj6F9fqzpkS.mp3, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\-pP6wHj6F9fqzpkS.mp3, size = 59935, size_out = 59935 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\-pP6wHj6F9fqzpkS.mp3.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\-pP6wHj6F9fqzpkS.mp3.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\-pP6wHj6F9fqzpkS.mp3.ForgiveME, size = 59936 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\-pP6wHj6F9fqzpkS.mp3 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\dR7lwIGs0Z.mp3, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\dR7lwIGs0Z.mp3, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\dR7lwIGs0Z.mp3, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\dR7lwIGs0Z.mp3, size = 56674, size_out = 56674 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\dR7lwIGs0Z.mp3.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\dR7lwIGs0Z.mp3.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\dR7lwIGs0Z.mp3.ForgiveME, size = 56688 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\dR7lwIGs0Z.mp3 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\iZK-yr.m4a, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\iZK-yr.m4a, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\iZK-yr.m4a, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\iZK-yr.m4a, size = 86206, size_out = 86206 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\iZK-yr.m4a.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\iZK-yr.m4a.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\iZK-yr.m4a.ForgiveME, size = 86208 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\iZK-yr.m4a True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\RGDQGWbIKXeY0JuzB.m4a, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\RGDQGWbIKXeY0JuzB.m4a, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\RGDQGWbIKXeY0JuzB.m4a, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\RGDQGWbIKXeY0JuzB.m4a, size = 30129, size_out = 30129 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\RGDQGWbIKXeY0JuzB.m4a.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\RGDQGWbIKXeY0JuzB.m4a.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\RGDQGWbIKXeY0JuzB.m4a.ForgiveME, size = 30144 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\RGDQGWbIKXeY0JuzB.m4a True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\YIWVXn.mp3, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\YIWVXn.mp3, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\YIWVXn.mp3, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\YIWVXn.mp3, size = 88674, size_out = 88674 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\YIWVXn.mp3.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\YIWVXn.mp3.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\YIWVXn.mp3.ForgiveME, size = 88688 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Music\-adZkLBC\P1mSoB7ZwTBS ZY\lYS3\PuBzdyEjdowWPHisqLI\m_dE\niX 6-wALvSX9OIsmnHc\YIWVXn.mp3 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\8hj-wT Vmm6RSkDVjsF.gif, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\8hj-wT Vmm6RSkDVjsF.gif, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\8hj-wT Vmm6RSkDVjsF.gif, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\8hj-wT Vmm6RSkDVjsF.gif, size = 79609, size_out = 79609 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\8hj-wT Vmm6RSkDVjsF.gif.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\8hj-wT Vmm6RSkDVjsF.gif.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\8hj-wT Vmm6RSkDVjsF.gif.ForgiveME, size = 79616 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\8hj-wT Vmm6RSkDVjsF.gif True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\8IwuY0yq7.jpg, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\8IwuY0yq7.jpg, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\8IwuY0yq7.jpg, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\8IwuY0yq7.jpg, size = 37984, size_out = 37984 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\8IwuY0yq7.jpg.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\8IwuY0yq7.jpg.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\8IwuY0yq7.jpg.ForgiveME, size = 38000 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\8IwuY0yq7.jpg True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\rfSBEsMiOiNX8geU.bmp, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\rfSBEsMiOiNX8geU.bmp, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\rfSBEsMiOiNX8geU.bmp, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\rfSBEsMiOiNX8geU.bmp, size = 38385, size_out = 38385 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\rfSBEsMiOiNX8geU.bmp.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\rfSBEsMiOiNX8geU.bmp.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\rfSBEsMiOiNX8geU.bmp.ForgiveME, size = 38400 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\rfSBEsMiOiNX8geU.bmp True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\V2XpokArQEslR4XPpUN.jpg, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\V2XpokArQEslR4XPpUN.jpg, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\V2XpokArQEslR4XPpUN.jpg, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\V2XpokArQEslR4XPpUN.jpg, size = 57476, size_out = 57476 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\V2XpokArQEslR4XPpUN.jpg.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\V2XpokArQEslR4XPpUN.jpg.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\V2XpokArQEslR4XPpUN.jpg.ForgiveME, size = 57488 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\V2XpokArQEslR4XPpUN.jpg True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\5KVbuoX6C7I.gif, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\5KVbuoX6C7I.gif, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\5KVbuoX6C7I.gif, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\5KVbuoX6C7I.gif, size = 23930, size_out = 23930 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\5KVbuoX6C7I.gif.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\5KVbuoX6C7I.gif.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\5KVbuoX6C7I.gif.ForgiveME, size = 23936 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\5KVbuoX6C7I.gif True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\a GgqEm.gif, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\a GgqEm.gif, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\a GgqEm.gif, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\a GgqEm.gif, size = 40538, size_out = 40538 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\a GgqEm.gif.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\a GgqEm.gif.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\a GgqEm.gif.ForgiveME, size = 40544 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\a GgqEm.gif True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\Cp5m9ui.png, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\Cp5m9ui.png, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\Cp5m9ui.png, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\Cp5m9ui.png, size = 86574, size_out = 86574 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\Cp5m9ui.png.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\Cp5m9ui.png.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\Cp5m9ui.png.ForgiveME, size = 86576 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\Cp5m9ui.png True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\EfciVDOoFpXajDNdowI.png, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\EfciVDOoFpXajDNdowI.png, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\EfciVDOoFpXajDNdowI.png, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\EfciVDOoFpXajDNdowI.png, size = 68241, size_out = 68241 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\EfciVDOoFpXajDNdowI.png.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\EfciVDOoFpXajDNdowI.png.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\EfciVDOoFpXajDNdowI.png.ForgiveME, size = 68256 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\EfciVDOoFpXajDNdowI.png True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\JYt B5eu2DQSpvUXEbj.jpg, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\JYt B5eu2DQSpvUXEbj.jpg, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\JYt B5eu2DQSpvUXEbj.jpg, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\JYt B5eu2DQSpvUXEbj.jpg, size = 57359, size_out = 57359 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\JYt B5eu2DQSpvUXEbj.jpg.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\JYt B5eu2DQSpvUXEbj.jpg.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\JYt B5eu2DQSpvUXEbj.jpg.ForgiveME, size = 57360 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\JYt B5eu2DQSpvUXEbj.jpg True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\V9ilU.bmp, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\V9ilU.bmp, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\V9ilU.bmp, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\V9ilU.bmp, size = 20579, size_out = 20579 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\V9ilU.bmp.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\V9ilU.bmp.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\V9ilU.bmp.ForgiveME, size = 20592 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\V9ilU.bmp True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\x8sFphIUh2ONQFW.png, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\x8sFphIUh2ONQFW.png, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\x8sFphIUh2ONQFW.png, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\x8sFphIUh2ONQFW.png, size = 93582, size_out = 93582 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\x8sFphIUh2ONQFW.png.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\x8sFphIUh2ONQFW.png.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\x8sFphIUh2ONQFW.png.ForgiveME, size = 93584 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\Dqfv9WDeoOJ1wv7KM\x8sFphIUh2ONQFW.png True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\1GK2iwe7p.jpg, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\1GK2iwe7p.jpg, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\1GK2iwe7p.jpg, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\1GK2iwe7p.jpg, size = 9497, size_out = 9497 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\1GK2iwe7p.jpg.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\1GK2iwe7p.jpg.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\1GK2iwe7p.jpg.ForgiveME, size = 9504 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\1GK2iwe7p.jpg True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\fETx.bmp, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\fETx.bmp, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\fETx.bmp, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\fETx.bmp, size = 34041, size_out = 34041 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\fETx.bmp.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\fETx.bmp.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\fETx.bmp.ForgiveME, size = 34048 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\fETx.bmp True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\lesA3Ej.jpg, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\lesA3Ej.jpg, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\lesA3Ej.jpg, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\lesA3Ej.jpg, size = 9948, size_out = 9948 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\lesA3Ej.jpg.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\lesA3Ej.jpg.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\lesA3Ej.jpg.ForgiveME, size = 9952 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\lesA3Ej.jpg True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\PmRRRaM0.jpg, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\PmRRRaM0.jpg, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\PmRRRaM0.jpg, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\PmRRRaM0.jpg, size = 49771, size_out = 49771 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\PmRRRaM0.jpg.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\PmRRRaM0.jpg.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\PmRRRaM0.jpg.ForgiveME, size = 49776 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\PmRRRaM0.jpg True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\vS5aAlhJ.png, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\vS5aAlhJ.png, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\vS5aAlhJ.png, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\vS5aAlhJ.png, size = 96656, size_out = 96656 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\vS5aAlhJ.png.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\vS5aAlhJ.png.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\vS5aAlhJ.png.ForgiveME, size = 96672 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\vS5aAlhJ.png True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\xr d6XROhOsECFoi.gif, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\xr d6XROhOsECFoi.gif, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\xr d6XROhOsECFoi.gif, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\xr d6XROhOsECFoi.gif, size = 60721, size_out = 60721 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\xr d6XROhOsECFoi.gif.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\xr d6XROhOsECFoi.gif.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\xr d6XROhOsECFoi.gif.ForgiveME, size = 60736 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\xr d6XROhOsECFoi.gif True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\7EZ4GtS3eucc.gif, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\7EZ4GtS3eucc.gif, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\7EZ4GtS3eucc.gif, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\7EZ4GtS3eucc.gif, size = 49881, size_out = 49881 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\7EZ4GtS3eucc.gif.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\7EZ4GtS3eucc.gif.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\7EZ4GtS3eucc.gif.ForgiveME, size = 49888 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\7EZ4GtS3eucc.gif True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\FWIZqvAtIpB.bmp, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\FWIZqvAtIpB.bmp, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\FWIZqvAtIpB.bmp, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\FWIZqvAtIpB.bmp, size = 84673, size_out = 84673 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\FWIZqvAtIpB.bmp.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\FWIZqvAtIpB.bmp.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\FWIZqvAtIpB.bmp.ForgiveME, size = 84688 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\FWIZqvAtIpB.bmp True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\v9-w8Y.gif, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\v9-w8Y.gif, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\v9-w8Y.gif, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\v9-w8Y.gif, size = 77545, size_out = 77545 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\v9-w8Y.gif.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\v9-w8Y.gif.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\v9-w8Y.gif.ForgiveME, size = 77552 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\MWcObuqUT\v9-w8Y.gif True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\0Elckohhrs6BzmQizNDC.gif, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\0Elckohhrs6BzmQizNDC.gif, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\0Elckohhrs6BzmQizNDC.gif, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\0Elckohhrs6BzmQizNDC.gif, size = 4096, size_out = 3551 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\0Elckohhrs6BzmQizNDC.gif.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\0Elckohhrs6BzmQizNDC.gif.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\0Elckohhrs6BzmQizNDC.gif.ForgiveME, size = 3552 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\0Elckohhrs6BzmQizNDC.gif True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\jj7t4P-k.gif, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\jj7t4P-k.gif, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\jj7t4P-k.gif, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\jj7t4P-k.gif, size = 96354, size_out = 96354 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\jj7t4P-k.gif.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\jj7t4P-k.gif.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\jj7t4P-k.gif.ForgiveME, size = 96368 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\jj7t4P-k.gif True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\-eDPrTR\-pO iFu69ZDsH.png, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\-eDPrTR\-pO iFu69ZDsH.png, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\-eDPrTR\-pO iFu69ZDsH.png, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\-eDPrTR\-pO iFu69ZDsH.png, size = 48473, size_out = 48473 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\-eDPrTR\-pO iFu69ZDsH.png.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\-eDPrTR\-pO iFu69ZDsH.png.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\-eDPrTR\-pO iFu69ZDsH.png.ForgiveME, size = 48480 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\-eDPrTR\-pO iFu69ZDsH.png True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\1R-gVDqQyZ-z0tidUvhb.bmp, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\1R-gVDqQyZ-z0tidUvhb.bmp, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\1R-gVDqQyZ-z0tidUvhb.bmp, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\1R-gVDqQyZ-z0tidUvhb.bmp, size = 11224, size_out = 11224 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\1R-gVDqQyZ-z0tidUvhb.bmp.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\1R-gVDqQyZ-z0tidUvhb.bmp.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\1R-gVDqQyZ-z0tidUvhb.bmp.ForgiveME, size = 11232 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\1R-gVDqQyZ-z0tidUvhb.bmp True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\2zm67v1dYDdfQe.png, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\2zm67v1dYDdfQe.png, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\2zm67v1dYDdfQe.png, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\2zm67v1dYDdfQe.png, size = 72910, size_out = 72910 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\2zm67v1dYDdfQe.png.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\2zm67v1dYDdfQe.png.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\2zm67v1dYDdfQe.png.ForgiveME, size = 72912 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\2zm67v1dYDdfQe.png True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\fV9gs2uPtrSIMKeAHGmD.jpg, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\fV9gs2uPtrSIMKeAHGmD.jpg, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\fV9gs2uPtrSIMKeAHGmD.jpg, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\fV9gs2uPtrSIMKeAHGmD.jpg, size = 66197, size_out = 66197 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\fV9gs2uPtrSIMKeAHGmD.jpg.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\fV9gs2uPtrSIMKeAHGmD.jpg.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\fV9gs2uPtrSIMKeAHGmD.jpg.ForgiveME, size = 66208 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\CBFS0 n\fV9gs2uPtrSIMKeAHGmD.jpg True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\KDaf1EJeF5D5 RP5J.png, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\KDaf1EJeF5D5 RP5J.png, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\KDaf1EJeF5D5 RP5J.png, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\KDaf1EJeF5D5 RP5J.png, size = 19004, size_out = 19004 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\KDaf1EJeF5D5 RP5J.png.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\KDaf1EJeF5D5 RP5J.png.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\KDaf1EJeF5D5 RP5J.png.ForgiveME, size = 19008 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\KDaf1EJeF5D5 RP5J.png True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\ppuAT.jpg, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\ppuAT.jpg, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\ppuAT.jpg, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\ppuAT.jpg, size = 86550, size_out = 86550 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\ppuAT.jpg.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\ppuAT.jpg.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\ppuAT.jpg.ForgiveME, size = 86560 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\ppuAT.jpg True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\rkgbPk.gif, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\rkgbPk.gif, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\rkgbPk.gif, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\rkgbPk.gif, size = 22948, size_out = 22948 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\rkgbPk.gif.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\rkgbPk.gif.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\rkgbPk.gif.ForgiveME, size = 22960 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\GM_1JVqNUb\n4vAqC57_uq8d\x4hn7gIQ6aSP\rkgbPk.gif True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\g_IdIecJjIpqXVu1uaF.gif, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\g_IdIecJjIpqXVu1uaF.gif, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\g_IdIecJjIpqXVu1uaF.gif, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\g_IdIecJjIpqXVu1uaF.gif, size = 90327, size_out = 90327 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\g_IdIecJjIpqXVu1uaF.gif.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\g_IdIecJjIpqXVu1uaF.gif.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\g_IdIecJjIpqXVu1uaF.gif.ForgiveME, size = 90336 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\g_IdIecJjIpqXVu1uaF.gif True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\38CkYWeudH.gif, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\38CkYWeudH.gif, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\38CkYWeudH.gif, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\38CkYWeudH.gif, size = 38550, size_out = 38550 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\38CkYWeudH.gif.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\38CkYWeudH.gif.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\38CkYWeudH.gif.ForgiveME, size = 38560 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\38CkYWeudH.gif True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\kqXVmhFl.bmp, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\kqXVmhFl.bmp, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\kqXVmhFl.bmp, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\kqXVmhFl.bmp, size = 18240, size_out = 18240 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\kqXVmhFl.bmp.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\kqXVmhFl.bmp.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\kqXVmhFl.bmp.ForgiveME, size = 18256 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\kqXVmhFl.bmp True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\o gHeJ.jpg, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\o gHeJ.jpg, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\o gHeJ.jpg, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\o gHeJ.jpg, size = 97109, size_out = 97109 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\o gHeJ.jpg.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\o gHeJ.jpg.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\o gHeJ.jpg.ForgiveME, size = 97120 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\QdvKTojjR\a0HFerBH\o gHeJ.jpg True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\gXUk6zGjZyC.jpg, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\gXUk6zGjZyC.jpg, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\gXUk6zGjZyC.jpg, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\gXUk6zGjZyC.jpg, size = 85539, size_out = 85539 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\gXUk6zGjZyC.jpg.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\gXUk6zGjZyC.jpg.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\gXUk6zGjZyC.jpg.ForgiveME, size = 85552 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\gXUk6zGjZyC.jpg True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\K0Oi0qu6JV.jpg, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\K0Oi0qu6JV.jpg, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\K0Oi0qu6JV.jpg, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\K0Oi0qu6JV.jpg, size = 50611, size_out = 50611 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\K0Oi0qu6JV.jpg.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\K0Oi0qu6JV.jpg.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\K0Oi0qu6JV.jpg.ForgiveME, size = 50624 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\K0Oi0qu6JV.jpg True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\nXFYUX1LdFo.gif, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\nXFYUX1LdFo.gif, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\nXFYUX1LdFo.gif, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\nXFYUX1LdFo.gif, size = 66116, size_out = 66116 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\nXFYUX1LdFo.gif.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\nXFYUX1LdFo.gif.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\nXFYUX1LdFo.gif.ForgiveME, size = 66128 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Pictures\xK7lvJG0Smo97YXbi2\nXFYUX1LdFo.gif True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\AAah3NdNBaxj.mp4, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\AAah3NdNBaxj.mp4, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\AAah3NdNBaxj.mp4, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\AAah3NdNBaxj.mp4, size = 79417, size_out = 79417 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\AAah3NdNBaxj.mp4.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\AAah3NdNBaxj.mp4.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\AAah3NdNBaxj.mp4.ForgiveME, size = 79424 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\AAah3NdNBaxj.mp4 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\i70c4 jL.flv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\i70c4 jL.flv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\i70c4 jL.flv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\i70c4 jL.flv, size = 7735, size_out = 7735 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\i70c4 jL.flv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\i70c4 jL.flv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\i70c4 jL.flv.ForgiveME, size = 7744 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\i70c4 jL.flv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\T0bhNVzVYc.mp4, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\T0bhNVzVYc.mp4, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\T0bhNVzVYc.mp4, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\T0bhNVzVYc.mp4, size = 67913, size_out = 67913 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\T0bhNVzVYc.mp4.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\T0bhNVzVYc.mp4.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\T0bhNVzVYc.mp4.ForgiveME, size = 67920 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\T0bhNVzVYc.mp4 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\TetGFUxS.mp4, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\TetGFUxS.mp4, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\TetGFUxS.mp4, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\TetGFUxS.mp4, size = 35179, size_out = 35179 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\TetGFUxS.mp4.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\TetGFUxS.mp4.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\TetGFUxS.mp4.ForgiveME, size = 35184 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\TetGFUxS.mp4 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\x6R9Ff0rW.swf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\x6R9Ff0rW.swf, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\x6R9Ff0rW.swf, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\x6R9Ff0rW.swf, size = 25835, size_out = 25835 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\x6R9Ff0rW.swf.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\x6R9Ff0rW.swf.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\x6R9Ff0rW.swf.ForgiveME, size = 25840 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\x6R9Ff0rW.swf True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\ZsnT4CE2i.swf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\ZsnT4CE2i.swf, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\ZsnT4CE2i.swf, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\ZsnT4CE2i.swf, size = 65609, size_out = 65609 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\ZsnT4CE2i.swf.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\ZsnT4CE2i.swf.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\ZsnT4CE2i.swf.ForgiveME, size = 65616 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\ZsnT4CE2i.swf True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\_Q-erkcMEj49z d2se8u.flv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\_Q-erkcMEj49z d2se8u.flv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\_Q-erkcMEj49z d2se8u.flv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\_Q-erkcMEj49z d2se8u.flv, size = 50653, size_out = 50653 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\_Q-erkcMEj49z d2se8u.flv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\_Q-erkcMEj49z d2se8u.flv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\_Q-erkcMEj49z d2se8u.flv.ForgiveME, size = 50656 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\_Q-erkcMEj49z d2se8u.flv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\-9k1Pp.flv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\-9k1Pp.flv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\-9k1Pp.flv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\-9k1Pp.flv, size = 24645, size_out = 24645 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\-9k1Pp.flv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\-9k1Pp.flv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\-9k1Pp.flv.ForgiveME, size = 24656 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\-9k1Pp.flv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\4tHxHXTTn_.swf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\4tHxHXTTn_.swf, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\4tHxHXTTn_.swf, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\4tHxHXTTn_.swf, size = 89455, size_out = 89455 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\4tHxHXTTn_.swf.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\4tHxHXTTn_.swf.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\4tHxHXTTn_.swf.ForgiveME, size = 89456 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\4tHxHXTTn_.swf True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\atxemqhw.flv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\atxemqhw.flv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\atxemqhw.flv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\atxemqhw.flv, size = 92822, size_out = 92822 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\atxemqhw.flv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\atxemqhw.flv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\atxemqhw.flv.ForgiveME, size = 92832 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\atxemqhw.flv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\aVDOWsEaj8PL.mp4, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\aVDOWsEaj8PL.mp4, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\aVDOWsEaj8PL.mp4, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\aVDOWsEaj8PL.mp4, size = 81477, size_out = 81477 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\aVDOWsEaj8PL.mp4.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\aVDOWsEaj8PL.mp4.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\aVDOWsEaj8PL.mp4.ForgiveME, size = 81488 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\aVDOWsEaj8PL.mp4 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\Dyrf.swf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\Dyrf.swf, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\Dyrf.swf, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\Dyrf.swf, size = 44495, size_out = 44495 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\Dyrf.swf.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\Dyrf.swf.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\Dyrf.swf.ForgiveME, size = 44496 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\Dyrf.swf True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\g8J7qL XZbbi3Xz7Ub.flv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\g8J7qL XZbbi3Xz7Ub.flv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\g8J7qL XZbbi3Xz7Ub.flv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\g8J7qL XZbbi3Xz7Ub.flv, size = 68123, size_out = 68123 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\g8J7qL XZbbi3Xz7Ub.flv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\g8J7qL XZbbi3Xz7Ub.flv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\g8J7qL XZbbi3Xz7Ub.flv.ForgiveME, size = 68128 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\g8J7qL XZbbi3Xz7Ub.flv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\iA9Xe-aPj5db.avi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\iA9Xe-aPj5db.avi, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\iA9Xe-aPj5db.avi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\iA9Xe-aPj5db.avi, size = 80080, size_out = 80080 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\iA9Xe-aPj5db.avi.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\iA9Xe-aPj5db.avi.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\iA9Xe-aPj5db.avi.ForgiveME, size = 80096 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\iA9Xe-aPj5db.avi True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\JJdT3P6bu5i.flv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\JJdT3P6bu5i.flv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\JJdT3P6bu5i.flv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\JJdT3P6bu5i.flv, size = 15508, size_out = 15508 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\JJdT3P6bu5i.flv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\JJdT3P6bu5i.flv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\JJdT3P6bu5i.flv.ForgiveME, size = 15520 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\JJdT3P6bu5i.flv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\ldIDPJKczA_q8p.mkv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\ldIDPJKczA_q8p.mkv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\ldIDPJKczA_q8p.mkv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\ldIDPJKczA_q8p.mkv, size = 90633, size_out = 90633 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\ldIDPJKczA_q8p.mkv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\ldIDPJKczA_q8p.mkv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\ldIDPJKczA_q8p.mkv.ForgiveME, size = 90640 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\ldIDPJKczA_q8p.mkv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\o19yd3KxSY3.flv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\o19yd3KxSY3.flv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\o19yd3KxSY3.flv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\o19yd3KxSY3.flv, size = 4263, size_out = 4263 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\o19yd3KxSY3.flv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\o19yd3KxSY3.flv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\o19yd3KxSY3.flv.ForgiveME, size = 4272 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\o19yd3KxSY3.flv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\4_rAxaFg1.swf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\4_rAxaFg1.swf, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\4_rAxaFg1.swf, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\4_rAxaFg1.swf, size = 81676, size_out = 81676 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\4_rAxaFg1.swf.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\4_rAxaFg1.swf.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\4_rAxaFg1.swf.ForgiveME, size = 81680 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\4_rAxaFg1.swf True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\A5Ar0nVRt__m.mp4, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\A5Ar0nVRt__m.mp4, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\A5Ar0nVRt__m.mp4, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\A5Ar0nVRt__m.mp4, size = 28784, size_out = 28784 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\A5Ar0nVRt__m.mp4.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\A5Ar0nVRt__m.mp4.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\A5Ar0nVRt__m.mp4.ForgiveME, size = 28800 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\A5Ar0nVRt__m.mp4 True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\aCMrQM_63.mkv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\aCMrQM_63.mkv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\aCMrQM_63.mkv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\aCMrQM_63.mkv, size = 39087, size_out = 39087 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\aCMrQM_63.mkv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\aCMrQM_63.mkv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\aCMrQM_63.mkv.ForgiveME, size = 39088 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\aCMrQM_63.mkv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\caJUViiH8J-NNmdDGq.mkv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\caJUViiH8J-NNmdDGq.mkv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\caJUViiH8J-NNmdDGq.mkv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\caJUViiH8J-NNmdDGq.mkv, size = 34281, size_out = 34281 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\caJUViiH8J-NNmdDGq.mkv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\caJUViiH8J-NNmdDGq.mkv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\caJUViiH8J-NNmdDGq.mkv.ForgiveME, size = 34288 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\caJUViiH8J-NNmdDGq.mkv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\F8gFrq6IWg-T.flv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\F8gFrq6IWg-T.flv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\F8gFrq6IWg-T.flv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\F8gFrq6IWg-T.flv, size = 73207, size_out = 73207 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\F8gFrq6IWg-T.flv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\F8gFrq6IWg-T.flv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\F8gFrq6IWg-T.flv.ForgiveME, size = 73216 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\F8gFrq6IWg-T.flv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\IUW6-rLdvTO6DR2.flv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\IUW6-rLdvTO6DR2.flv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\IUW6-rLdvTO6DR2.flv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\IUW6-rLdvTO6DR2.flv, size = 44577, size_out = 44577 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\IUW6-rLdvTO6DR2.flv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\IUW6-rLdvTO6DR2.flv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\IUW6-rLdvTO6DR2.flv.ForgiveME, size = 44592 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\IUW6-rLdvTO6DR2.flv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\KNPt4Gm.flv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\KNPt4Gm.flv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\KNPt4Gm.flv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\KNPt4Gm.flv, size = 24285, size_out = 24285 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\KNPt4Gm.flv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\KNPt4Gm.flv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\KNPt4Gm.flv.ForgiveME, size = 24288 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\KNPt4Gm.flv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\TctoFGOt_9l.flv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\TctoFGOt_9l.flv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\TctoFGOt_9l.flv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\TctoFGOt_9l.flv, size = 11016, size_out = 11016 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\TctoFGOt_9l.flv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\TctoFGOt_9l.flv.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\TctoFGOt_9l.flv.ForgiveME, size = 11024 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\TctoFGOt_9l.flv True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\v zXqlE7_5RW0Ol.swf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\v zXqlE7_5RW0Ol.swf, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\v zXqlE7_5RW0Ol.swf, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\v zXqlE7_5RW0Ol.swf, size = 6971, size_out = 6971 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\v zXqlE7_5RW0Ol.swf.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\v zXqlE7_5RW0Ol.swf.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\v zXqlE7_5RW0Ol.swf.ForgiveME, size = 6976 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\v zXqlE7_5RW0Ol.swf True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\z_9nlp1Ozu.swf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\z_9nlp1Ozu.swf, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\z_9nlp1Ozu.swf, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\z_9nlp1Ozu.swf, size = 34218, size_out = 34218 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\z_9nlp1Ozu.swf.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\z_9nlp1Ozu.swf.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\z_9nlp1Ozu.swf.ForgiveME, size = 34224 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\z_9nlp1Ozu.swf True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\02cYYkEK8IzC.swf, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\02cYYkEK8IzC.swf, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\02cYYkEK8IzC.swf, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\02cYYkEK8IzC.swf, size = 50993, size_out = 50993 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\02cYYkEK8IzC.swf.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\02cYYkEK8IzC.swf.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\02cYYkEK8IzC.swf.ForgiveME, size = 51008 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\02cYYkEK8IzC.swf True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\1_Mbsa5OD.avi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\1_Mbsa5OD.avi, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\1_Mbsa5OD.avi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\1_Mbsa5OD.avi, size = 102384, size_out = 102384 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\1_Mbsa5OD.avi.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\1_Mbsa5OD.avi.ForgiveME, type = file_type True 2
Fn
File Write filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\1_Mbsa5OD.avi.ForgiveME, size = 102400 True 1
Fn
Data
File Delete filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\1_Mbsa5OD.avi True 1
Fn
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\GsWbzkiCj91tplEo.flv, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\GsWbzkiCj91tplEo.flv, type = file_type True 2
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\GsWbzkiCj91tplEo.flv, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\GsWbzkiCj91tplEo.flv, size = 63038, size_out = 63038 True 1
Fn
Data
File Create filename = C:\Users\CIiHmnxMn6Ps\Videos\W_2oE9qXQ-AL\fNkfIsQ9nuirE9UHiz\oWG6Vi 6Ok\GsWbzkiCj91tplEo.flv.ForgiveME, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
For performance reasons, the remaining 1005 entries are omitted.
The remaining entries can be found in glog.xml.
Thread 0xcfc
1 0
»
Category Operation Information Success Count Logfile
System Sleep duration = 1 milliseconds (0.001 seconds) True 1
Fn
Thread 0xd50
32 0
»
Category Operation Information Success Count Logfile
User Lookup Privilege privilege = SeDebugPrivilege, luid = 20 True 1
Fn
System Get Info type = SYSTEM_PROCESS_INFORMATION True 5110
Fn
Thread 0xd4c
5 0
»
Category Operation Information Success Count Logfile
File Create filename = \\.\PhysicalDrive0, desired_access = GENERIC_ALL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Create filename = C:\WinWOW32\mbr.bin, desired_access = GENERIC_READ True 1
Fn
File Get Info filename = C:\WinWOW32\mbr.bin, type = size True 1
Fn
File Read filename = C:\WinWOW32\mbr.bin, size = 512, size_out = 512 True 1
Fn
File Write filename = \\.\PhysicalDrive0, size = 512 True 1
Fn
Thread 0xc8c
33 0
»
Category Operation Information Success Count Logfile
System Get Cursor x_out = 535, y_out = 873 True 1
Fn
System Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
System Get Cursor x_out = 830, y_out = 558 True 1
Fn
System Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
System Get Cursor x_out = 830, y_out = 558 True 1
Fn
System Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
System Get Cursor x_out = 830, y_out = 558 True 1
Fn
System Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
System Get Cursor x_out = 830, y_out = 558 True 1
Fn
System Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
System Get Cursor x_out = 830, y_out = 558 True 1
Fn
System Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
System Get Cursor x_out = 830, y_out = 558 True 1
Fn
System Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
System Get Cursor x_out = 830, y_out = 558 True 1
Fn
System Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
System Get Cursor x_out = 169, y_out = 746 True 1
Fn
System Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
System Get Cursor x_out = 169, y_out = 746 True 1
Fn
System Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
System Get Cursor x_out = 169, y_out = 746 True 1
Fn
System Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
Thread 0x2d0
24 0
»
Category Operation Information Success Count Logfile
System Get Cursor x_out = 169, y_out = 746 True 1
Fn
System Sleep duration = 500 milliseconds (0.500 seconds) True 1
Fn
System Get Cursor x_out = 169, y_out = 746 True 1
Fn
System Sleep duration = 500 milliseconds (0.500 seconds) True 1
Fn
System Get Cursor x_out = 169, y_out = 746 True 1
Fn
System Sleep duration = 500 milliseconds (0.500 seconds) True 1
Fn
System Get Cursor x_out = 169, y_out = 746 True 1
Fn
System Sleep duration = 500 milliseconds (0.500 seconds) True 1
Fn
System Get Cursor x_out = 169, y_out = 746 True 1
Fn
System Sleep duration = 500 milliseconds (0.500 seconds) True 1
Fn
System Get Cursor x_out = 169, y_out = 746 True 1
Fn
System Sleep duration = 500 milliseconds (0.500 seconds) True 1
Fn
System Get Cursor x_out = 169, y_out = 746 True 1
Fn
System Sleep duration = 500 milliseconds (0.500 seconds) True 1
Fn
System Get Cursor x_out = 169, y_out = 746 True 1
Fn
System Sleep duration = 500 milliseconds (0.500 seconds) True 1
Fn
Process #2: cmd.exe
177 0
»
Information Value
ID #2
File Name c:\windows\syswow64\cmd.exe
Command Line C:\Windows\system32\cmd.exe /c ""C:\WinWOW32\\work.bat""
Initial Working Directory C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor Start Time: 00:01:59, Reason: Child Process
Unmonitor End Time: 00:02:25, Reason: Self Terminated
Monitor Duration 00:00:26
OS Process Information
»
Information Value
PID 0xdf4
Parent PID 0x950 (c:\users\ciihmnxmn6ps\desktop\ligma.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x DFC
0x EB0
0x CD4
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x00000000009b0000 0x009b0000 0x009cffff Private Memory rw True False False -
pagefile_0x00000000009b0000 0x009b0000 0x009bffff Pagefile Backed Memory rw True False False -
private_0x00000000009c0000 0x009c0000 0x009c3fff Private Memory rw True False False -
private_0x00000000009d0000 0x009d0000 0x009d1fff Private Memory rw True False False -
private_0x00000000009d0000 0x009d0000 0x009d3fff Private Memory rw True False False -
pagefile_0x00000000009e0000 0x009e0000 0x009f3fff Pagefile Backed Memory r True False False -
private_0x0000000000a00000 0x00a00000 0x00a3ffff Private Memory rw True False False -
private_0x0000000000a40000 0x00a40000 0x00b3ffff Private Memory rw True False False -
pagefile_0x0000000000b40000 0x00b40000 0x00b43fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000b50000 0x00b50000 0x00b50fff Pagefile Backed Memory r True False False -
private_0x0000000000b60000 0x00b60000 0x00b61fff Private Memory rw True False False -
private_0x0000000000b70000 0x00b70000 0x00b7ffff Private Memory rw True False False -
private_0x0000000000ba0000 0x00ba0000 0x00baffff Private Memory rw True False False -
locale.nls 0x00bb0000 0x00c6dfff Memory Mapped File r False False False -
private_0x0000000000c70000 0x00c70000 0x00caffff Private Memory rw True False False -
private_0x0000000000d60000 0x00d60000 0x00e5ffff Private Memory rw True False False -
cmd.exe 0x00e70000 0x00ebffff Memory Mapped File rwx True False False -
pagefile_0x0000000000ec0000 0x00ec0000 0x04ebffff Pagefile Backed Memory - True False False -
private_0x0000000004ec0000 0x04ec0000 0x04fbffff Private Memory rw True False False -
private_0x0000000005070000 0x05070000 0x0507ffff Private Memory rw True False False -
sortdefault.nls 0x05080000 0x053b6fff Memory Mapped File r False False False -
wow64cpu.dll 0x73030000 0x73037fff Memory Mapped File rwx False False False -
wow64.dll 0x73040000 0x7308efff Memory Mapped File rwx False False False -
wow64win.dll 0x73090000 0x73102fff Memory Mapped File rwx False False False -
cmdext.dll 0x73150000 0x73157fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74a30000 0x74a88fff Memory Mapped File rwx False False False -
cryptbase.dll 0x74a90000 0x74a99fff Memory Mapped File rwx False False False -
sspicli.dll 0x74aa0000 0x74abdfff Memory Mapped File rwx False False False -
advapi32.dll 0x74c60000 0x74cdafff Memory Mapped File rwx False False False -
kernelbase.dll 0x74d30000 0x74ea5fff Memory Mapped File rwx False False False -
kernel32.dll 0x75130000 0x7521ffff Memory Mapped File rwx False False False -
sechost.dll 0x770b0000 0x770f2fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772c0000 0x7736bfff Memory Mapped File rwx False False False -
msvcrt.dll 0x778d0000 0x7798dfff Memory Mapped File rwx False False False -
ntdll.dll 0x77990000 0x77b08fff Memory Mapped File rwx False False False -
pagefile_0x000000007eb50000 0x7eb50000 0x7ec4ffff Pagefile Backed Memory r True False False -
pagefile_0x000000007ec50000 0x7ec50000 0x7ec72fff Pagefile Backed Memory r True False False -
private_0x000000007ec76000 0x7ec76000 0x7ec78fff Private Memory rw True False False -
private_0x000000007ec79000 0x7ec79000 0x7ec7bfff Private Memory rw True False False -
private_0x000000007ec7c000 0x7ec7c000 0x7ec7cfff Private Memory rw True False False -
private_0x000000007ec7f000 0x7ec7f000 0x7ec7ffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfaf7a0ffff Private Memory r True False False -
pagefile_0x00007dfaf7a10000 0x7dfaf7a10000 0x7ffaf7a0ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffaf7a10000 0x7ffaf7bd1fff Memory Mapped File rwx False False False -
private_0x00007ffaf7bd2000 0x7ffaf7bd2000 0x7ffffffeffff Private Memory r True False False -
Threads
Thread 0xdfc
177 0
»
Category Operation Information Success Count Logfile
Module Get Handle module_name = c:\windows\syswow64\cmd.exe, base_address = 0xe70000 True 1
Fn
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75130000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75172780 True 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System False 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 3
Fn
File Open filename = STD_INPUT_HANDLE True 2
Fn
Environment Get Environment String - True 2
Fn
Data
Registry Open Key reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 120, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Registry Open Key reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Registry Read Value reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Module Get Filename process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\Windows\SysWOW64\cmd.exe, size = 260 True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PROMPT False 1
Fn
Environment Set Environment String name = PROMPT, value = $P$G True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Get Environment String name = COMSPEC, result_out = C:\Windows\system32\cmd.exe True 1
Fn
Environment Get Environment String name = KEYS False 1
Fn
File Get Info filename = C:\Users\CIiHmnxMn6Ps\Desktop, type = file_attributes True 2
Fn
Environment Set Environment String name = =C:, value = C:\Users\CIiHmnxMn6Ps\Desktop True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Module Get Handle module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75130000 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x7514fa80 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x7514a790 True 1
Fn
Module Get Address module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74e435c0 True 1
Fn
File Get Info filename = "C:\WinWOW32\\work.bat", type = file_attributes False 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
File Create filename = C:\WinWOW32\work.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open - True 2
Fn
File Read size = 8191, size_out = 802 True 1
Fn
Data
File Open - True 1
Fn
File Get Info type = file_type True 1
Fn
File Open - True 1
Fn
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Create filename = C:\WinWOW32\work.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open - True 2
Fn
File Read size = 8191, size_out = 791 True 1
Fn
Data
File Open - True 1
Fn
File Get Info type = file_type True 1
Fn
File Open - True 1
Fn
File Create filename = C:\WinWOW32\work.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open - True 2
Fn
File Get Info type = size True 1
Fn
File Open - True 2
Fn
File Get Info type = file_type True 1
Fn
File Read size = 512, size_out = 512 True 1
Fn
Data
File Open - True 2
Fn
File Get Info type = file_type True 1
Fn
File Read size = 512, size_out = 512 True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Create filename = C:\WinWOW32\work.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open - True 2
Fn
File Read size = 8191, size_out = 771 True 1
Fn
Data
File Open - True 1
Fn
File Get Info type = file_type True 1
Fn
File Open - True 1
Fn
File Get Info filename = cd\, type = file_attributes False 1
Fn
File Get Info filename = C:\, type = file_attributes True 2
Fn
Environment Set Environment String name = =C:, value = C:\ True 1
Fn
Environment Get Environment String - True 1
Fn
Data
File Get Info filename = C:\Windows\System32, type = file_attributes True 2
Fn
Environment Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Environment Get Environment String - True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Create filename = C:\WinWOW32\work.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open - True 2
Fn
File Read size = 8191, size_out = 746 True 1
Fn
Data
File Open - True 1
Fn
File Get Info type = file_type True 1
Fn
File Open - True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Process Create process_name = C:\Windows\System32\takeown.exe, os_pid = 0xb04, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Environment Set Environment String name = COPYCMD True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Set Environment String name = =ExitCode, value = 00000001 True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Set Environment String name = =ExitCodeAscii True 1
Fn
Environment Get Environment String - True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Create filename = C:\WinWOW32\work.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open - True 2
Fn
File Read size = 8191, size_out = 722 True 1
Fn
Data
File Open - True 1
Fn
File Get Info type = file_type True 1
Fn
File Open - True 1
Fn
Environment Get Environment String name = username, result_out = CIiHmnxMn6Ps True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Process Create process_name = C:\Windows\System32\icacls.exe, os_pid = 0x554, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Environment Set Environment String name = COPYCMD True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Set Environment String name = =ExitCode, value = 00000002 True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Set Environment String name = =ExitCodeAscii True 1
Fn
Environment Get Environment String - True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Create filename = C:\WinWOW32\work.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open - True 2
Fn
File Read size = 8191, size_out = 680 True 1
Fn
Data
File Open - True 1
Fn
File Get Info type = file_type True 1
Fn
File Open - True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Process Create process_name = C:\Windows\System32\takeown.exe, os_pid = 0x8d8, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Environment Set Environment String name = COPYCMD True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Set Environment String name = =ExitCode, value = 40010004 True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Environment Set Environment String name = =ExitCodeAscii True 1
Fn
Environment Get Environment String - True 1
Fn
Data
File Open filename = STD_OUTPUT_HANDLE True 2
Fn
File Open filename = STD_INPUT_HANDLE True 1
Fn
File Create filename = C:\WinWOW32\work.bat, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
File Open - True 2
Fn
File Read size = 8191, size_out = 632 True 1
Fn
Data
File Open - True 1
Fn
File Get Info type = file_type True 1
Fn
File Open - True 1
Fn
Environment Get Environment String name = username, result_out = CIiHmnxMn6Ps True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Environment Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ True 1
Fn
Environment Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 1
Fn
Process Create process_name = C:\Windows\System32\icacls.exe, os_pid = 0x444, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Environment Set Environment String name = COPYCMD True 1
Fn
Environment Get Environment String - True 1
Fn
Data
Process #4: takeown.exe
0 0
»
Information Value
ID #4
File Name c:\windows\syswow64\takeown.exe
Command Line takeown /f logonui.exe
Initial Working Directory C:\Windows\System32\
Monitor Start Time: 00:02:05, Reason: Child Process
Unmonitor End Time: 00:02:07, Reason: Self Terminated
Monitor Duration 00:00:02
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xb04
Parent PID 0xdf4 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 92C
0x 388
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000210000 0x00210000 0x0022ffff Private Memory rw True False False -
pagefile_0x0000000000210000 0x00210000 0x0021ffff Pagefile Backed Memory rw True False False -
private_0x0000000000220000 0x00220000 0x00223fff Private Memory rw True False False -
private_0x0000000000230000 0x00230000 0x00231fff Private Memory rw True False False -
takeown.exe.mui 0x00230000 0x00234fff Memory Mapped File r False False False -
pagefile_0x0000000000240000 0x00240000 0x00253fff Pagefile Backed Memory r True False False -
private_0x0000000000260000 0x00260000 0x0029ffff Private Memory rw True False False -
private_0x00000000002a0000 0x002a0000 0x002dffff Private Memory rw True False False -
pagefile_0x00000000002e0000 0x002e0000 0x002e3fff Pagefile Backed Memory r True False False -
pagefile_0x00000000002f0000 0x002f0000 0x002f0fff Pagefile Backed Memory r True False False -
private_0x0000000000300000 0x00300000 0x00301fff Private Memory rw True False False -
private_0x0000000000310000 0x00310000 0x0034ffff Private Memory rw True False False -
private_0x0000000000350000 0x00350000 0x0038ffff Private Memory rw True False False -
private_0x0000000000390000 0x00390000 0x00390fff Private Memory rw True False False -
private_0x00000000003a0000 0x003a0000 0x003a0fff Private Memory rw True False False -
takeown.exe 0x003c0000 0x003cffff Memory Mapped File rwx False False False -
pagefile_0x00000000003d0000 0x003d0000 0x043cffff Pagefile Backed Memory - True False False -
locale.nls 0x043d0000 0x0448dfff Memory Mapped File r False False False -
private_0x00000000044a0000 0x044a0000 0x044affff Private Memory rw True False False -
private_0x00000000045a0000 0x045a0000 0x045affff Private Memory rw True False False -
private_0x00000000045d0000 0x045d0000 0x046cffff Private Memory rw True False False -
pagefile_0x00000000046d0000 0x046d0000 0x04857fff Pagefile Backed Memory r True False False -
pagefile_0x0000000004860000 0x04860000 0x049e0fff Pagefile Backed Memory r True False False -
pagefile_0x00000000049f0000 0x049f0000 0x05deffff Pagefile Backed Memory r True False False -
wow64cpu.dll 0x73030000 0x73037fff Memory Mapped File rwx False False False -
wow64.dll 0x73040000 0x7308efff Memory Mapped File rwx False False False -
wow64win.dll 0x73090000 0x73102fff Memory Mapped File rwx False False False -
version.dll 0x74800000 0x74807fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74a30000 0x74a88fff Memory Mapped File rwx False False False -
cryptbase.dll 0x74a90000 0x74a99fff Memory Mapped File rwx False False False -
sspicli.dll 0x74aa0000 0x74abdfff Memory Mapped File rwx False False False -
user32.dll 0x74ad0000 0x74c0ffff Memory Mapped File rwx False False False -
shlwapi.dll 0x74c10000 0x74c53fff Memory Mapped File rwx False False False -
kernelbase.dll 0x74d30000 0x74ea5fff Memory Mapped File rwx False False False -
combase.dll 0x74f70000 0x75129fff Memory Mapped File rwx False False False -
kernel32.dll 0x75130000 0x7521ffff Memory Mapped File rwx False False False -
imm32.dll 0x75220000 0x7524afff Memory Mapped File rwx False False False -
msctf.dll 0x76da0000 0x76ebffff Memory Mapped File rwx False False False -
sechost.dll 0x770b0000 0x770f2fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772c0000 0x7736bfff Memory Mapped File rwx False False False -
gdi32.dll 0x77370000 0x774bcfff Memory Mapped File rwx False False False -
msvcrt.dll 0x778d0000 0x7798dfff Memory Mapped File rwx False False False -
ntdll.dll 0x77990000 0x77b08fff Memory Mapped File rwx False False False -
pagefile_0x000000007f0c0000 0x7f0c0000 0x7f1bffff Pagefile Backed Memory r True False False -
pagefile_0x000000007f1c0000 0x7f1c0000 0x7f1e2fff Pagefile Backed Memory r True False False -
private_0x000000007f1e4000 0x7f1e4000 0x7f1e4fff Private Memory rw True False False -
private_0x000000007f1e9000 0x7f1e9000 0x7f1ebfff Private Memory rw True False False -
private_0x000000007f1ec000 0x7f1ec000 0x7f1eefff Private Memory rw True False False -
private_0x000000007f1ef000 0x7f1ef000 0x7f1effff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfaf7a0ffff Private Memory r True False False -
pagefile_0x00007dfaf7a10000 0x7dfaf7a10000 0x7ffaf7a0ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffaf7a10000 0x7ffaf7bd1fff Memory Mapped File rwx False False False -
private_0x00007ffaf7bd2000 0x7ffaf7bd2000 0x7ffffffeffff Private Memory r True False False -
Process #5: icacls.exe
0 0
»
Information Value
ID #5
File Name c:\windows\syswow64\icacls.exe
Command Line icacls logonui.exe /granted CIiHmnxMn6Ps:F
Initial Working Directory C:\Windows\System32\
Monitor Start Time: 00:02:06, Reason: Child Process
Unmonitor End Time: 00:02:08, Reason: Self Terminated
Monitor Duration 00:00:02
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x554
Parent PID 0xdf4 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 2C4
0x B34
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000100000 0x00100000 0x0011ffff Private Memory rw True False False -
pagefile_0x0000000000100000 0x00100000 0x0010ffff Pagefile Backed Memory rw True False False -
private_0x0000000000110000 0x00110000 0x00113fff Private Memory rw True False False -
private_0x0000000000120000 0x00120000 0x00121fff Private Memory rw True False False -
pagefile_0x0000000000130000 0x00130000 0x00143fff Pagefile Backed Memory r True False False -
private_0x0000000000150000 0x00150000 0x0018ffff Private Memory rw True False False -
private_0x0000000000190000 0x00190000 0x001cffff Private Memory rw True False False -
pagefile_0x00000000001d0000 0x001d0000 0x001d3fff Pagefile Backed Memory r True False False -
pagefile_0x00000000001e0000 0x001e0000 0x001e0fff Pagefile Backed Memory r True False False -
private_0x00000000001f0000 0x001f0000 0x001f1fff Private Memory rw True False False -
private_0x0000000000200000 0x00200000 0x0023ffff Private Memory rw True False False -
private_0x0000000000240000 0x00240000 0x0027ffff Private Memory rw True False False -
private_0x0000000000280000 0x00280000 0x0028ffff Private Memory rw True False False -
locale.nls 0x00290000 0x0034dfff Memory Mapped File r False False False -
private_0x0000000000380000 0x00380000 0x0038ffff Private Memory rw True False False -
private_0x00000000003c0000 0x003c0000 0x004bffff Private Memory rw True False False -
icacls.exe 0x013d0000 0x013d9fff Memory Mapped File rwx False False False -
pagefile_0x00000000013e0000 0x013e0000 0x053dffff Pagefile Backed Memory - True False False -
wow64cpu.dll 0x73030000 0x73037fff Memory Mapped File rwx False False False -
wow64.dll 0x73040000 0x7308efff Memory Mapped File rwx False False False -
wow64win.dll 0x73090000 0x73102fff Memory Mapped File rwx False False False -
ntmarta.dll 0x73120000 0x73147fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74a30000 0x74a88fff Memory Mapped File rwx False False False -
cryptbase.dll 0x74a90000 0x74a99fff Memory Mapped File rwx False False False -
sspicli.dll 0x74aa0000 0x74abdfff Memory Mapped File rwx False False False -
advapi32.dll 0x74c60000 0x74cdafff Memory Mapped File rwx False False False -
kernelbase.dll 0x74d30000 0x74ea5fff Memory Mapped File rwx False False False -
kernel32.dll 0x75130000 0x7521ffff Memory Mapped File rwx False False False -
sechost.dll 0x770b0000 0x770f2fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772c0000 0x7736bfff Memory Mapped File rwx False False False -
msvcrt.dll 0x778d0000 0x7798dfff Memory Mapped File rwx False False False -
ntdll.dll 0x77990000 0x77b08fff Memory Mapped File rwx False False False -
pagefile_0x000000007e870000 0x7e870000 0x7e96ffff Pagefile Backed Memory r True False False -
pagefile_0x000000007e970000 0x7e970000 0x7e992fff Pagefile Backed Memory r True False False -
private_0x000000007e993000 0x7e993000 0x7e993fff Private Memory rw True False False -
private_0x000000007e999000 0x7e999000 0x7e99bfff Private Memory rw True False False -
private_0x000000007e99c000 0x7e99c000 0x7e99efff Private Memory rw True False False -
private_0x000000007e99f000 0x7e99f000 0x7e99ffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfaf7a0ffff Private Memory r True False False -
pagefile_0x00007dfaf7a10000 0x7dfaf7a10000 0x7ffaf7a0ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffaf7a10000 0x7ffaf7bd1fff Memory Mapped File rwx False False False -
private_0x00007ffaf7bd2000 0x7ffaf7bd2000 0x7ffffffeffff Private Memory r True False False -
Process #6: takeown.exe
0 0
»
Information Value
ID #6
File Name c:\windows\syswow64\takeown.exe
Command Line takeown /f "C:\Windows\System32\en-US" /r /d y
Initial Working Directory C:\Windows\System32\
Monitor Start Time: 00:02:08, Reason: Child Process
Unmonitor End Time: 00:02:24, Reason: Self Terminated
Monitor Duration 00:00:16
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x8d8
Parent PID 0xdf4 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x C10
0x C28
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
takeown.exe 0x003c0000 0x003cffff Memory Mapped File rwx False False False -
pagefile_0x0000000000fe0000 0x00fe0000 0x04fdffff Pagefile Backed Memory - True False False -
private_0x0000000004fe0000 0x04fe0000 0x04ffffff Private Memory rw True False False -
pagefile_0x0000000004fe0000 0x04fe0000 0x04feffff Pagefile Backed Memory rw True False False -
private_0x0000000004ff0000 0x04ff0000 0x04ff3fff Private Memory rw True False False -
private_0x0000000005000000 0x05000000 0x05001fff Private Memory rw True False False -
takeown.exe.mui 0x05000000 0x05004fff Memory Mapped File r False False False -
pagefile_0x0000000005010000 0x05010000 0x05023fff Pagefile Backed Memory r True False False -
private_0x0000000005030000 0x05030000 0x0506ffff Private Memory rw True False False -
private_0x0000000005070000 0x05070000 0x050affff Private Memory rw True False False -
pagefile_0x00000000050b0000 0x050b0000 0x050b3fff Pagefile Backed Memory r True False False -
pagefile_0x00000000050c0000 0x050c0000 0x050c0fff Pagefile Backed Memory r True False False -
private_0x00000000050d0000 0x050d0000 0x050d1fff Private Memory rw True False False -
private_0x00000000050e0000 0x050e0000 0x050effff Private Memory rw True False False -
locale.nls 0x050f0000 0x051adfff Memory Mapped File r False False False -
private_0x00000000051b0000 0x051b0000 0x051effff Private Memory rw True False False -
private_0x00000000051f0000 0x051f0000 0x0522ffff Private Memory rw True False False -
private_0x0000000005230000 0x05230000 0x05230fff Private Memory rw True False False -
private_0x0000000005240000 0x05240000 0x05240fff Private Memory rw True False False -
private_0x0000000005270000 0x05270000 0x0536ffff Private Memory rw True False False -
private_0x00000000054d0000 0x054d0000 0x054dffff Private Memory rw True False False -
pagefile_0x00000000054e0000 0x054e0000 0x05667fff Pagefile Backed Memory r True False False -
pagefile_0x0000000005670000 0x05670000 0x057f0fff Pagefile Backed Memory r True False False -
pagefile_0x0000000005800000 0x05800000 0x06bfffff Pagefile Backed Memory r True False False -
sortdefault.nls 0x06c00000 0x06f36fff Memory Mapped File r False False False -
wow64cpu.dll 0x73030000 0x73037fff Memory Mapped File rwx False False False -
wow64.dll 0x73040000 0x7308efff Memory Mapped File rwx False False False -
wow64win.dll 0x73090000 0x73102fff Memory Mapped File rwx False False False -
ntmarta.dll 0x73120000 0x73147fff Memory Mapped File rwx False False False -
version.dll 0x74800000 0x74807fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74a30000 0x74a88fff Memory Mapped File rwx False False False -
cryptbase.dll 0x74a90000 0x74a99fff Memory Mapped File rwx False False False -
sspicli.dll 0x74aa0000 0x74abdfff Memory Mapped File rwx False False False -
user32.dll 0x74ad0000 0x74c0ffff Memory Mapped File rwx False False False -
shlwapi.dll 0x74c10000 0x74c53fff Memory Mapped File rwx False False False -
advapi32.dll 0x74c60000 0x74cdafff Memory Mapped File rwx False False False -
kernelbase.dll 0x74d30000 0x74ea5fff Memory Mapped File rwx False False False -
combase.dll 0x74f70000 0x75129fff Memory Mapped File rwx False False False -
kernel32.dll 0x75130000 0x7521ffff Memory Mapped File rwx False False False -
imm32.dll 0x75220000 0x7524afff Memory Mapped File rwx False False False -
msctf.dll 0x76da0000 0x76ebffff Memory Mapped File rwx False False False -
sechost.dll 0x770b0000 0x770f2fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772c0000 0x7736bfff Memory Mapped File rwx False False False -
gdi32.dll 0x77370000 0x774bcfff Memory Mapped File rwx False False False -
msvcrt.dll 0x778d0000 0x7798dfff Memory Mapped File rwx False False False -
ntdll.dll 0x77990000 0x77b08fff Memory Mapped File rwx False False False -
pagefile_0x000000007e590000 0x7e590000 0x7e68ffff Pagefile Backed Memory r True False False -
pagefile_0x000000007e690000 0x7e690000 0x7e6b2fff Pagefile Backed Memory r True False False -
private_0x000000007e6b7000 0x7e6b7000 0x7e6b9fff Private Memory rw True False False -
private_0x000000007e6ba000 0x7e6ba000 0x7e6bafff Private Memory rw True False False -
private_0x000000007e6bc000 0x7e6bc000 0x7e6befff Private Memory rw True False False -
private_0x000000007e6bf000 0x7e6bf000 0x7e6bffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfaf7a0ffff Private Memory r True False False -
pagefile_0x00007dfaf7a10000 0x7dfaf7a10000 0x7ffaf7a0ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffaf7a10000 0x7ffaf7bd1fff Memory Mapped File rwx False False False -
private_0x00007ffaf7bd2000 0x7ffaf7bd2000 0x7ffffffeffff Private Memory r True False False -
Process #7: icacls.exe
0 0
»
Information Value
ID #7
File Name c:\windows\syswow64\icacls.exe
Command Line icacls "C:\Windows\System32\en-US" /granted CIiHmnxMn6Ps:F /T /C
Initial Working Directory C:\Windows\System32\
Monitor Start Time: 00:02:24, Reason: Child Process
Unmonitor End Time: 00:02:25, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x444
Parent PID 0xdf4 (c:\windows\syswow64\cmd.exe)
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x D7C
0x 548
0x 534
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000eb0000 0x00eb0000 0x00ecffff Private Memory rw True False False -
pagefile_0x0000000000eb0000 0x00eb0000 0x00ebffff Pagefile Backed Memory rw True False False -
private_0x0000000000ec0000 0x00ec0000 0x00ec3fff Private Memory rw True False False -
private_0x0000000000ed0000 0x00ed0000 0x00ed1fff Private Memory rw True False False -
pagefile_0x0000000000ee0000 0x00ee0000 0x00ef3fff Pagefile Backed Memory r True False False -
private_0x0000000000f00000 0x00f00000 0x00f3ffff Private Memory rw True False False -
private_0x0000000000f40000 0x00f40000 0x00f7ffff Private Memory rw True False False -
pagefile_0x0000000000f80000 0x00f80000 0x00f83fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000f90000 0x00f90000 0x00f90fff Pagefile Backed Memory r True False False -
private_0x0000000000fa0000 0x00fa0000 0x00fa1fff Private Memory rw True False False -
locale.nls 0x00fb0000 0x0106dfff Memory Mapped File r False False False -
private_0x0000000001070000 0x01070000 0x010affff Private Memory rw True False False -
private_0x00000000010b0000 0x010b0000 0x010effff Private Memory rw True False False -
private_0x00000000010f0000 0x010f0000 0x0112ffff Private Memory rw True False False -
private_0x0000000001130000 0x01130000 0x0116ffff Private Memory rw True False False -
private_0x0000000001190000 0x01190000 0x0119ffff Private Memory rw True False False -
private_0x00000000012c0000 0x012c0000 0x013bffff Private Memory rw True False False -
icacls.exe 0x013d0000 0x013d9fff Memory Mapped File rwx False False False -
pagefile_0x00000000013e0000 0x013e0000 0x053dffff Pagefile Backed Memory - True False False -
private_0x0000000005520000 0x05520000 0x0552ffff Private Memory rw True False False -
wow64cpu.dll 0x73030000 0x73037fff Memory Mapped File rwx False False False -
wow64.dll 0x73040000 0x7308efff Memory Mapped File rwx False False False -
wow64win.dll 0x73090000 0x73102fff Memory Mapped File rwx False False False -
ntmarta.dll 0x74a00000 0x74a27fff Memory Mapped File rwx False False False -
bcryptprimitives.dll 0x74a30000 0x74a88fff Memory Mapped File rwx False False False -
cryptbase.dll 0x74a90000 0x74a99fff Memory Mapped File rwx False False False -
sspicli.dll 0x74aa0000 0x74abdfff Memory Mapped File rwx False False False -
advapi32.dll 0x74c60000 0x74cdafff Memory Mapped File rwx False False False -
kernelbase.dll 0x74d30000 0x74ea5fff Memory Mapped File rwx False False False -
kernel32.dll 0x75130000 0x7521ffff Memory Mapped File rwx False False False -
sechost.dll 0x770b0000 0x770f2fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x772c0000 0x7736bfff Memory Mapped File rwx False False False -
msvcrt.dll 0x778d0000 0x7798dfff Memory Mapped File rwx False False False -
ntdll.dll 0x77990000 0x77b08fff Memory Mapped File rwx False False False -
pagefile_0x000000007f160000 0x7f160000 0x7f25ffff Pagefile Backed Memory r True False False -
pagefile_0x000000007f260000 0x7f260000 0x7f282fff Pagefile Backed Memory r True False False -
private_0x000000007f283000 0x7f283000 0x7f285fff Private Memory rw True False False -
private_0x000000007f286000 0x7f286000 0x7f288fff Private Memory rw True False False -
private_0x000000007f289000 0x7f289000 0x7f289fff Private Memory rw True False False -
private_0x000000007f28c000 0x7f28c000 0x7f28cfff Private Memory rw True False False -
private_0x000000007f28d000 0x7f28d000 0x7f28ffff Private Memory rw True False False -
private_0x000000007ffe0000 0x7ffe0000 0x7ffeffff Private Memory r True False False -
private_0x000000007fff0000 0x7fff0000 0x7dfaf7a0ffff Private Memory r True False False -
pagefile_0x00007dfaf7a10000 0x7dfaf7a10000 0x7ffaf7a0ffff Pagefile Backed Memory - True False False -
ntdll.dll 0x7ffaf7a10000 0x7ffaf7bd1fff Memory Mapped File rwx False False False -
private_0x00007ffaf7bd2000 0x7ffaf7bd2000 0x7ffffffeffff Private Memory r True False False -
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image