ph_exec.exe1.exe
Windows Exe (x86-32)
Created at 2019-05-16T08:39:00
Monitored Processes
Behavior Information - Grouped by Category
Process #1: ph_exec.exe1.exe
6907
0
| Information | Value |
|---|---|
| ID | #1 |
| File Name | c:\users\fd1hvy\desktop\ph_exec.exe1.exe |
| Command Line | "C:\Users\FD1HVy\Desktop\ph_exec.exe1.exe" |
| Initial Working Directory | C:\Users\FD1HVy\Desktop\ |
| Monitor | Start Time: 00:00:30, Reason: Analysis Target |
| Unmonitor | End Time: 00:01:07, Reason: Self Terminated |
| Monitor Duration | 00:00:36 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xa9c |
| Parent PID | 0x860 (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
CE0
0x
D64
0x
540
0x
F9C
0x
D78
0x
F5C
0x
CC8
0x
D04
0x
F84
0x
394
0x
E0
0x
E64
0x
2D0
0x
DD8
0x
F14
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| ph_exec.exe1.exe | 0x01080000 | 0x01094FFF | Relevant Image | - | 32-bit | - |
|
|
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| C:\Users\FD1HVy\Desktop\ph_exec.exe1.exe | 69.50 KB |
MD5:
99e04531bf6237e855a1d1de9f2dae1b
SHA1: 46250ec773b4b9a6d99f8f93455f1b5f3ef591fa SHA256: 92552ad15838d6861e2768859ac2c9985e895012504bcf2f1968f8946dfd2429 SSDeep: 1536:YFOPbkyoTwtPto0Rl0DsN9/TCecZfmFA3prqdKYNPcs8QNlt3h3:YYPxAwtPtoe/TCxmm3prqcYSQNH3h3 |
|
|
| \\?\C:\588bce7c90097ed212\1028\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 6.41 KB |
MD5:
ad4ee915869cedb7e85f9992976c7aab
SHA1: eba051e1f2fa1ca989af657bfa3f575c553fd365 SHA256: 06255ecefba9eb4616f07f3cc414831d9c25408f812f8b47467df476d43b2a6f SSDeep: 96:sYdZx7bA58pUYs0RiCXZ6jDgP784QSqZMpSHHq4++kY+0cDoFsi+yqQ+E97krY:sYd7H1js/CIY7s2r10cDoxqRgws |
|
|
| \\?\C:\588bce7c90097ed212\1030\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.49 KB |
MD5:
b394675554262953aedfa59bfacb8efa
SHA1: bef497314a18d8c75656f30d01994e83a2347941 SHA256: 42c45dc126cfa40051d9153f017faf58dadcca32458d66bb319cfe20421fd61e SSDeep: 96:5uDqWjqwdBg9sT9E+xn11GyQ8UrWMilrh:zWjqIg9sTn8yir2rh |
|
|
| \\?\C:\588bce7c90097ed212\1038\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 84.67 KB |
MD5:
17b85e6589f56f14c25a0aae47199196
SHA1: 5de83a418a6edad5fc52d32bbd16a2263c61655d SHA256: b93153f2445916a5f9a07e1f60c3b1a71554bacc5c2a677ab82dfa6d8c4c0091 SSDeep: 1536:6Co8gwki6tow/ggYL5kvYkNm+/a5QK7WSh9crLHCVuknWKH3c53dVIANGNH8pI29:j0i6tH7e5kQkNzDK7WSeLi8knWKH3c5X |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Print.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.36 KB |
MD5:
9c6259217212ef03e0daa162506a423e
SHA1: 75fb47e6d42d478b864887d6499fe90d22a50e16 SHA256: b3138129d247b80fdb97d4ac36f3cbc1482d69c7203cf77fea3e96e98f32305c SSDeep: 24:AIxlZQeRPZl9PFi5qj/IfBFuKOp35gBypS2E3wfLfRCbTvPDKm/KyZcatzHy1U:A8lZNPPpsZfyKOpE2XFGTK6ByOzoU |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Save.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.36 KB |
MD5:
82b2bd00ee766db73f22bab1fa4e987e
SHA1: 6b2cc6c8384ef911aea4c6940c45bb0e0ea8ff46 SHA256: c111b9a4cbf06dc43c9b476f15fd764b9ad0843a9ecec48f87061ae351006d59 SSDeep: 24:fpFd3TnR3SzCxYEDermCBg15+DYfYWTsD/jJk3T4Rvzdmxdpo8CDSatzHy1U:BnTZwCp0geQbojC8t0xLHKSOzoU |
|
|
| \\?\C:\588bce7c90097ed212\ParameterInfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 265.92 KB |
MD5:
bc36ea3c6678ee6258e0b4fdff05737f
SHA1: adb89031e20f6baf7019bdead2c1663d021d1a68 SHA256: a5bef0b85a48105ccaf86e5d64b74c943de3866b01ba4e47437e912ac64da828 SSDeep: 6144:gg640/hlRxUdGE3bhPvKE5LtUGjqL/+alQyg993mNMNbIlBwxE:B6pZvxmGy1hCog/U2GNbEr |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 8.63 KB |
MD5:
0329d736703ac0c22b8caffad89436a3
SHA1: 14dbc14eaac52241a772e7aab081439fafcb0691 SHA256: a78329b18c2820f9add2e6b6fcc44589255edf98227ba8fad8c50d41df896b53 SSDeep: 192:krmakialtxG+d/GgkU61QtFaCZ7cyMwnlFpV4XSCS04:OmakiaJG+XFaijxX04 |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 434 bytes |
MD5:
9ba847751037d682bc0ab9db248e119f
SHA1: faec322ce8c98d07ddca8ed9e2351712022db24c SHA256: 2bf4b5353606e8fe9ca4088fa80b1c2d0c97982c65ab54e06d65bc41c02e8730 SSDeep: 12:kVkk59LR5P7jUFvVLSF7xi4lsOpVrz0T/8Ln:k79b70vVLgNi4lbrzi8L |
|
|
| \\?\C:\588bce7c90097ed212\RGB9Rast_x86.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 92.77 KB |
MD5:
5c9a35eb82896d09817fc58ce3c7f063
SHA1: d4ff5e66b48c11f5d9786481fa3dab949dbcd85b SHA256: 767ce6e74c686a7fecc9d67118806184610d21dc43419eecd786d65e1ad6d3ec SSDeep: 1536:MrVf9Dsrtl4JFJdpm47qslZnGh38fu52Zs6HGt7O1sgl8rM19Ivw3RR7+9obHuF7:MrTDEtCFJdpm4ax8G2s667xHKWaZHCXL |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 7.30 KB |
MD5:
bde056e111590104cd2a5ccf5280419a
SHA1: 3c8ef1db6b2d78ce7fa12cbcf3b949f936b0d414 SHA256: 641cd2d1231fdbba20d792b4523b57ea6223c872191cbe47706eea59a1b39076 SSDeep: 96:g3XmSY0s5Zr/9cwpjzt3wKA3VZSE9d8Yl5AEoCgrNFFJxsrbd77DLw9XvnGiN0CV:cmSY02lHp/mXdZliPpZRGrRD+N04qm |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 15.19 KB |
MD5:
4ac0e1c7a8d745637753c418a0947212
SHA1: 45a4e2a97bb2f2fe81495c808b5563bac195e7d5 SHA256: a049d9955bd52c378538ef26e4206b530e2bd1bc519703a14cca2d7b97744f89 SSDeep: 384:+vjEo/gOnbkaI3V/U6/bZ1dBVpxqDjVaiBZ:qEOFIl/L/bZhujVVBZ |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.44 KB |
MD5:
f8716207ae30c1c51b9a058c3d430c68
SHA1: 51c459a8d2042cd91dac7b28476fe532d49ec039 SHA256: ed68d564afc7234d5ee2ff3d3d916cb24c7fb78da8d438eaf78301ec8876df70 SSDeep: 96:b7K0Np+1EdsZdQkc32LWnGrP7SmDrAuBlz9qnhGslqALIRLyRRTTaNF2Ke8vgXXE:b7n+1EmZq/mEGrP7SorjzYnrA5IRTAcO |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.74 KB |
MD5:
44017da4e0374974a6ffce689f0d671f
SHA1: df2b329638f480dc53032b802fd5ae33d1d62aab SHA256: 464e68b93b4ec95a97d606b31a688c6934950328b60ce7785338fd4cb427e7f9 SSDeep: 48:kpQ4VJvYIY4j/cFOdUNvDKycNpvTZnMZJVpKFx8ri0NHc63rhh4:gnBY4jUOdUNvlcnTZneon8NH93rc |
|
|
| \\?\C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
0246d1c20a7b12238269a65a2d7a97cc
SHA1: 39adb7f2ee030f36aa01f19bfa1f91a28957fcae SHA256: 7df7b8c4689d6c2f1442cd6ad1d1cf6c85666560d917f11d5c426b6d9215b019 SSDeep: 1536:sK5bJhg1N8jnVwsezWbQgeDJz6zNrfL6O4jeySYink3pj:vhvg12jn+sezWbQkzNrfUCKph |
|
|
| \\?\C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.00 MB |
MD5:
9ac4f47f6936cbb4a7c465b2c103c596
SHA1: 8ceb713a9cf952759755603a591657e94688c18a SHA256: 29615637a5f9f528b1f0f978dba950aad81dd3574f411e4ffd16b1909edb9576 SSDeep: 24576:z7r754QRxXu7uoVJWPdcxuqCvjvx8oYH5Zw2NVBIx:z7fXxXPpFRjZ8hHDNVB2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.55 KB |
MD5:
656b2746a7696ffa6aab8787b12f8a57
SHA1: be83bb3904c7c5d63add76a7599f686d57003dc4 SHA256: 4df45f7675b19821596f1fef3e45a232789c8e67d24bf698aea235325b990c3b SSDeep: 96:nIAsUrCsSKeXa2jwoR6pwEKZyyvkaXuIn4oSJVh8njCRf:IAzC9tDer2yysyZ4O2Rf |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
3937a0960104f32806ed11e0c9c5b2ca
SHA1: 2d567b2a6149b68dd01131344ccf0749c16e515d SHA256: a51be4404beddc33e0203adb8c7f04d4a1810262d1076a8671cda2c4cbccc6e5 SSDeep: 48:iaFpgewpGSVqx5qZ+IksikrN/Azak7JiD4:bpgFISw4ksiiN/dpM |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.80 KB |
MD5:
8d44928cc97f22e518a122846b5deca4
SHA1: cc98e3aa5c1cc4683ed5e940822c1cf2d562d7f5 SHA256: 6af0f28253f84da5c5fb02c51c3794b1c7fbc5d09b607b31dab8a4218fb69e75 SSDeep: 48:OudkJhtCcm6929OabJ/MjEInd4xUYP6SdbY+sof4:hdeLCuobtEEIPYP6ssow |
|
|
| \\?\C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
c77fbe8261f4b8d4549532c18af8c983
SHA1: a72320036a7faeeb21594f0490714b20ba1a4365 SHA256: b49bdb6fc07e3eba36179267cbcbdb307d4b91b6a98beae2c95aaed61d694af0 SSDeep: 1536:hSSzfvxcKc8IjJEoS0XMF+mN5hgA8ige5MBbZr:6KZIjHNA1v18/e56dr |
|
|
| \\?\C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 41.97 KB |
MD5:
db5232d2f4e70ea657f6acfa006ebda4
SHA1: 615ff1dfd6eb1124fe4ec1d4fbe2b160e4114c95 SHA256: b851033a4b6df8171860806c2331f77477c8296a69588da455cd1b955d1e820a SSDeep: 768:2AqOeR2YqO5MWIYE7tNxV/xQSqYMHl/OBaqioGsRnnr6CvaOezGQhxB8RM:2NOeRblIYEZH4SfulWBaqcSnnX2Ki |
|
|
| \\?\C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 6.16 KB |
MD5:
359094ee30f4735364c0cbc5770641f2
SHA1: a4135f7e37597d91b545b5ece91e870783d764b1 SHA256: 2c239dc199034e146f867ac0e61662d46d06d5956946a2474e2c2a815752b836 SSDeep: 192:syJfHKGS78cxoGo/3GoFw79C3zV/3CwyFkLO2Cvy2GL:bfqX7vxdE3PUC3pyp2q+ |
|
|
| \\?\C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 418 bytes |
MD5:
cd6a68e9befa09295be4aca3d80f88e7
SHA1: 0caab6ec3a1cedc6322d534c7a0708546bc8894b SHA256: 7585e5783b0afb7df9b04a2a61171797d2d159f55ac2ca07424baa4d5946f745 SSDeep: 6:INytlZl/23dej553P/AMkeysnuY+2gnEa1QExwxiPa/7h0i1C5axJgHZh6MVrzJX:I8tlne3ct5uogn/jy0RKSpVrz0T/8Ln |
|
|
| \\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 386 bytes |
MD5:
495c5e510f0c0298f5d25792a91ece48
SHA1: 9638276e6259e820aabef88e8502d3b62ca64e23 SHA256: e2770c905bbb9568900144f56af0eb09eec73071ebdd74094601484c0208cedc SSDeep: 6:dY37blxdtvBHpg2tgsUVPi26DT14Sme0DllMe3axJgHZh6MVrzJ2NZ/XGUn:M7dtpeUUAdjmNDllPbpVrz0T/2Un |
|
|
| \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 386 bytes |
MD5:
c78ffb235bdde3b208a5cdac9f370efa
SHA1: e3302aa099719696daf42a9d2518cfe15770f8df SHA256: 16d410983725669690e0a6858c604dc927b9990564dd3f44a858b9e4e584f120 SSDeep: 6:1pRF3McxU6RM3IFLwAuhuVMm2ghzebGs0CJ1lSaxJgHZh6MVrzJ2NZ/XGUn:1pTVCqM3IFEliJYGs5J1lCpVrz0T/2Un |
|
|
| \\?\C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 140.96 KB |
MD5:
e8015b22edceb9177746ba5b13a01f3f
SHA1: 412168a77c122a2181eda6576fc9ded3bd735fa4 SHA256: 705551cecc83407df29250200cb1aa3d153f7b467de6d846460099a3841164e5 SSDeep: 3072:KncmangHE0WzE1/p+h/m5EbuKmFCl7uvNE7qHP+/xw:KnAH0C6ouSENEwuK |
|
|
| \\?\C:\$GetCurrent\SafeOS\preoobe.cmd.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 322 bytes |
MD5:
d3cc503154b88ad331c23198a40ed875
SHA1: 30a287d23f85aeae2ca431f0c38b9e345d3bf529 SHA256: 8d7730d62db28450f4548135bd1432ed3677917ad8f75bebf01472d5c301384d SSDeep: 6:jucwWlucvOjb9GarBel2USJDemIRwsyUG5S1iDae0LkuaH0aRalDskE35Hd/vM1U:qAaGarBelNMemIRPYydnaUaiwksHxM1U |
|
|
| \\?\C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 866 bytes |
MD5:
4ff893818d49c6eff2a919d3da4a2788
SHA1: e04bfa142f4fbd7bc8a2c2786446affa370be51d SHA256: dfae582c274b283eb012e6b69756cf78c4c76a8fec4524426816752b75820e5c SSDeep: 24:NTqYwFfujbvKTym82Ni8KbccH2GIeNiatzHy15:4YwFKhh2Ni8NlGIQiOzo5 |
|
|
| \\?\C:\588bce7c90097ed212\1025\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 7.63 KB |
MD5:
88997f329001bdd2d1d08011f2b87723
SHA1: 8db33b435b3c70f3fa678eecb544faf0bcac57af SHA256: 3e2a8beb64f90db63c14ee849f3c5fdc32fef02194a7dc6959cd84ef692add43 SSDeep: 192:gbI7P83I5FhVQBwcqInjSTteZrGfbjAJYe8:gM7E3I5FDQycDn4eZrGfXT |
|
|
| \\?\C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 322 bytes |
MD5:
cde662e2d05a3eb0fef3dbfb3ac39225
SHA1: aa71d0dc254253c6897142414b78e255070d1ff6 SHA256: 330631845eeb8fbb70ff047489fb3bd617940e04c0ed004ade1f554db86ea5ce SSDeep: 6:OCWkc36J4faDbE0CJE2NJoYfiSaxJgHZh6MVrzJ2NZ/T3Un:OBd6ponE24YiCpVrz0T/Tkn |
|
|
| \\?\C:\588bce7c90097ed212\1028\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 59.66 KB |
MD5:
6cff687c99ff74218cd884438cd41d52
SHA1: 2c9600627f50e6df06dfa154fe0fc726da3d89d3 SHA256: 8c86dfccedf399855b27185149f4bd0c6933b14d977e61556fef6c4e7b45638d SSDeep: 768:RNd2KmVfV6/6p6n2mHERW/TyyNSH5oEcATot9r6niWXrs395B9T51rWfb8JTDGql:RNyW/J2BWLP4H5F/TEBxbTJB |
|
|
| \\?\C:\588bce7c90097ed212\1029\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.88 KB |
MD5:
22bc021fbb154d04b2ff4a4c25be0536
SHA1: 7915c7a2f61f23bc51597df88a9089497e061ce5 SHA256: ea66b8b0000779d85eabe424c1393827280a383d15448819da5d744615aded59 SSDeep: 96:eRTAJTYNlcXsV/IwSmwdirWnRu+SkAcYnMrRegci:afCXiSWrW1SVfAVF |
|
|
| \\?\C:\588bce7c90097ed212\1025\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 17.10 KB |
MD5:
031dd1d3397f6ff5585105136ca76b06
SHA1: 08995de05a01fc83213df4498bbb788f8e5ed7ce SHA256: cd03a4f27e520e7401a5e63c8f123a0763e404f7f34071f7a597f49097539a09 SSDeep: 384:WRNQA9hQVQbp5FcJmoBIAojDUXoGsy8UNA6G5mV8JE:CQA9KV+5Xj4Xgyhu6cmVYE |
|
|
| \\?\C:\588bce7c90097ed212\1029\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 79.33 KB |
MD5:
d46f1eba0649711faa2202882f57f5da
SHA1: 918ea28cff858ce751fe307e515ceca2565c1f98 SHA256: 24b87eccb4afa35bd78bba13f12aae30b20c3c1a6af2f3eec082ba0873cb13b3 SSDeep: 1536:GNOVFR6000ESrEIUFm+CxUihnjsm3i/5vbnBBLY68MwwrTVY5veMNVDV:GNsFRF00ESrE1fCxUIjn3i/5vbBJjTuH |
|
|
| \\?\C:\588bce7c90097ed212\1028\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 14.10 KB |
MD5:
82d8f3c3736670479c130338094c809d
SHA1: 7408db74737739747a55402ae4f89547b915124e SHA256: d1e9a9e5714de13744d04970c9d7cf75f6dc7b245f7cb7f733efa2c0213f310a SSDeep: 384:nfT8YmXzKJQi13I9yAovhUmHN+JdiUdv26bXTIrXhud:fIJjK+i1Y9yrAJLbXWwd |
|
|
| \\?\C:\588bce7c90097ed212\1029\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.10 KB |
MD5:
3579a513cc047ed415e9a4ed8fe2c80b
SHA1: a253eed2c3c861848dc8e570b07ec573a5778672 SHA256: f36fdbdafad41a30119aac03c47d17318a4faebffc9920fb4d7d8d74885c165a SSDeep: 384:8YY1OsV9EuTbctb/enC8eSglGK6h8WSNqV9ZmR0bVl:F4j/ctb/OBeSYvGtSNqtA0bVl |
|
|
| \\?\C:\588bce7c90097ed212\1030\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.10 KB |
MD5:
80f99bf4ae75fd138bc66e041629a7dc
SHA1: 530830c23595d66c298460a4fa292de2b55be888 SHA256: 0dffcae69898660cc4a0e4df257a62a24fc80e108a55fcd8f8660a64c5556d57 SSDeep: 384:RQ1HfU30ruV0WNJTbi/Dh2QMM73Q3vJNPhHLpXvRM:RQ1/UEryOh2Q73QfJNPby |
|
|
| \\?\C:\588bce7c90097ed212\1031\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.60 KB |
MD5:
b9c67b65c4013e3542f98810cb9dc8e0
SHA1: 49ca329daa02599e378a0aea7c3785721eaa9ac8 SHA256: a2a2f5d364f9766f1c274f4c85760d6560850077b5c9152d41d423884a89a373 SSDeep: 384:MkZIthU7th8wvcKybqhnrvKmli0zz/5PchUYQ2WrlRW1yU0fY9kPNgLin4hWE:MkWthCtf2bCnrCmocPctbWBY0mkP+ca |
|
|
| \\?\C:\588bce7c90097ed212\1025\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 72.74 KB |
MD5:
27517b49db1c3006898872111c95d86b
SHA1: c585326c52ef8efa3b68101473d21030682e4f75 SHA256: 51474256267d9f0a9baa6c737192508042d00f01e8742083ece8539e1267782e SSDeep: 1536:Nqm0sxlFpwMe88ft5ltQjDzYVz3XQh25tgr5WOJ1+BRQdf:Nb0yl68ur6Q6m6roxvQ9 |
|
|
| \\?\C:\588bce7c90097ed212\1032\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 19.10 KB |
MD5:
1b66bbffb86773fd8ed317c60e60162c
SHA1: 7d2a08e5b3a801f748bc002be07bdcc9aebc349e SHA256: 3e501043b7e7f55bf8714ee88997727ab1c2c0250a699634ffd752c572440260 SSDeep: 384:RNjt7QgIp2ZvAy4/sYmjXJth0xf7jSdjyRiH9qC2BkM/jAV:btNFH950xf76wW9qPBkM/jC |
|
|
| \\?\C:\588bce7c90097ed212\1030\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 76.19 KB |
MD5:
3ef290df21770108fa46d7c973ca41e2
SHA1: 33c77b17f6ff87cebf569e0d5063c6e33e677bbd SHA256: 72bf7c281fae39dc15116c130ae18529d5714f0fdec4bccb8b888f58deb7faee SSDeep: 1536:hTnxVyRXrrMM/dC/EZThcFGqWJNgDk3K7IZ2B4Z51Z0ZgHUW:hTxmXHMMFC/AFc8dsk3KzB4L1Z0Zg0W |
|
|
| \\?\C:\588bce7c90097ed212\1031\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.58 KB |
MD5:
1f45151b47d5cf70db27464ba6f61078
SHA1: 59a29c5b55f482a8f2e02cba9e14a248a6e04d93 SHA256: 1aa00adc93ef5f6940bcd09d2972110f98f9340c80cf1608e9397f5c1203f31b SSDeep: 48:UzIvOvLZ4gX4bIrx4jtKhL4xG4L8JMtYhqs8dgEL4sQ32T6rcag0HGmC4xOvZOCC:UzImjvSaLSTTtYGS3Zca2cOvZZC |
|
|
| \\?\C:\$GetCurrent\SafeOS\SetupComplete.cmd.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 578 bytes |
MD5:
39fa3e5b25e9cb6c33d1373fd40fc35e
SHA1: 446fc03ee5d2de0e6b70d753d7ca8034ff37cebf SHA256: 7adf2d0ba3447685a97bf234af768ebf7cb9723a86eda44736e345a8e9b4ece0 SSDeep: 12:BisBEpZoZfkGqMALqs53lw+kd/yX/K8eRENeIAqdnaUaiwksHxM1Jn:UsBUZKfk5MEqs8+liaeGatzHy1J |
|
|
| \\?\C:\588bce7c90097ed212\1035\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.10 KB |
MD5:
f069f72adb57ece890c37f9a239060bb
SHA1: 7e5f4b2cffc2347d8393f043e96483b97194497c SHA256: c2d880f4f91276e9dd011acec4f51beb40757126735fcbb91cbc8c5fcd49e216 SSDeep: 384:hEUvqmIVOm1qtKkg6+3eU0h/SEiwaTbvXvbRLC0WKnDbge:TqhVm86+3VM9iwaTbnbRLz1Xge |
|
|
| \\?\C:\588bce7c90097ed212\1036\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.60 KB |
MD5:
78656b5161ae0121d4393d0daec60480
SHA1: bdb7dc54186e2378a0fedfdc3f8efe3f6d7897b4 SHA256: 4826672f6b4841e6e4d3968008823bd5865557c81b156953a2750a01715aa3ea SSDeep: 384:rXs7hqjO1ocSy0iadir01NHoUxwJYh/5KFF/w/GF:rXs7gy0iiiQPPxwJYHKL/x |
|
|
| \\?\C:\588bce7c90097ed212\1032\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 8.91 KB |
MD5:
7c357332228533ca88b13fbdd2476d39
SHA1: a48afae8ceaaa14c465a3f2a565c81da7eaf4437 SHA256: 0f5fa56daf615ed6a6ad1a66a952336c3262cee233d9b9bedaeea6bb4cea5567 SSDeep: 192:ThoOZWAXASvVBS7w+SCKtTv8Fr3CNicF5HKJ9fEsJuq1I5hrI9zE0:T3QYASvVBS79+AZcFRK+qGrrIzh |
|
|
| \\?\C:\588bce7c90097ed212\1032\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 84.52 KB |
MD5:
419838e7ad42fac466a63aee8091efaa
SHA1: f3afab0844b09567c6411f752c98da23198db329 SHA256: cd490850b79799a3635218e1b9e25ae03404995c8b91f1c342ecc2b7bcc7d45c SSDeep: 1536:sxFYTWVDTnl4ba5JLctZpO2YZnukBFNo2agMsUG86jg3MUBE8XbGcGZv3sc:sFDhnlzjL684un3MpMUqEg5 |
|
|
| \\?\C:\588bce7c90097ed212\1033\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.36 KB |
MD5:
66c878dc2f6bedf12c6b3dc1fd9930b3
SHA1: ebe010a5aa3b7f9660dd18448fa7aa06edea27d5 SHA256: 4f18911865cd6c57442e517b405abb6418bdd048debf02ec903549b9b0de20e3 SSDeep: 96:JRYm/WZFJvaj/OrRLMP0XfwWMwVg3i58pvVaQDAHV0r/V:Um/WNCj/2u4w+fmUKV |
|
|
| \\?\C:\588bce7c90097ed212\1033\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 75.69 KB |
MD5:
67414387a028656ca187ca33f055f069
SHA1: b8d4c4411ba13e51e032ffb6e93e9666e29ee6fa SHA256: 47c29f173fd36574beb74071588504dc141f44cc7fae195d501fd09c82bdb649 SSDeep: 1536:EYrX1/jBqfOu9G5Kw9tD0go+rXkRy0bkGJ4wYG8y0c3h9C2in1Z4qidXjS0:EyJjB6O0G5hjDBo865iRk3h9C2in0 |
|
|
| \\?\C:\588bce7c90097ed212\1033\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 17.10 KB |
MD5:
4a982ea0e41b27a5b3cd47ea1f476f33
SHA1: 3fc8c2b4b68672c31d004454fad7e2895490864a SHA256: 99cd416391dc421b287cb2b2d4af8b5f6e2dfd2e444ecf5efb35f540a923165f SSDeep: 384:DBDVqLjUR1nU1zgIdPfTp2o56gKAB2Lg39UpTO/+JGsMX44l:DBDVWYznYg61cAEp5JGrXFl |
|
|
| \\?\C:\588bce7c90097ed212\1031\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 80.67 KB |
MD5:
63aea7ed9f43340e221ab5f50866ddee
SHA1: 69bb00e01d3baef3eb27f1dbd28918e344e2a512 SHA256: 55ee6a8cb07e1ab5f89f5ae70c146701b79fb3671d4a4f0f3f19ad03f54c3a70 SSDeep: 1536:Qv/fRNJlzyPBAmoEWZ2qHDiXywGuM69jVxq4lpLMrbMypxq+74vZPUo:Q3JxyPBAmoEE+7Gy9pQeLUwypxqa4mo |
|
|
| \\?\C:\588bce7c90097ed212\1035\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 75.47 KB |
MD5:
ec68fdb0321306f516978c4868e6df3f
SHA1: cc2020316f63e33c1eebf220f586d4e46b01278d SHA256: 1bd9d793fd371d808b96efc506bbf0bd5df82a89ca2359e4d700e6d3bd292d7c SSDeep: 1536:knnT1qh19amUALB7hPK2kxDfyFIV4d5cZWgBwJ6z/ih+:SneDahWPbkx+IGd5cZjKJU |
|
|
| \\?\C:\588bce7c90097ed212\1038\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.60 KB |
MD5:
b1dbc514e3fa6f02c92c2e3278aec3e6
SHA1: 13dcd0765444004f54333e79b791413b1a1f498d SHA256: 9c6959f2cd75cf9cec1af140060e0f78deb43425f87018863f4ddbb4afd8e114 SSDeep: 384:XTKCMFVTRx6RxpCwmAeG5wqXGbPizScgoqZ3rX/k1u+3468p1Tx2q8J75:DKBV9x6RqwmK5NWPGcJL/MudyJN |
|
|
| \\?\C:\588bce7c90097ed212\1036\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.69 KB |
MD5:
cc3c940f0ca39ba3b663ead9148c679a
SHA1: ed4009bf3d9a5d4f6243cc078d0d9e99f0993a66 SHA256: 549e3237e2987aec81da40cb360c8b4845ec124427fb74e88b3aea6dc2b85e42 SSDeep: 96:/17jYMIVOddQ/p7J0wQzZ2G6EtbOCrPiqTE:97jYMRK/IwQl97BOCrPTw |
|
|
| \\?\C:\588bce7c90097ed212\1036\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 81.28 KB |
MD5:
f6f98d2f19b906f8bf7f2b76e1419678
SHA1: cdec073d68de7c4bdcd7ad610a4b0be534a9d335 SHA256: ff173f45bc7bde226c4bc6b5981dcabe72ea5d81b46f3b4f1c742d618970b87d SSDeep: 1536:UVkCGcQdd2pRxtt9I3EULdu/wMkiBKlJq4nwiGHOzC6jG+H1kMFeiWpC:U6CtGdiNtG3EULdCE84wiGHOzC6jG+CU |
|
|
| \\?\C:\588bce7c90097ed212\1037\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 6.94 KB |
MD5:
d75d347a7fd8726456901ca85e6f72a0
SHA1: e281d87fb8d43a49576930e4f962d3723016a276 SHA256: 049f5a63052bbf9baa23b0be02d81ef23b72cc3bdc201a73be4021e1735d7177 SSDeep: 96:dbDVmJa7w3EIx5gSb+aJAReZMndFgQB99JzXKcYU2j6+gGldWTqBbT3QenLoNLpi:9DVmJaUx7bxyccrJF+FdldWWBbTzngXs |
|
|
| \\?\C:\588bce7c90097ed212\1040\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.10 KB |
MD5:
d4ab01d49bbc27d998c845911d8bb4be
SHA1: 595e2fa6fa288348fc99aa3be3f7be59a0a52035 SHA256: 889fca250c3aaca880ca8e61fd38fc6fda7e7ad905e393bf10ab1d17717ee239 SSDeep: 384:uv1dwG2mkg6dhSbO6jw/LeAcMnQczOOncz8By49:uddOmidhGPc/hiz859 |
|
|
| \\?\C:\588bce7c90097ed212\1041\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 15.60 KB |
MD5:
0adedbe4a71025dc0aaaefc6fa2a9d29
SHA1: e2c8cbf89d67370f425fd60b8097428900ddd04a SHA256: 75fa41d0ecf3fe58721a8e3bb2a9157f68fa2cfab8abb9bf05aaabec40c0c8f2 SSDeep: 384:k+Y2ImSqVbBqPamOr++qCh5Sj7WjqyxWtIjp:S2Ifq2PLOrVh53nVjp |
|
|
| \\?\C:\588bce7c90097ed212\1035\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.86 KB |
MD5:
4c531d1e0d8752856f5294f360f1b378
SHA1: dbdafb409263a7ea9d5673e025a190af0789b4fc SHA256: e350ef806a86bc48ab94c8c4aeeedb308de335c2fbba753f584a135a7c2948f2 SSDeep: 96:9UqAOvk0IDREUWTeOytRh6CxlbJ7tNPlwn5qdb5Vj:ZAOFItbshI/6ylF7VU56bH |
|
|
| \\?\C:\588bce7c90097ed212\1038\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.39 KB |
MD5:
b48b9b7d3614944ef9378161b36dd178
SHA1: 360bbbd83012a910d49ffa59232a73f7cb6d7519 SHA256: 97d34ed434d548358f25066710d0dae4c2db42ea8d84ada135718da5cfb9dbc7 SSDeep: 96:FrHQPMf1lgJc23kQxZm73R3b5URnxVhkNTPdNvIkQ1PeRCyrnvIoxny:eEfbgJc5GI3R3b5mnxfkPbDQ1Phy5ly |
|
|
| \\?\C:\588bce7c90097ed212\1040\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.80 KB |
MD5:
9b8616a68e31ce7f01c2dd101cc676d7
SHA1: df820c285f06b02eb0f4093a49a9ad65369baa82 SHA256: 8f5082e6b779fb9d96ba2452015ae8c5f47a99d40ca878b27da6e2d2f38a0ef3 SSDeep: 96:oz3xw0FWcD5TIknYbWNI95nD+ThkrpS+9ZfTPIZz:orIc9TI+dm9RqGAaYz |
|
|
| \\?\C:\588bce7c90097ed212\1040\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 78.44 KB |
MD5:
a2ab879f6dced0dbe1b71e1179208678
SHA1: ac92719e4f82342b10295ba11c65d2596316aef1 SHA256: 80615f95c8572878f09240de7478eecb308f3f5b17d3739b4c696cd33a897755 SSDeep: 1536:uP6SXyyi/4WnIwyIQ3N2eTkgPBnZPFGAdZ5jhrOYiUBUwgni3n:mDXyyi/hIwp+8ckgPBnZPzRlrziEsna |
|
|
| \\?\C:\588bce7c90097ed212\1037\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 70.64 KB |
MD5:
b59529bb2081912b24a1a315e2083657
SHA1: 4f3e6af8e039c014d7cbc2f0ac49fdbf540de5ad SHA256: 17377d67fc85c520cac9db4c4d804b0bc65aefaf4173f73213a6e51305d42dd9 SSDeep: 1536:plyXjtoTNSL+VAfNtURIwQdkuw7wZ4LILUyRGGBUuvQ48XNE1:izmEL+VAnS1uLkSlGGBxvRuE1 |
|
|
| \\?\C:\588bce7c90097ed212\1041\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 66.89 KB |
MD5:
a22cdadd64567640a008658338cd7b7f
SHA1: a2a87f0c0466089569426b35cea4af1e8fbeaf20 SHA256: 81fc4a742273e183b3d04cfc1331ce04cfdb8d54a7c0187e10ab7b8ed7919ad7 SSDeep: 1536:KJuffqbLa/jfdwz7+bKtxcLaiQvUMGFataKhQxyiL8ZM0oTqxcr:KwcWrfdA+YxlPMMGFataKOxN8yiG |
|
|
| \\?\C:\588bce7c90097ed212\1042\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 12.63 KB |
MD5:
30174c0c7ecac53080cd89aeaf51c7f6
SHA1: d80a55dea0bf997f35a1dcba5ef83a983bebfed9 SHA256: 4c47cb471e424b1d86ca036f72c275b8eab3298a27b159b0b53f4f30714854cd SSDeep: 384:QEbLrzNF66wSmjiFKoxBgLWDIW57qjXSj8hID:QaLG6wSmbLcIW5N8hW |
|
|
| \\?\C:\588bce7c90097ed212\1042\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 63.97 KB |
MD5:
15cd6f5b7572e0d8b90314496c3e216f
SHA1: 192964decbb3f170764dac53cf449eacd4fb5d28 SHA256: f628eabd9155dfeccf86c3806efc48f94cd053d3ce11cdf22aace2daf39813eb SSDeep: 1536:QrYp9CstZXNsua9DMf4KZuiwUa9KB4kgorQ+mbbMXp6ywvA7h5:Q0phNC194f4sui7a9KB4kgmQyXp9wGh5 |
|
|
| \\?\C:\588bce7c90097ed212\1041\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 10.13 KB |
MD5:
a63801ef30b634b02ccd50399758308b
SHA1: 09df1fe1e2612da11257aec2ffe7ea4adf194337 SHA256: 189715d338291b1dafd490e6b48a711f424832ce3592db3229afabbc834a30fe SSDeep: 192:QxZe2KzREobdS8g3VMQszANbbw0ZpGR+2dt4njRkskb+vLxM7xkRcG:ae2aREDn3VMQVxGR+2dt4njRkJ+vPR |
|
|
| \\?\C:\588bce7c90097ed212\1043\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 78.03 KB |
MD5:
65672436fd14cf523100f2f37d1344a6
SHA1: c05cccc7f2255e50703127b1dd38aaebf0b42fbd SHA256: 52c5dca162e31768b120cea776e5733d117d7a028f9aa5c29f63b606e3702259 SSDeep: 1536:FnyRzxrRPF2soNedkjIr/rPE1Qx3wew0ZrKHXqC736C9GIJ15hDXQC1S1TrZ:FutRN2Qdkjm/Aax3hfrKaCT6MG4DgWSH |
|
|
| \\?\C:\588bce7c90097ed212\1042\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 15.10 KB |
MD5:
1229785974a7fbe106e44ebf7e364ea4
SHA1: e52eb6aee3a241d506b9dd7e1ab0656a527257c1 SHA256: c539b5a34093b4416d16a989e924c1781248cc58e69da8797ccfbb7ab834d866 SSDeep: 384:mg4LJ50VKQGGZC2ni+SW2iv80IukTW6yzFk42oY:v4LJ8jC2nvLtf6QFk45Y |
|
|
| \\?\C:\588bce7c90097ed212\1037\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 16.60 KB |
MD5:
c340ebc7b78a6e2042bc1c77ceeb7358
SHA1: 0dc9883c3e7751560a36a481c98340db2a493512 SHA256: 2b6fff760240e8d20f3cd890d024ee1a566113efd61c2158ca49cf3c33ae8bed SSDeep: 384:16VBGZhHe0YI94fdsDLsUMG5hS9TpyhtD5o3GqskGwBuZR:MLWhHeYSOD4UF54udGQkO |
|
|
| \\?\C:\588bce7c90097ed212\1044\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 17.60 KB |
MD5:
7acca9eee249dd8cdaea24bcbbac09ff
SHA1: 83185c1885003b86f53ee5d2a77c3b0e06e9bef8 SHA256: 1b0af922327b5a2749b615063196e66b497c85a5475442ed82010b660a58e9bb SSDeep: 384:im8BH8yqz7eWiZzgBNC526/ICaqsSvPe4ihXixB8MnG9Suuxgrpa/M:im9r8gNC5OTN4YSD8Mnrgrpv |
|
|
| \\?\C:\588bce7c90097ed212\1043\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 19.10 KB |
MD5:
88c2711770e21233fdd601d14c88f384
SHA1: 801322a46f7ec74ec59cd66b1002e1bef0a1f601 SHA256: a25fc4b5f2e5ae58ce46253e4998d109f7263a5734d61148b3b801e4d82137fe SSDeep: 384:Z+jiIiQb2iCTR008FbnUR6ySX7QVyj6/q75S59Nzh9uKCVNVNrN:Z+PiQb2ELFj66yy/s/NYF |
|
|
| \\?\C:\588bce7c90097ed212\1045\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.10 KB |
MD5:
84f1d6c1e74f772ec81ddb690e6ea52d
SHA1: c5f1fe7543edf8875606c9a897b02930612ddbdb SHA256: a062d57510592d1ad25c248bfa86e909a6445c51edb11cda9967abea09d8aeea SSDeep: 384:5xzSdzY8n762jJZhJQeajjcKkSoo8zEkhSRi9Z9lPQz:vzlMvseajIqegkhF9ZPQz |
|
|
| \\?\C:\588bce7c90097ed212\1046\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.10 KB |
MD5:
db870aa9ce9d5658c7d305fac40d3440
SHA1: cea609af9e6be1a094263e0005e57876d5f621ef SHA256: 15c45a5168992227403e7ed2145f89a56fc9f4dbc576f44f433365faa211d870 SSDeep: 384:Rj22cYtcuEwwYMw24MakXIs3wayp2IkhIu7veLMHPfZ:5xiuEwdprkXXzIkx7GL6fZ |
|
|
| \\?\C:\588bce7c90097ed212\1049\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.10 KB |
MD5:
ae5880d080fba3dd64914662418f3ba5
SHA1: cb3a0406f986042e7b825d0328b132bab30d72f7 SHA256: 7fb14acc4ff55f47ff152242b7fc12b93804b41057ff6f3316cd78d9ccab0df7 SSDeep: 384:Vb9QduIJntsntwX7Ge+DrUjmUc5eapfg5mGoTF9x/HryQz9dbI9rk:VxQLFeW7+nigpfgCTF9x/LVHbp |
|
|
| \\?\C:\588bce7c90097ed212\1053\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 17.60 KB |
MD5:
f20958c0f73d0072622e402e8b47dcee
SHA1: c1b5d0c47be8ed2d5a67f918c6f8ba7aa38415c4 SHA256: f33b02b6f4d9b583156764e1c4a833ae58248587afc509b3ca41d0026e5a3464 SSDeep: 384:uz+N9NdHhrSu70hE51bEW2qk1nxxMyNp+UXaXqy:99NdHhrSw0hE81qk1xxMyNMUX8 |
|
|
| \\?\C:\588bce7c90097ed212\1055\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 17.60 KB |
MD5:
54587de2e2d57678ff087f5e45c41afc
SHA1: de169ca66f50611dfdebf4cdfc165293f583dbae SHA256: 0f66ce1574441709e0497a6207ae0160c10ec618c18ba8985ec4b36f175ae5a1 SSDeep: 384:/pU9KVjbaEDUMtFQTLJaSag63c67FlrwOJ6bML1Roe:/m9G3a8BFQTdjIceFFwOAbMhRoe |
|
|
| \\?\C:\588bce7c90097ed212\2052\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 14.10 KB |
MD5:
2a2a00848042fabb593cf6baff634ab5
SHA1: 60a881668e3b43d2a63fdc15793c6166fbd9c055 SHA256: c3894c5f07e78eafe5ea11f19e4fcdadf1d46b2e3d9aaac6a890371b228c7d6d SSDeep: 192:0YuLLJ1zBxc5VmfuXJhv+6Ck29QtJ8OHXPrYkVmJObGo3tEnloJncvz:09fn7GlJ0Jrat6O3jYbu3unloJcr |
|
|
| \\?\C:\588bce7c90097ed212\3076\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 14.10 KB |
MD5:
54aec1f5f882e59d80cacf27614c5ff6
SHA1: 8808289badd2c2b6ad50ca1d9ff513825449ff98 SHA256: d6997b9cb242336eedd25101c54078793348bb2e0271f7971960554e4a891f7f SSDeep: 384:lrmXuGHWRe92zFGpqeAbr0ctV46ruMr2jkW3:lrmeGHWhFgX60V6iMr2j7 |
|
|
| \\?\C:\588bce7c90097ed212\1043\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.71 KB |
MD5:
40edabd0b92c577cdd8a720e67fc0db8
SHA1: ceb3fcf84aa132aa8621a4cfbcaf21bc87b0dc56 SHA256: 36287d4bbb538fdb0375b88b18950c9bee6775fb17293624787df7fa914987c8 SSDeep: 96:41ePfYba68qs5dkYSmSgm3SJNR0zIIebIoshIuS:41e42DqdDmSgm3SJNRmIIeMNI9 |
|
|
| \\?\C:\588bce7c90097ed212\1044\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.22 KB |
MD5:
103ec9d8ad84d422f795dfe8813fbfb4
SHA1: e086d2de014f8113c11edd92708f3dfa0db1465a SHA256: 854a15eecc37b080d5ab11ec34c8574d4d821ef01d6f5cba6a34271893b2cc5e SSDeep: 48:P2cL5b/jVv40vFfYUl4PLzMXYy1rvnIBV+ydSkde4P2AXxelvxM2oXyvZG714:P7L5b/jS0qq1rv3yQOza5MeN |
|
|
| \\?\C:\588bce7c90097ed212\3082\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.60 KB |
MD5:
75c9c1c84e2da8738eacb7d001118678
SHA1: 56c23d9d871eb12383bab19b288a5ab2172f0ef6 SHA256: a973fe89e2e961f7916dbd2f2b9c8adab15ff697f60514a48aab2e4d9f898cce SSDeep: 384:+Wdkq8SPC8/ijqbosmcalg0EoCtavDqMLUisorPULPGp3QLys:ElSPn/ij4lmcaVxrqMYDuUrc3Qv |
|
|
| \\?\C:\588bce7c90097ed212\1044\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 77.71 KB |
MD5:
17ac3ae804fd94c40c32bbb1a9bf2fbb
SHA1: b6373986e60ac335d6d75561144a616b86b57067 SHA256: ce645bf4fb4f5cef6fef2b90e4d3e57952720a37b8786fee5372bb04b232cf15 SSDeep: 1536:NaWYF7GFHHtzk1892Vc0eMGxss7P++HbFQb/+:NaWYo5Nzk1lCzMFaJQ7+ |
|
|
| \\?\C:\588bce7c90097ed212\1045\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.19 KB |
MD5:
a964f8e47f228afa6610bafcf7adeb1d
SHA1: e6a064a17ee122e1471886896e07c66072f052e3 SHA256: 42f15118d393d899814d5d8bc8b72fbc7c06b111cff5a0aedbe769667d6911a6 SSDeep: 48:yVkVCgcyTD/STfRe4NPzhRDypNr9z+slhd9hAySuFzUjCr/iXRUiZ8kCZoM4:ylYL2AWUp19KsLd9hAySuOOq76dob |
|
|
| \\?\C:\588bce7c90097ed212\DisplayIcon.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 86.71 KB |
MD5:
5d81607ec0544660ac0434293851108f
SHA1: 24fcc2231b8e27bc23fe3dfb5304f9e4e80f54a1 SHA256: 48bb4d98257b67b02ed0e2c0edd807a69e78265ff697d14dbe6139dde54e3efc SSDeep: 1536:LJheOShKxPTwTQiuCz9oGj157G+z8cM5ac++L/V3ARWTI6gMBYHYDpHaW:LJRoKxPTtiuCzVjxQ5aV+L/Np6W |
|
|
| \\?\C:\588bce7c90097ed212\1045\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 80.71 KB |
MD5:
98ef77d81cf7483d1f5f5b7c416662d7
SHA1: 47c7467202dc2a67898f39dc81deacf11d660fbf SHA256: a720fdbf88d42f172ede79ce23a473382e40c9a4edf7af22e382596cc13f5c1f SSDeep: 1536:5k6j7IL4M0LuELgPKVvzVYEGnXvhqp6Xy55rVFw7yRA2FodBddu+rn:O6j7ID0L6yVVGnfK6iTRA2KxDrn |
|
|
| \\?\C:\588bce7c90097ed212\1046\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 79.11 KB |
MD5:
441008326ada0845eacc8396aaa7b194
SHA1: dd99208f4c8e2366e47d4af258ba422d1150e372 SHA256: c52c9dabc2940d75b5755d32c7bfe85b89b794737a336fce21dc4249489eaa48 SSDeep: 1536:20c43eQyzGw9xAReIP8Iu7TNQSMQTeyS1qxBONlV7Wr1KZn4wn9gTTZD9c5fSr4j:FcTDzZAkUoTrHyqxBONvZTn9gT1lPs |
|
|
| \\?\C:\588bce7c90097ed212\1049\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 53.42 KB |
MD5:
4fe8f526a4888757f536b67388076fc1
SHA1: 596970e377d1638f51c285880dfc8852b2a205d5 SHA256: ea979883c410534ce7260d2ba73aa4b8fa35b82fd5f598cb8a1427ad971f66e5 SSDeep: 1536:A5pljDuBP7KBRTfGJ30rrPcUhmEYrUSvZAnh1Ep6YouMNt1:Arl/uBOBtfGJ3qrPHhVYF6e6Ypm3 |
|
|
| \\?\C:\588bce7c90097ed212\1049\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 79.83 KB |
MD5:
b5ff00d6cd86fa0dd1a59410b8f318ce
SHA1: 7515822ce5180bdb768bb0c4f1e8a8fc1a3c0eac SHA256: a31fd5d3a8e596174b64b0c9c5a02f00f6d216bc60ea8a57a22c7a1ee58bec08 SSDeep: 1536:rZzdSGF/IBLl9hGkR3KKnfekjWuq7lMedn1lzkNLhZcnl2oZ7oOte:r7TFUlrGkRJnWkEXlQNtOnx7oN |
|
|
| \\?\C:\588bce7c90097ed212\1053\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.02 KB |
MD5:
444bc6095d0dbcf30155bb6a19b77298
SHA1: 6b68e683214da89283f683717fb350baf06a0edc SHA256: 8ed2de343285f57bb168fae450bcaf783ec4e8b3e25ca4f205052547b1f702c4 SSDeep: 96:sdlKLm/PqHqsDe9/KfXiLUOJLAnbE53NdBS46fkwN3EoA9Y:aUS/CzC1KfUUOabEB1S42BEoAK |
|
|
| \\?\C:\588bce7c90097ed212\1046\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.85 KB |
MD5:
f86afffc4648e7024b3ec0a2b0d75949
SHA1: 0e7d7f000087ca37416c904ec1984b0d58452137 SHA256: 9694ac11a9ed663b1f157d2079d0bff2a99896f3826ba532676cfff131081dd3 SSDeep: 96:rUhdkzNZ0rWldqDbmHwTQUuLIl26cCqwla3DmG7BOGLUjqK3Mqwnbb:rMCJZ0rWlsHUwTws0sla3yVq2Mqwnbb |
|
|
| \\?\C:\588bce7c90097ed212\1055\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.02 KB |
MD5:
fabf2784e38e3e04a1cce56c83114123
SHA1: 5d448b9c30fe084e073557a158b7f2be86568775 SHA256: b86f56984c565df4d5c6ee85e3a536aeff6a212426cc433d3f071021e66b1916 SSDeep: 96:rVMukfwZ1JPdmfkbZ+KcU0yInWZq9H5Uo8Ks1DZfmSbvyW:vHZ1Hms91tCWkPUo8Ks9tmSTp |
|
|
| \\?\C:\588bce7c90097ed212\1055\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 75.28 KB |
MD5:
3f469c07d84884ea9d50375f60b2d821
SHA1: abb5da8123e9af9bf6349a61f34f2ffe673b12a6 SHA256: a0f8ea912ccde7afae9c0e7db0e48bb82325b1720053308da610e6f673e8bc13 SSDeep: 1536:vq8GGoCduHUrhkai6EHLwuHPyfYlK390D8sCNvEBFvACejoRSn5iX:vNo4uHUmGEMYSODBlzvA3o4n5o |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Rotate1.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.11 KB |
MD5:
3d4047b871b6f80aef856cf84a808741
SHA1: f8e9ddb1562d44f1a4b1523bccc8ffdd98b16d0d SHA256: b92d559e060b5b1b3a65c9f379984a2b969fc42049d32e967855bc10f8c66641 SSDeep: 24:pv1+/h/M28mbDwcsvguvv9F46kM0SzfuWQ9qfJX9PiFPDNrUgPatzHy1U:SW6gzvv9yM0sfhQQfJNPiRJrbOzoU |
|
|
| \\?\C:\588bce7c90097ed212\2052\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.94 KB |
MD5:
9b37c1c7a159b1e306819f6cc4fdf769
SHA1: d27dd0fca8f7d4469eb04a82c39d2fd9be4b4de6 SHA256: fd3e4dc46f5fc9323d7d401525d96a5a4bbd50dd42bb92b17cb089fde77236ab SSDeep: 96:vq/0fG/HQ9kAfuDgIhj7yq9zbTGqdzlUK1/waDdELLYNlCIYJVdjvWf98s9:yc21AfAgqiqVbTsK1RsylCIYJVd4r |
|
|
| \\?\C:\588bce7c90097ed212\2052\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 59.52 KB |
MD5:
46a06f982408a2d22d62b21f6a1c6136
SHA1: b2a972bf3ae90c962d3510d1fd604aa40cc55b8f SHA256: 7cfa3d2e38c0fb8c4712df0174b83e613aefdc3abeb9eefeadf0ec2acb9a16a0 SSDeep: 1536:/pmCw9rzHnFa9LcBkqf9oOKcW+C5p5QmXr29ziz:/p5w9rzHE1vlB/QmXr29ez |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Rotate2.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.11 KB |
MD5:
9b3ccd099504cb696add1b6c8edd8956
SHA1: 79a8e4d63f89c3c2a72a5a1e6e360c7c80471bb8 SHA256: 144052319d15618722df9aa74c21fca2290192097118ae81572f1f84b8c58d86 SSDeep: 24:QRcK06yFTWlkcvfKXRRATqalTnBHpNRyRWEb3xIZJa/NXatzHy1U:Q86yaEjATqQTBH3Y33KZQVOzoU |
|
|
| \\?\C:\588bce7c90097ed212\1053\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 76.13 KB |
MD5:
8c75ae1f350ce7562c42e6c4a8685a62
SHA1: 7ae0b4ce614f5d8583986b73d064695728b35a92 SHA256: b1557ae06c2b97ade38c8fd9b3125297a176496eb6b6d838b91eaa919341c912 SSDeep: 1536:aWgpTnF3f/TtXew6REy9zi2yC9R7AFORxSVZn1QvkaRnhhsmfmv7o+tl:zgFxtcFzi2l9ICSv10kaRhh/+D7 |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Rotate3.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.11 KB |
MD5:
781232743a54a32c5e06ef005e3a2104
SHA1: 0a73983b92923364e2bdb4c3a51c33877ae06f3b SHA256: 514f1875427d147ae81afdfb1ef1ddc6da06d17fbd28961e812ece2accf2b8cc SSDeep: 24:zJfxXp67NDy00ORISALhHI7Ery5JxcqivVQDe8Qa1DWUsatzHy1U:zPXGNDSdtytxw9QCysOzoU |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Rotate4.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.11 KB |
MD5:
75fc807e187b10d5a56eadaf1de4acc2
SHA1: 9186daacfb1bd04b0480bc86ebf3e26358dcbce5 SHA256: 0522c258ba874b3a8207d3d0e7e7dd5f3684e121c09293310e4ebea9624884b0 SSDeep: 24:DlO3Z6EzMvLXCfAV6EDgmlgMhHt2480a+WiWDo53rpjatzHy1U:DsZ6EzMvjCfAEE01kV5ahqFOzoU |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Rotate5.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.11 KB |
MD5:
31b37a0b9dc3a1d4ae004b0a9793f5ec
SHA1: 7c3ac9540906189955721ec0d30cde126955cb75 SHA256: 1944759395af1a2372d0b05ee734b001bf5b24cb1bb536809eb455f6b930c069 SSDeep: 24:QPTfy9jOqlL/4FGcB4LsVEedV+ON5RXsktUNQqkkPqdqNuc7atzHy1U:wTfyUUb4FG444dV7JskKeqkk0qNv7OzN |
|
|
| \\?\C:\588bce7c90097ed212\2070\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.16 KB |
MD5:
3f07a9d3620e1b2c7175a427436b0c15
SHA1: 61676f60e103ab3d8d6bd39f8f5c21fef3faa91d SHA256: 8fb8cf33c75a2e2d9846613b01ce8d35df9403057d5674358e1cde905d110acf SSDeep: 96:3B1UmXSnlS7iahfKCDhr5+RkHCZSZxp439fgHlKsGc:ROmXwg7iUp7HCoZx8qHlK1c |
|
|
| \\?\C:\588bce7c90097ed212\3076\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 6.41 KB |
MD5:
b3a270991dcd264661a124e419942673
SHA1: 0c5fb0c28ba29efaf141829d944de086d146f5a4 SHA256: a2718cbd92b6bd54bb2dba56a1eabd9227b6c6bd630e436906b44a5674204a4c SSDeep: 96:PGlIV0vu2HwfKvebJh69tWWrnZ2SAlvlIVH1R9oQQEv4GtvNkHUPx6U7rX/8pKTf:PswfQ94WTsSHr9hpDPx6UPXl |
|
|
| \\?\C:\588bce7c90097ed212\3076\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 59.66 KB |
MD5:
c8c46e2064ab46c0f05410152c1de7bf
SHA1: fe6bfc28b5ea0bf3697cba030a6cfee1451d2872 SHA256: f6f3f365ba140b8061a76069ae2bf7b5ee86cbe1c61bf800192e2b32a7ad5193 SSDeep: 1536:sf4c8nWunG3ogwREkKmwqPq96ueT3BmMeG42Bg67e:sf4cUDGYzGkKFUtTcMNZ7e |
|
|
| \\?\C:\588bce7c90097ed212\3082\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.24 KB |
MD5:
0d141681bc5081ea8fa198587ba76e4d
SHA1: 7b12f19258853625b726ee36180984a0be9e2dc4 SHA256: 0a46fae724c76d892fa68bab56e9223a54749d0afd2617759a9c153a30ac4b43 SSDeep: 96:6BjWl8S7d5C5EC6tYT4Af1dmR201GwzTCYxU:6BSlFkyYUAy2TCxU |
|
|
| \\?\C:\588bce7c90097ed212\3082\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 78.38 KB |
MD5:
d197c934565b3c6424b3459b6df2582e
SHA1: 05589763c02b4c411650cb936a36b12f14934ed5 SHA256: c8a3ec184eeb0292b8729ed0263e55171c208a08a1a3e5c42b0cd6fe4ee75f18 SSDeep: 1536:UkIhCIZZL8ZlKK9oE13lM1BRQHKp5VWK3Jt1CY5vs5HQw2N5qgaJ2kpIcHkKuJud:zIZ6DXjBaBLSYds5wige22kKfd |
|
|
| \\?\C:\588bce7c90097ed212\2070\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 78.63 KB |
MD5:
f666aa586e10b938ec55878373fb3dbb
SHA1: e893d2115925479f81659b85835167a6a24bcead SHA256: f80341861d5e1b8ac91da05748eebcd85a774d8e4625885cbbf2d9f70d8c141e SSDeep: 1536:ldUE1Mum/UrPnBnAAz0Wzqtetpe+W7zGwXD/jHKf9vdKaF8PPRuQxUKsqI/pvYZH:zUaVPnBnAAz0WgCpeLXD/jk9H7aUKqYt |
|
|
| \\?\C:\588bce7c90097ed212\2070\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.60 KB |
MD5:
990ac9809fbb84f6aa8b9a4a5ab88e48
SHA1: 6320138f946f7006ad29a1ba4976b5f08882ba19 SHA256: d1f1e51985b1beb8ca05017ace2609e71d302ba5db0dea64495dbbca06caf0a3 SSDeep: 384:lqUnnFY+Kd/0gSbaKmAVReUpDqZ9WYF9UytqQOstpnIGUh8N+1NR1kCU:VnXK1aaLUg3W8lqU3IGUI+Ri/ |
|
|
| \\?\C:\588bce7c90097ed212\Client\UiInfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 38.38 KB |
MD5:
c5076ea3da08f52fe8b75b1ca4c3d588
SHA1: 34cafdc377df65db875afa16301f7c5357e93683 SHA256: 8dc8ec2159e0348c210ad0a0212bda1f544d424d2d733c76a159b26b81449ba7 SSDeep: 768:Gye1Eo1JteDj6IkgxB0usgvd97w90UXMjuEigq6eEo6jR9fOPpFj1:e7kj6xaqusCd978mjdigzhjrGBN1 |
|
|
| \\?\C:\588bce7c90097ed212\DHtmlHeader.html.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 16.00 KB |
MD5:
263d1031f434ea7b13386b029b209acf
SHA1: d8fe434e30ec8e67976cb88e5fba8f5618cfaf42 SHA256: 9f9dcdca60ec2ff1bf55a0f82bbec46ef9e86d30f90f1f8274a4a32287b77cdb SSDeep: 384:LXLYCbaOPnVN3TuR9NKS+Uf6/iL2CtHPiUtTjeI/Bv:QSaCTyfNKdUfGdiKSTqIR |
|
|
| \\?\C:\588bce7c90097ed212\Extended\Parameterinfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 91.39 KB |
MD5:
0215ffd559d5a8ce23d31fb7fc8b82e9
SHA1: d9d74bf077714daf5434afee9200f69c84b7dfb2 SHA256: d1c2606449f934a4b6147a33158bcd1e538392e2995179e59e02bb012768a9ea SSDeep: 1536:2yftVhwMCalquBBxwPKd5AYXrDysKB2YhUlorDDDNlHLugaMxaK6KAi5Vp/eYW0s:22fhLlwSHHYyuDDJiMxaKkidmn |
|
|
| \\?\C:\588bce7c90097ed212\Extended\UiInfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 38.38 KB |
MD5:
ea3bc607cba7b00000dea0aebb7119f5
SHA1: a1aadcb45a4892c573a069fc7f20433e0e206a9c SHA256: d90521c04ee5d2f37cbef58a078d63c3760a1e4225297c722e10eb43832fb1d3 SSDeep: 768:P6Mm8vgRJOJ78UsN7csYBIfpOUa7lIWB1DoLYgB4WDcU+Zyr0DP:Px4mCchBMamODoLYgB4C07 |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Rotate7.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.11 KB |
MD5:
3a41a179acc6d2232f003a048b94491d
SHA1: c6ee46508022ff55ff9a84f7d5ff94b3d6f2e854 SHA256: c1b8a925be371c7082c8d268481ddfd6b103aa383c22567b3757cfea4168ec1e SSDeep: 24:UAwvxQZTaoDII+87b/sUP8MmjMS/nMjYXft+AfH59IxLWYJatzHy1U:ZnwoEI+UTh85jt/MjYwQ59IxdJOzoU |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Rotate6.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.11 KB |
MD5:
78429351d8c3c6e15ceaf9e4edfc2b0a
SHA1: a3505d3c1fe4a1400f5bda94bcbb4a6134e05b6c SHA256: 3de8a2bd6237a5404cb423819482e07719db3c5f5e4e9c38760779d815ef682c SSDeep: 24:N0F36tuuNKvbO6jVNPyxq2GrGllTKUc0dFitp2DZYFatzHy1U:eFKtzUz1lzJGLWUaP2DOFOzoU |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Rotate8.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.11 KB |
MD5:
d1ac8e2fc4109c02c7f047f1f8ed84fb
SHA1: c3293ca39c071dc10a0db6eb6b64a73de91e7bcd SHA256: 7327bfcae5c22682ffcd2b5f8900ac66c6213c585cc65a23a22ea4ca230a715e SSDeep: 24:3WnALIIZjDCZA7ZleATpATV7n4dUDLlfxSWu+7Gl20atzHy1U:3SAx5D2oleAxdqSAGvOzoU |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Setup.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 36.10 KB |
MD5:
c59528beb235d4781c854f9ea3d46d7f
SHA1: 2e24eb48ebc3c670aea440bea0ce4b0c3f08711b SHA256: 88b1b09c6c0a1435413e022d7f2458fc87c9639ba66d8a10169c6ba8e4de5ab3 SSDeep: 768:nFbFV4DYBm12SSvppkYYRtx++rHFpywEFExROK+zI+qE:x4Dz2BpyXS+ppywEFExqd |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\stop.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 10.14 KB |
MD5:
0c6ad85aa8135bb50021c1827a7b03b2
SHA1: 266fce9284d5fd93de0704cf59533eeae213baee SHA256: 340e4a6690473cf3bc3e5df415542958568aa79c3963ff2ffe2c68b12c78a1d3 SSDeep: 192:hR/FRqF1WgDS+VWnx7xqv1zxLqUh/d9zUa93+WvOxQiKzxN3FdYymapLzSS/WL:hRWF1lDSwWFxqNFu0tUa9OvxvodYxMU |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.36 KB |
MD5:
856edf3cad55c114bced272b8eaceaee
SHA1: a85d2f101a5650823f3ef8826793913a02576660 SHA256: 503aa97037c448808b042835231013b5de5eda749384f7b3c8f86350b5a10afb SSDeep: 24:kbw0kgSBCjefgtWhYb0TtOHoMZIcsDqOOHOVNScc5gikNvQ4LhZuP4/ZevHe+Pa7:4ogCCSoWGDg8OvVczkNvHijvHeyOzoU |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\warn.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 10.14 KB |
MD5:
f76ea82b9850a91d25b8a4118a06895f
SHA1: e8cfceae8518872c245885dfc09b7a733b181e91 SHA256: 2f21e4762db521c55949feebbe621cbbd6b78ac4ab918001bfb576dffc0371c7 SSDeep: 192:HMZGjqwebAEEtGXtfp6pc9730JF4Osai6NG5FBV4VGbEnpYZWO:TrSkGdfoSlwsalGnBV4Q++WO |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.38 KB |
MD5:
b9af51ae67402eee1cbb310037cd9a9d
SHA1: 188ad0d564f21da24987c0f8f049d0c640d7975c SHA256: 7f713164def41b07ff900209ec83c6e593da094a248b541ff2df1aeb8e6cfdba SSDeep: 24:yzC+KJ0+T2zHegNQXijXyW/jvdUxqB++WjNisw6EVc4L8a6BsJsv0atzHy1J:TTyDjNq+jvixt+WjNvw6En8a6BsJsv0D |
|
|
| \\?\C:\588bce7c90097ed212\netfx_Core.mzz.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 173.83 MB |
MD5:
cc75e7bda8993fedfe1a6badcf08dce7
SHA1: 9f7920f930c3874402c2d3c14535e2bdd1fe4eed SHA256: e104262286e666244be9b1244b073d074f316420ff783d93d664a93ea8c7c99c SSDeep: 196608:GV04YyKSBXZ35w+KBK2KJKDcloT46ooP8ZNoz+hK12RP1O7lT:z4Y7qZ3CwFISoT46ooP8Zyz+hm6Mp |
|
|
| \\?\C:\588bce7c90097ed212\Client\Parameterinfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 197.33 KB |
MD5:
fe93f920dddb62bb0ca43b77acd5f2ce
SHA1: 583b7c6a279823fda7e8079a49c5ee76b13743f4 SHA256: 3bf86b03b4472334755440e63a6bc2d0a3b57b5aab953e169a34e0fceeaaf766 SSDeep: 3072:/ixHE1z0RvKyuxi4kGu2egBZMji+9uf4bkQ/xWGV11GYME0OPAAZGZAZk:/t0RRuc9r2eGMDuQb7xpLGYMoAZeZk |
|
|
| \\?\C:\588bce7c90097ed212\header.bmp.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.78 KB |
MD5:
0485149e726068c71a6f0a8a8c4aa5d4
SHA1: d7542db191db7552d2e095ef3797d4338465daae SHA256: e84ff4523ca120f84c3d49dc437e7073b392dd3798bf99589d7499398653912c SSDeep: 96:jxOJbHuBKBHXQHot2d4wNSHqFmD518gPGZsvF7cR73VNOrvFqv/ZKJP7mAXd:IB5ys2d4wNSCY5VPgsNs7FNOpq3ZKJDN |
|
|
| \\?\C:\588bce7c90097ed212\SplashScreen.bmp.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 40.38 KB |
MD5:
8fe575619d6b8692b9b39fc3cba3c631
SHA1: bc45f62333dc8744cef7c9a652e2d90dc961ed81 SHA256: 3aa98fbe4697b6399342b7dbb54972de5353a0d725fcdccaa411ece6bbfab0d2 SSDeep: 768:tiI6hiAZzPz4sKj3lnGdckixcbulhjS8YVt4zZXr+CMjQ2YhfBrdn:tNGiApPUTjRGdbiibulh79X3MjQVprd |
|
|
| \\?\C:\588bce7c90097ed212\Strings.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 14.00 KB |
MD5:
7931b3ea83bc603ab7beb0ea15713fca
SHA1: 5ff8da89557bd59e7481c39e46db0cd6d7cdaa3e SHA256: e8b8fd696d5e1e626015b97bcbb50ed9c092d68b4865672949f6fa858a5fc23d SSDeep: 384:NOdU75bNpfwh+KzSGJWL9TaSUpOKPgwlKc3LSBg3a:sKLfwD8ktsKPg2X3LwgK |
|
|
| \\?\C:\588bce7c90097ed212\UiInfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 38.24 KB |
MD5:
8e43fe84fc0aea0b20131715305a5f76
SHA1: b1d8740d886555bf8d8980d72de19344997741e7 SHA256: fa9e6f8dffe70faed009b82e9b4b9776423eb6848eb66cb426be47252d4847c6 SSDeep: 768:o+uQV6UexeH/SHAFFhJZVdklxa0rc/OmatHur6Y0I1CYwsyzLWi+cgNC84:oEh3FFhVdklx6/xMHur6YTCR6i90C84 |
|
|
| \\?\C:\588bce7c90097ed212\watermark.bmp.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 101.88 KB |
MD5:
fe0d5c20b6dc275b543e74fdffb35ab3
SHA1: a88ac72784a93ff0b39cf36c4a9f5ddb16216894 SHA256: 4fcfffb3d0bc15e774eafb2ca127f382206222d3d8baa20850bbab6ba6cb6ef8 SSDeep: 1536:TV9BPUAqvFyHpj9heZi19giyRefhNRoKf8ih4AJHK0YIS90woYFLqdCx0ts8NmzH:x9uAqvFCjhXjyRQ7fh4AJEfLqIx0hEX |
|
|
| \\?\C:\588bce7c90097ed212\netfx_Core_x64.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.56 MB |
MD5:
7335f34ff54cd64f34e71f7402bd239a
SHA1: dff2c410b3db2b06269c3e5f24d3a4b76237d6c0 SHA256: 082dddba4f785bb744489d2fec165df9ae6d72fa5c231f607ad82ee312bb1f38 SSDeep: 24576:nc+BQbPyxbs4rONS5voMfjhOGxRcAA2wfpSUQEIbMFWGDdAXEQRqfr1zCjbHFrs:ncxisfQxoML1cp2GSUtsWQEQgfRufFrs |
|
|
| \\?\C:\588bce7c90097ed212\SetupUi.xsd.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 29.66 KB |
MD5:
133795dfff96bd2cb5baaed78c5e828d
SHA1: e9fff20ba318913b7c22c8ee28f7305352e70270 SHA256: 4d64e7878b6eb5c02573a989f8909d81fccc6d0ae6fbe9b556df300f80daa803 SSDeep: 768:PQ8BcvRTM5Admloo+N+lb0DsJ45dc147fy33GS6UP0id3tqo:PQDCKdsrlgDs09f9UP0+3tP |
|
|
| \\?\C:\Boot\BOOTSTAT.DAT.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 64.25 KB |
MD5:
7d87828880319b61c8683d6404077dd2
SHA1: 7aa3edd3cc89824274581d44af9468d95010885e SHA256: 717034d38243664227de93555084eb69bba70fac812c64266c5a53fc66b06096 SSDeep: 1536:3X80YrHtSC7y67HoYAMRz96ujOQHfuJntXc7szNXo:n8NSsyCHrR/6ulfu9tMT |
|
|
| \\?\C:\BOOTSECT.BAK.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 8.25 KB |
MD5:
b5618cd48413611c464e57a987dcd73c
SHA1: 1b03a8ed0a5b05bafbe429bfb5394afb037ff36c SHA256: becfda81db9725b2995e7976d122a8e433b4cdd8cdb4fdc9c95a7b35cb013864 SSDeep: 192:392K6zn2FgQOLwkFzpgurT4iwCBALgI8k1x/o0kLTblTN:ZFtOLwkFzuu3A99f/o0QTJN |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.30 KB |
MD5:
618d2da8dc2d0c7872e64b8a7f26a824
SHA1: db1b7799e852988c424be2c70e489e4190d37596 SHA256: 6b25dab2b962978f421ef8447ec19a4270046c63b1c081cd4cc4d134b56f9826 SSDeep: 96:lFyi9tuhg+NZu0mMvqVhvEf6vLZsEAGwdg4vOTyuL:3yi7T+7DmLc6TZsxdbOTyG |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.94 KB |
MD5:
451939fb3a15c3592e004d8ebb8b2a8d
SHA1: 657572c3a8c99cbe6af65b1d884e1865c5bc4782 SHA256: 556f04bc2fa5ee9a34465c120d77549c7fbee057e52bc474193a00291af6f955 SSDeep: 96:dUaUSmxbpML/XyyScrPEVLFD3X7oOnDqC5qdB5dnMHZEIcIj8sIPNOIW:6DF0ai0BbX7Pj5qdTdM5ue8sCNTW |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.63 KB |
MD5:
3d256ddf2f2f56cfdd0b604c5668fece
SHA1: 1f0ba64faa6f344721f0d1e44ee1368801583bbb SHA256: 84bec8e291beb08c6dbe70cccdc01575ee3e44ca165a9cca5c794ec9007f637b SSDeep: 96:B6z61yKnIj7iFUHcIx1C4kc0mcHu+YAMEX0+L9d5ZQr:86bIjaq1CatcHu+zz+r |
|
|
| \\?\C:\588bce7c90097ed212\netfx_Core_x86.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.11 MB |
MD5:
bb272865528723509bdf99f7dafae77f
SHA1: 4f68628d6dd920b112648e4f0c9c2d5105786bba SHA256: 5e626c1bd747e19deceb24c04644a7f006a5158455503f4e2b65b84482f88eeb SSDeep: 24576:aMUfvA/IFQ7Vr6xVNSHIiL4C61CN1vTcVlI6NydLIjS7Izz:aMUfkIO1KEoiL4C6YXCILdLIG8zz |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 898 bytes |
MD5:
1954fff9a30cd7b81cef29574bce52b9
SHA1: b5a876e3a780088739a4cb28d1c365f1cf76bf2d SHA256: e3a0f41d0f4be0a734ccf07a759811587b27f7238df59775c4161b89bd3eaee0 SSDeep: 24:XydSlV6nHkeu6szdPEtGQQeFjyagQ7Vs1rziV:iEKEeuFzd+GTeFjzq4 |
|
|
| \\?\C:\Program Files\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 418 bytes |
MD5:
267cbf65da39c22933653069c725a309
SHA1: 635ec1651665e33f5b8d2912ee7b08fc70a280c4 SHA256: df739565ccbdb8b88dce169bfbcbfba4f97a0d58379f24a606d04123e9e31b11 SSDeep: 6:+xd9i6J2cel/XxT3lZFkexZiNCHs9sXRqSukEgmSaxJgHZh6MVrzJ2NZ/XGUn:+TQbFm6sqXRZMVCpVrz0T/2Un |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.63 KB |
MD5:
b7383fb193db58022f3c3fa974361eb8
SHA1: 828ad7cb78e2cffadc288ee1578147da8005d77e SHA256: c8dddd5fa9e7133287368f44dcd36ed5e11a483f1522853b165804545f106ed9 SSDeep: 48:pIWycBPWaSDpA8/TPu9+StFU3el3HnWKoi80r4:tycJ2z/7uIBecU8R |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 14.06 KB |
MD5:
884290f4788ce0474de6f28735fcf491
SHA1: f11a129d06bcaffe5e6aa5c8474eb116290adde5 SHA256: 4c63301359474b8db40c8a85707c5068af590109a3fae3e42b946dcdba65e84c SSDeep: 192:lxLjiYWDhDaQ5GGqApvyAPQeNZmHPN6nto8VoAMuR+ozKrMXldcYf5f75VabhdSA:DuDhDaQsApvyAoF18pMM2r6dcOto9dfV |
|
|
| \\?\C:\588bce7c90097ed212\netfx_Extended_x64.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 852.27 KB |
MD5:
f08d1800a846c0d18cc03c30cc12ac6c
SHA1: 76e32ebe4840be23acf7039d947f61ed7787ac45 SHA256: 2b93376dee3f431fee22c7b2ac70c6b34af0820b1bed9b2c73f1ba0f69eeaaa8 SSDeep: 24576:QG7xPoGxjJosSyynGaUFj5GcvgNF7ra9i8AWCjUWfh/yUB0:Qed5qyynlUFj5W7ci8TIK |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 15.16 KB |
MD5:
9b5bfbccf8b64aac760f6674ffa12e5e
SHA1: 7ecec3cf239bd3d8f14f6e086b37f9a9fb4a60c7 SHA256: 68b6aacfc9be5e2227f78ca69fe8988ffc4739a56aed1204fba8c575c35c4ede SSDeep: 384:7F3GYq+kPeWSzy8jDtJATweH4T2TbNuTYoJ/tKih+A:R3GY/vj8HH4TwuEoJ/Rd |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 7.88 KB |
MD5:
7d56b378bea4a4061f99f5068c2413af
SHA1: 957bb6a63b3feb7de2ca74e1d4184fc056f0e4d1 SHA256: c59ed6be0deecd57376771e6fe6fbea405217f776104e9608b3779c095afffa7 SSDeep: 192:zNCtDgLoHV4jPUnd23rsuoAGdCR4D0d32kCy3icITi0GCDSU0:52MSVywGroAUCR4QFtP3iFe7 |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 418 bytes |
MD5:
daca45d0e26dd6082526514721779f8c
SHA1: b8c43a8d72f7f0006bc17117b2a1c7533d65b874 SHA256: ba899c852e407c62c6b15ce75e055f83e333ae1842fb42acc979449aefe7e38b SSDeep: 6:g1HXSUL3kd9WIS/EVqnvJRksMf6BRCJscFaxJgHZh6MVrzJ2NZ/80Un:sXtL3k+ISsVqvflQ6eNpVrz0T/8Ln |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 12.22 KB |
MD5:
6c3ce1b7a11d7a966e03fe469fff24d8
SHA1: e73e490a0d4660963acd0d86a4a5a578b033e40a SHA256: ebe9fb8aca30ca627bc25c71917826ff752ef3496fd6b602c56b0e25ea93092b SSDeep: 384:stpsPfi+j6AnryPNmzrza0ySfnWSbCBzKlVt:stGPfTj6Aa7mLbA2ln |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 434 bytes |
MD5:
6ff9e37f166f267251d69fde55615248
SHA1: 6c47c40faec013e7c581b204d94dc55683bd133b SHA256: ec56e947be4fd4f4267a9f4c9d4586bbb467053c146f762f76ec36b22c9a8fcd SSDeep: 12:em0ml8rkV5lr0LjhFyr1hoJv+pVrz0T/Tkn:emnX6jhIrkCrziA |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 434 bytes |
MD5:
dcbc3f2c3339fab29919a9f190ae034f
SHA1: 972100a03e581d5395b870b1449589fe2fc589c4 SHA256: 39eefee373a49a1e929db07c8d4fbb87da9a07ef2e500c829a91607bb76dcd3f SSDeep: 12:Sl8/i+ea21VddLy9msQI0CDxypVrz0T/8Ln:u8qq21rdLy9Turzi8L |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 434 bytes |
MD5:
da56426eb37356071363ab0bfe42f4aa
SHA1: 282ad5f5063e30c7c43028640995876839b52d83 SHA256: 431058d088a91b95d751165063aa9bc4061602b6c490684ae76d0c41a285eb4b SSDeep: 12:NkOehWp2pN0BxG7IJtWy2AxUpVrz0T/Tkn:NkOoWhgEMyvxirziA |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 434 bytes |
MD5:
52f578300786ec544cb9c0002eb36d10
SHA1: e44bc4f5ba0ff7087db8713d3344b62d545a0c7b SHA256: f62ba8bd6bc982a3da2178f8b225f938d3976162bd24b91408e32d4decd0ebcf SSDeep: 12:M6cd4uEbi2jAMEp7Zdm3l8iLT1IhpVrz0T/Tkn:O2bi2righLparziA |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 418 bytes |
MD5:
88d1a17e57d549e6bb328b2e78483aeb
SHA1: c96c06bcddd5c8c73596c7d7398a808a1aefed05 SHA256: bc459bf38695d36d9bbc19d0fb59bc3e01556421046e3eb48bc47e78b70c2527 SSDeep: 12:tuGOfnUfwXcM7i3lUuEzLG5NpVrz0T/8Ln:4GISwt+36nGvrzi8L |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 103.27 KB |
MD5:
54c923008b71e41b76a025472cc58361
SHA1: 0060c2314395ea43116c102e43d98c444c3517c1 SHA256: 44b0bc5ebfd244ccc750a1ba39b628944d976f952162c3f58a6e834562835472 SSDeep: 3072:n/LdbqBppNh5aQw1dKHFM2Gm2Colwr6silqVXDezpTmkG:n/LdbM55SKWwXE7silqtDeG |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.38 KB |
MD5:
416bf91fad8ff2c093eca4151d778eeb
SHA1: b48dac124c8813cb23d2cfd2563757d5dbdf7e7f SHA256: eba308b3144849d10433292d8eb40b8786412a0efe8684f7acaccd48a414d62e SSDeep: 96:o/7pzRvws9FtRjiKS2qjm/skXrSTbhmXM6TIXbi0FbHku:o/7pqKTRW8qWXrSTbykXuu |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 62.72 KB |
MD5:
6bba569fdf41ace6fac474b55d248a07
SHA1: 2bd081756e5a09fe98d98fafecc0d10cfc9c4cef SHA256: a2a769ae6655fa35ab000e6bbb9b5d5337985a232285b9f229c7e9595578e3f0 SSDeep: 1536:fPN38H/jxYDJHe0H01uahp+2N8fVoSHQI/B8fgja9oqDG4t:fPN3U/V2e0H05hc2ceSwgBc6a9oqDNt |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\README.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 290 bytes |
MD5:
300b13b4d9976e56adbfaaee6f7c4ebc
SHA1: fb7edbaa1e094aaab44de967fa2c026b32411173 SHA256: 659997ddd5a6b2f6d7c7c9a854ece0aa6aa744d11bc889f7f409bb37d4f27d05 SSDeep: 6:6gchstAQjmYWa7S5lNBTGwN2MMEHaxJgHZh6MVrzJ2NZ/XGUn:fcatDf37S5ljNrnpVrz0T/2Un |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\Welcome.html.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.17 KB |
MD5:
6c251794cfb808ddff432c3a14dadaa2
SHA1: 8dd7dec6a86d344d9c8487f40211eaf992da8846 SHA256: 259cf65ac67ced9a357fd3f5e2f8fc19ccddadd03ac478750f4c40c0eb36403e SSDeep: 24:h9/18c/2FHmdJm8tNarRUHLvKeSYO6bu8m/HrziV:L/1tEmd88to9gm6buF/H4 |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 142.05 KB |
MD5:
481f30865a5b09005faba416b1ac038c
SHA1: b6fdb182bdc309582683ec8128bef443808a4285 SHA256: fda7aff9198bd304b7520ac4f6390c2699dc321f5c79a85173285ccd90b7aae8 SSDeep: 3072:1jiVZLBmIwHdZczFAfT8/RumPU/v2ZNek9GS+iWrR4Q9qOBpG0QLVjy0hlc1tIH:QTGHdizFA4Zsv0NAiW94QvGxjHh6mH |
|
|
| \\?\C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 546 bytes |
MD5:
48cec063bb4ca9b37a1b62f86bb6797c
SHA1: 2f4be011f7b23de8c55883ceef43238a97ba4fc5 SHA256: 6c004295a3940828b34d5216ceb9c1b108305124ed13d0d418ffe88b73969b77 SSDeep: 12:5TqR8H31/NFK2Ga2wxI/1emMzuCvonDRAw2hpVrz0T/8Ln:lo8H31v2XIKaMA9Rrzi8L |
|
|
| \\?\C:\588bce7c90097ed212\netfx_Extended.mzz.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 41.88 MB |
MD5:
b790da90d0c6c3db2d470430d72b0adf
SHA1: ba28aaf3de47f780fd99f939c6190d4a029b4166 SHA256: 9079e442aee573d221fa746a405405a2553f60de994e7db863d6eb28640df578 SSDeep: 49152:cpSdqU6tLnvVqSK5G22mDgBOOmeGGiU9Erqkbnt7QTr5+Oc2EI+8dd0ZwTse9QOH:CtZKH2mALErq2nt7rvfI+vZpfQ |
|
|
| \\?\C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 170.69 KB |
MD5:
f83774409321dfd77545b200f5acedf4
SHA1: cd6ae90ecac46c448f0a9c1a164afff2c3e6d1ca SHA256: a0ad3477b362793976e779dc29f70054132b775508c1dcb19b059cc5e545ff2d SSDeep: 3072:QW14PQ7tx+CTdIc0IqginQkx/DDgsDbBGfeuk+Fbf/02Lf4gmoq5J+z:QW77/+Wb3irBgsDbWjpKYnu5J+z |
|
|
| \\?\C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 92.50 KB |
MD5:
dc229f0b3025c31a1e5f32f9674f783f
SHA1: ff72f76564f8e819f40d2247c59616ed6e4d3d19 SHA256: 8440657d77a75cc093b888f6b515119064f334d0ad764d0cfd81572c2c16eb4c SSDeep: 1536:ReLocmnWPARABqLbiMeYIXcM+FQB8zz+Y5sj0VvTwksXHK/lFgKl+jq7rMC3Xer6:IUcmnWPuLuMehXcFFQBw2jYvXKxMHXeG |
|
|
| \\?\C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 35.74 KB |
MD5:
6dd72c88ce277d46c073143488d1c9f6
SHA1: ed8c0dd9e163cf5d9d20580f8635b766799868b0 SHA256: a5846ecca665a331cf63f8fb710275179c2a90c66be77b349e30b2feeea1f3f6 SSDeep: 768:b81ptYNUUo5ukT7Q2dEUoGoDYSCandsJo94ALwe0nTyPm6qcu/OZU3kkAu4f:mir4ELCm4Kwr2PDq12S0kE |
|
|
| \\?\C:\588bce7c90097ed212\netfx_Extended_x86.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 484.27 KB |
MD5:
602e2432d8df7fd96a4bba5b4a2bb687
SHA1: 1b9b4453119886b7d8850c777180d8acb81b161d SHA256: b3e085a8de407ad049515f40523fbff2e5bcc0be9c6307675a1f3672e61d94c0 SSDeep: 12288:bHFDQ+yRC4UWo6gvWpuTnvUwOqYUBHi0hbgShoS+b7:5U+yc4Ux6g+gTnvUwfBC02S+/ |
|
|
| \\?\C:\Program Files\Microsoft Office\AppXManifest.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 6.42 MB |
MD5:
4cdff17103bb7c7f7aa010e98f3ebc21
SHA1: c92470b97e164e748ae3d54dd98339913859655c SHA256: 4e29800b1563e8ae670210cc598894a5a46772508a0805fc466afa9f1d8bffa4 SSDeep: 49152:5qk3NIX3NIIaA5PSX53+QTdZnBeHsMxMOY52D7u:5qfakaX5uQTdu/Hl3u |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 378.60 KB |
MD5:
a696a5a4943e53be9ca83e8dbc9db79a
SHA1: 4b3925b2b699fb7ac215024635f449c7ddeed47b SHA256: 4a8397b5e54b8d060a2deef8f425cbf04389269ff75cbad96ad419917df1c576 SSDeep: 6144:fj5K6NbCsAinnt4fHGnxznmKVPJpv+8vopBEZK2+g6qIkjPVZDpiWlRQYW:LoG25SOfmxz5Jpv+8vopeZ96qIkrVHiJ |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.81 KB |
MD5:
6aa062667bbbb1f7b952e9d5d03da311
SHA1: cbb1d88beeefc236c51822de4d8a4958a37ca63b SHA256: 94f1b253874ea038490ed8fe525b01164019eec0e16a6d08ad8628b3f8353cbf SSDeep: 48:+pbt97JZEQQAB6CPpQqS8/oy9vLjgc14WdL:+pbr1ZEQQArPYKALwL |
|
|
| \\?\C:\588bce7c90097ed212\RGB9RAST_x64.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 180.77 KB |
MD5:
d02b5e2ffb41fd7271260b2d18baf4bf
SHA1: 71c11e01f8e688732cfcc44bee22b6da313d3e46 SHA256: cd237fd4371e200cd256be8e3f4e38de6616cc6d4a671a688ff3c7914bc8e0b7 SSDeep: 3072:hLPgFTgbsDETC+wbGNrEFx1C7f75JNLItUkx6hm1bufgxIjpnXeYsqcvN+ceOd:hL2SsITqKm1A5JJaUk8hYTxs5XeYsqc3 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 782.42 KB |
MD5:
6f25af13bd7f8a5b064b950ff91229cb
SHA1: 94325f04955fea0583ead6a7a126a6573db17f9d SHA256: 47ce5b91682380e1ba8695b57259144f7fb1754b2c59a84575028afcb0b3205c SSDeep: 12288:seOVNfsTnllBpeLzwiKeXC3mN2k9AipCr8mePYWpQRCqx1qIZMHxMSMepm:U4llB6zwf2xYr8mbFY8M6Xec |
|
|
| \\?\C:\588bce7c90097ed212\Setup.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 76.56 KB |
MD5:
06203b60232ba316fb7245a32fad3879
SHA1: c30244e1980af9db98c8cf1557d6b66a6bc39df1 SHA256: e085fbc781d46cdee83717952c018460dea5f43a7fb79413000ba67cf17438d5 SSDeep: 1536:JcsUJjRlSAF5HG2yHq24oYgp4kvUAJgwHRTxqLZX1wxV7Spdau:KsUJjG8G7uodp4k8AfCZXexV71u |
|
|
| \\?\C:\588bce7c90097ed212\SetupEngine.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 788.58 KB |
MD5:
4c9ed87ca107e9d33a670a0f9e72be23
SHA1: cd12c658fb1fb683bcd2d5aaf8c9c4b18cdeb58d SHA256: 73e5832c0bbf1d54fd9b431b0f46dc3bc480bb6ca0fc95d67dbaa8d91f06494f SSDeep: 24576:qGr9lukRNa5BjqF4gE0hJu7Gkxiv3HjOcec:q09lux1ueeJhP3HJr |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
9c6cf89fb8db5811501ab15721487480
SHA1: 610cc5f05589b20ad154a93298f2e4404956726c SHA256: c63343d97cf69159fc238976b384d66c83838bebd2beeb6ccb9d72a227ccee80 SSDeep: 24:yWlXA/i7yvMm5Y8HywH7eIcmwJpENs7a8UKVi3cDO/lOd+Fr+8Tqkrzi8L:BYiYMmp5GvUs7AKViMD+qo68ukdL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 485.21 KB |
MD5:
a4cae8e4cd905f27839f8f0693cfc640
SHA1: cf0405c87dc841b7b0465c2ddc7d27501939413c SHA256: dec64df3045d8982d5502b3ed7f48cc352b6e0803e6c1fc5291a673c22177d13 SSDeep: 12288:p4jj93gaMmz5HfWdkkbOBe2fiB7l02+3uwedk:yjj9g1YWdkkb0qSu9dk |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
79598036f21e1d07e7206955f9754016
SHA1: 58b250a51e5a4086e31a39227659e71f6c82f9cf SHA256: 040d624dd5744cf416af82cdf3c3a1a54be94aea552bc277f9999baf9e3833ca SSDeep: 24:HNXVFnOYN5uQTgrito1JOwN4vkSyAcwNGfwaPm/jdEuScAYNcaxtRrzi8L:HNSYN5uQTgrL1kBSAcSERm/jdEBFYRdL |
|
|
| \\?\C:\588bce7c90097ed212\SetupUi.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 288.58 KB |
MD5:
9934e756ceadbec48d53382d42a6c044
SHA1: 49f2337c655774df6ce775a07eef6fb18bcb4eac SHA256: 799be30c79c8668228225555d3cce180aff1bbe134778590e2cc3ef2e84017f5 SSDeep: 6144:AuAVcf54W+97PfucUiH+9MuwiWV0qqZhar9X458wdVZykXWhu2wIcG:AuAah4J7eY7imN8orh4SwdVkkuRwpG |
|
|
| \\?\C:\588bce7c90097ed212\SetupUtility.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 94.10 KB |
MD5:
9822c31c84b8452fc9e131d686353748
SHA1: 30b0f0868f01b521d4e4bf6d34d5917898929d51 SHA256: 25638745d2f7d32ea7cf968659aec2205db8e5d7ea7bc6f5d9cce3bc03ec7241 SSDeep: 1536:KwlcKBBT2KFgKjxB14W+i3/fPQ6L36R8pc607eBvertgZ33zKvRUwiqPcyNGFjf:K/KBBT2KOSqiPfPQA3qcAcWo3jKgINGd |
|
|
| \\?\C:\588bce7c90097ed212\sqmapi.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 141.28 KB |
MD5:
bad915ebf4e69a85e4414bf2981461af
SHA1: 0c6636167618dc5ddeb77b86134fb98dde668f67 SHA256: 1dbc8aea9db5f5f8e9a8b780d66c668dafc8cfc4f64f45dbe4afcb4ee64843f6 SSDeep: 3072:3nw3IyPx2TAgw+5ncK0G0iPVFzPTkWWg7yiq0ACws3ZVL8KBa6XH:3nw3nPgTHh5nfZv31KYdPLA6X |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 248.10 KB |
MD5:
c390193ed2ee1afeda0ed1d6edc81010
SHA1: fa6fd2d108a49472ef5c68a19fdac390a5ecb763 SHA256: 02cc9ecc4ffd23815332aa8f859ebb93287610966ec63b1ef8e1d4441035f295 SSDeep: 6144:eoc/zgzm/OT1EtyX1Au1ua9E49fUbVLPlVUeUA:eB/tK1EYFNNrfcZlVR |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
706e21204794ebf5c1b0fa86c959956e
SHA1: d7a594603aa8e8f20d84bce23c05e031fb792aa8 SHA256: 77249a0b8c89e276b86f5864da24a6b83c25a40f01e7509849c8eb2a1b5d8165 SSDeep: 48:uwgH84JGP3stkikeRgiymQ1OfZoCgQ9XnVc8n7T8bNk0dL:uGPP+BkeKh3OfZoCgQ9X8OmL |
|
|
| \\?\C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.71 MB |
MD5:
b97361748793ebac692b33b803ad934f
SHA1: 6dd4967caabfb80af1b8012e7a2b228a608f73db SHA256: 310ae94e81639a81a2b4fdde908a77ea2cb670cb2bf7d5ab0b6b163c0bfc7eaa SSDeep: 98304:uuEAUjb7BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKyJg0fzRn:e3PBkOK2Knq45mY4H5OMKkKQ/l |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.07 MB |
MD5:
c0d541d715671c9b1224ad646eb68c8d
SHA1: f3e40364d35d66f6e31ff7da96c407a24da0bb70 SHA256: d2efd712ccf77ba8184e8c29e28d9b92910adc1806c81b82811667920633ccb6 SSDeep: 24576:C8C+PpLptM2wtYj/S/63qOhISf7Hiuy2M5XV3IwQsZjuFE2K:aqLptM2wtYjq/66a7HiuyND4wvjelK |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 19.31 KB |
MD5:
bbdb49a0e521ea3e11279212fde2e953
SHA1: da00e2b92eabde6352c54424a32a3a940ef16466 SHA256: 55d05634e0df2714753536e54344c4308ba7b9378772793f2b049775ede9ecdb SSDeep: 384:WDbf+wo5FEstjbWWyJkqix9HWWHCxXsFIR0WUDdqtkt1AW5nm1qElZ5I0b9Po:WfBo5FNtjbVR9HlHCx8eR0jTj35nmvOJ |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 745.80 KB |
MD5:
0bd0cb0338b0bf453a6aaed77793dbbb
SHA1: 0896c0b907e7870404fdbf9dc4fddda435411927 SHA256: cfc46c9f7946df4d02f15fe6f4badcc01201a9b7a409d2884abe97722766a273 SSDeep: 12288:b8cLVHqIRCw1N2MQr3xQdyP/X/ZznP7335wgWaihIbCFOmegdASwH2cXQ8BWQi:bqI11N2ThQ0P/Rv335jlki279wHlXFi |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
0f5ad065fdd56802f2c8719baeb604d5
SHA1: 20038bca025d9b3148262d56dcc9f958f567326d SHA256: ba9b8716c91dcfa2d8fb073988d2947dd5f08b5e941e84694d4fcbdcfc58ec7d SSDeep: 48:My5Ow+UiIofOnSe8PvaDv9vywBFb8qEpTzZTrpYdL:N/WIofvtPCD1KJqc9pqL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.42 KB |
MD5:
2ee25199c8d9efa8b3287b981dce67fc
SHA1: 4baf7aa5c5e0d24b9c31698cd46eddbb56af2075 SHA256: 09b0e33a35f5f9c5d0326cea9db459449a0f2051cf1fe934f7521979c2eabb72 SSDeep: 48:04l7ZvyPfpRjruCFa2roktp/FhFENgWUZl16TBoYoP4CNgCdL:049ZaPfyCFf/FiFCl1hbNgcL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
6fd1f7104175134380ff2dd71414e8ab
SHA1: 474b06ef83d7d1a4236473bdbeade58ab809568a SHA256: 766ec91b6038992d5e450a48e88ebfca6b9b49081429683c0cc511cbecce6709 SSDeep: 48:d/+/+iXM5btr5mVTAjUZ8wXqK6/U8nmdL:dm/jXmZr5mV0wXJsKL |
|
|
| \\?\C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.84 MB |
MD5:
368b7ab42ff04fbdbacee95daaaa5f4f
SHA1: 06dfbf9a4fa0b3258a86b3977756ee82322ac548 SHA256: 2479be2521076adaae5206fb00a8bb5ee8246a983c71cdcda82491ccaa45e211 SSDeep: 49152:WV4YaGoDumT1r7AdXZy9KU2KUYxs35DKZ3OIKBJ8tPBiJJlinOMH6kglo/1n/:WV4Yab1PAdXZzKUYxs3pKZnKz8tJYJda |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.42 KB |
MD5:
b9c779a87602a5490d1aa211d85ab7b0
SHA1: c4d8672e105e6806881191883f04fa86d05b1a8f SHA256: f0e321bab1f7776c42695ebd233b22f642463220238b57297cb51f012138bbb1 SSDeep: 48:DF8hn4Lhv+/cN5GW9r1rIy9QK6NYsiZSA+8d6Oy7p+/ox0hIOYtowvcdL:DgCP5ZrL9QcJZwUyVsomK7t1GL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 211.14 KB |
MD5:
6e9f6e6ac104faa2885586a28af100d6
SHA1: 660b9c148074de442e2de29565f26fcaa42694c9 SHA256: 8e01bdd21a00b3747034231fbc0ccedc943a8c1c1785890be44042d1cc63d792 SSDeep: 6144:P+W4t8RT9xXQGDrAcrGM1yJko2dZloCSOCb:7dFnAqAciwUkogzp+ |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
37a0f9d4d7daf0bd26be065306db886c
SHA1: 15130dd3f3580eeb1ad878308a79b9420f6fc363 SHA256: 500a757683b28aa49a0b4a2f2a3434dc44b9ee67ae167fee94b261a238bd5753 SSDeep: 48:hFTTxvikzpteoosm9nitkTTisru7B1YzRCnv6wdL:hl1vbpteoW4tgGzszaL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
4e4c22bea8c9f43b03e8fddc700db7a6
SHA1: 3e7f15a46d243dc9abe0e524d6a85032beb40562 SHA256: eb2da2f56336bef7fb4089324d0401c4e533f25294b14a8f866822462aa7d65d SSDeep: 48:iUxO7n9BEP/v2kmGQeiNPp+6VNPrCsmaiBdL:gnPuGdJ1zC1bL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 335.61 KB |
MD5:
93e526f6b896da69d2f4c4773f8b9339
SHA1: 112f40fdbb98829374b784981662da293b07db5e SHA256: 2e5b0de4ec7d9766ee042aa65fa4ecadb479e83bca2dde3eddbc7cc7616346e9 SSDeep: 6144:N1rnvqvq+PTXiwRNMUlAuEuH/8Sh+3cHs/+VcbcmfZAxxr0N6yOfvkhLCfmXIZAc:N1rnvqi+PTXBNM06uESM3MsNjAxxGpe1 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 14.89 KB |
MD5:
2987dbfe62bcb415de4e59b47f8b8ea8
SHA1: 087ce45e08984f4e5df8a98168857c8e91385a43 SHA256: a4269bf7de51c5ed4edc7c4cc0e1ebe0a4c06c632ed15cb0d1f0b392b212c5ad SSDeep: 384:rXpnbZEwVhs0xB7tNHFzi1abthLiFC2nrAkt:9bOwVS0xB7lziG58C0t |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 349.30 KB |
MD5:
3a001304da933fff06693b71c5f2781c
SHA1: 26f70b0735fe2320b0db295c1d530dc069936234 SHA256: 0573f20cd6577c1876d1351a6471bb5d0dc89e4a55947c3846a96152368abea8 SSDeep: 6144:ALHlgM0CqtAQuBZdE3wv2qN4W2rlmWG4KIpen+YaSapOe91CLNbtfqQXSvat:ALHWltPWDEIjN4WGaqenTaX/gPiv4 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
d35de197795d51227deab64f45d3dd25
SHA1: 35b3154799e67c18da16f3a93d9e04ee3dbc9e53 SHA256: 12770aa1d2e7edc77f4d6db3872eae88923fa12097cdd3817f36b94925443905 SSDeep: 24:/+E+unTXTVCyGVaiANQr7zl0XLQ36b8XRM3rPWANJLdpe0ncLjI0Y8VKjg0jerzN:7+AhAV7JDlUGiP17Xe0cHYrNjedL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
74eaf206e5504d812ddbf63e84ebbb18
SHA1: 545a462af556e81ecead04bd4d32faac83409c37 SHA256: d8bccabd21060f4bf1bf902900327d352118b471f4ec4c49afcb174f4ef60c38 SSDeep: 24:rYAzhRQiksNxWuxyEQv9DS5ACLh7s61ASKWLCfd7AcrNbdeywDoyGPrzi8L:/QipNTpAS5lLtg5fd7lrbeDGdL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 63.80 KB |
MD5:
dd9ab3da40b441df12fd1f3054fbbf65
SHA1: 6116cd8268ce27e28effe09e6e0e8d240d59a0d6 SHA256: b980faecc5b4c5aa243ba1df6f16e7634e31f11bd08db553b624203ba9444aa7 SSDeep: 1536:JRucBOJ3TCTAlrB98Np8GSgR8eZBP1FsByV7YUdW5OqvB76:JDsJXrL8z8GzRrLj8yV5KvB+ |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
c0f5228ff86cb635e87726b5724fd6b1
SHA1: de8a6d48ee3a84ba2a34a8d06dd64931e8c988b0 SHA256: 0a11a33fcaaeee40ea08ac25a192bcafddda57c8683a00bb77b1853ab84ee173 SSDeep: 24:h1Ad2RAX2/NdO0HTFyeZbvvj00VEmWjiEmR3AnbbeNy4koPRkl8i0Frzi8L:/A0WUnzFyeZbHjpEmWWEeA/ayTxSfFdL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
db62cb1d9c811beff52fcc4fc8549c13
SHA1: a3ca968e099dcd00802d581785471587d5b8fb40 SHA256: abb31045317d043fe1aa3107c5af1c65af9d613a91ffe1d72a39d86749e74354 SSDeep: 24:hZ1JpmAvX2qnmX7U9z6hURxc4eoQxaV/5ciETHKjG3d48u2Qerzi8L:X1J8APbY76GhURxJZ5ciOqjGN4l27dL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 9.33 KB |
MD5:
a6428ad03059217eb5dd1aecb6fbb1f2
SHA1: 764fae9f9981e1b437843ff7f7b8e6f55e0a49c1 SHA256: 855c2497b9298ca7927873eb12e885778327d907e284d0ec886263b75efbe02d SSDeep: 192:uXmSNaozGghuhW5babZ8JkrTsevAKDWil4H9:uXmSNaOXFBabCJ0AGU9 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 390.49 KB |
MD5:
1127c7496bab524c2f30a60aecc1d987
SHA1: 867a0b6379420f4d6339d9f9019db0843d445ffb SHA256: 0ef8aebddb90fb62f3c41fb48a58021be75591301bc3d39ecb5859a7e8f2b465 SSDeep: 6144:IffVmFzYGWOaHsTBJVM/zgY0M3KvUAEpIDPZqBrlbGwqc4TGcsHyxPq9alCKtnx2:ytmBYGWl0gEYiHEpVBpbGwqXERsdtxxI |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
278af4fe77a0a6605e0cc2460b6c18ca
SHA1: 669a04578f433ca8b53e11dea88df7c03ab36c62 SHA256: e2852d41f52790071842e6abc30d58a65b38f7b724a49c91bea2a4b0836e49f8 SSDeep: 48:nBCbmJ81F+cB9oOGISK1TZ7Rf2wluvYqskvzudL:QS+mVOGjK1TZIwMvls0zIL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
ff45c14d49df2b5f19393f4b21c148e7
SHA1: e650261cac59156ea2802b51fbcd92bdf36c9243 SHA256: c35473c7550b7e4edd03f0226735f0d40f2287f78597efafc0134f17c9b8353a SSDeep: 48:7Ms94sDnzjukr3arK9sJJVllp1B8W4DqIv+WVvSoyD6dL:7Mbrkr3aUsJJ/M2W+WBYDUL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.74 KB |
MD5:
b0677bb755036a369ba54b89414a7f98
SHA1: b6c600606aa53f775bb15302fc19874f94e9d954 SHA256: 35ac61bc9449a568936e27ad06f7d4858d910efaa69a6163857a958d8b1cf926 SSDeep: 48:BFbBVPIs9XKTP9TD9YmedoIqguHM/nMYc09dL:bHPIppTxXeeIu/CL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.99 KB |
MD5:
c076b89eb1445b3e80717c77deab7eaa
SHA1: 8f303f1d52795c31b674bd0aeec24ddb34e647fb SHA256: 811e6279066d95b9cb1736afa80006d315feeed57de20932b2ffd997f2f633be SSDeep: 96:rlx4Fl9+wuFzijLJhI0t2ppH5zOLNRStpiHkxL:hx4FlAw1Ji0t2XYZRQge |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
7b5077f0a14f252e13fd5bfa64a6f9bc
SHA1: b059e39fa968bc9fbb4e965ce4a7f631c6039df2 SHA256: de82339a7abfc47bcedffe365d56b76b3f27b83245a6425e659c22afd36642ed SSDeep: 24:hJRztIs33WjNKt/Z8CQOy0qmY4yiwwvag/wrhwj+CxQfu1rzi8L:VpTM9gvyiwwvkrhwj+CxQfUdL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
1028384023c369bde7734ffe8659d288
SHA1: 77503c263d0068562932560cc48a7fc2fd531bdf SHA256: 407a3f3e8e6165458020b44f29456ff2af7adb292ad7af0988cf70f8befba79b SSDeep: 48:j5Knt+F+l1eQVyBo5BwckzxjczV8W2BdL:Ufb3fwDzxy2XL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
e252e157ec62cd276ec940fd3291bd0c
SHA1: 5f2f2c03b3afd79420cfee0029098fdde7f268f7 SHA256: 432f21971e9b86f7d884fbd2b4418e4f1885da902c23994e49e37009e646c6a0 SSDeep: 24:lZhVS+qla/G9yDMX8IQnPKNflKhJmdGSxt0QMHjS5EoMuE4DXCZSwZt7YNx2nrzN:XhxHwXuPKmwxt0xandXCkwZ+qdL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.55 KB |
MD5:
3f15712dc2a811d21e3fc5a0c9a92b9f
SHA1: f1fba37875945b8d78aa288be1b6624bdef40043 SHA256: c26b243fee2d95adb6d7ba638dfac6a1e62033b72011392b57fcaf2af776b391 SSDeep: 48:Bhd0IJaEOI9mtPcbYA18egq1aON72W56zZb2WdL:BhOm1OkkqgAaWxwZCwL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 515.91 KB |
MD5:
c56f144e62fe13e18efaaafd0bda390b
SHA1: 093bc75af130c04526c6f95ec5122b41915305a2 SHA256: 767d7fe54b3b0c0d3f98c62c9a1993e8da31fb0c28267babc79d3ec63dcf57ca SSDeep: 12288:B4oGrdX2hzngxODqcpuDAebc1I4b6pdhJj3lnO5wHw:Bi92tngxOCDAW+GpdhJj3YyQ |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.61 KB |
MD5:
be594e74e0ae54ade8c48958931bf948
SHA1: 825dd0d6707cbb007a3211da70fd093e5b324393 SHA256: 7b695b2cec8ab64da730dd5876e0809e08d5efd95f100c01aead3f7c451acea1 SSDeep: 96:Sez1nVJnaGU+025Ob/U0sbH2z9Dx4Mw6K40YowFL:9nnsDOOb/ReH2zUMwElF |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 9.88 KB |
MD5:
21850adf71885b335bd64d35c9e75420
SHA1: ab9be96514e2bf92e905e550553b1099155e4745 SHA256: 90ddc065957e41e983718e5fc2ba0ebbdbdd07568bacfed30437296eba9b762f SSDeep: 192:XWEXqUaBxRumjoa4a9jVWXKKAE1wj6vT3dnshRGjCxiORm+M4UihNNK1:DXqUKRu1a4a9jV9jE1nL3Fsh1RQ8hPi |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 642 bytes |
MD5:
0a3785b2ee652b170fc592d0b79fe285
SHA1: e768ad9fb859c66c6e9f8cfd8e46f07a7c658b69 SHA256: 7c9e9ddff6448c6a5ece7c40b6c415861a0d58804d45282b0f1d288909260d79 SSDeep: 12:lGaTWe8CLCrsU8wkrEpwlVbo1v1EBOvyacyHmYDjpVrz0T/8Ln:lGaie8C2rD8TEilVk1vExyHmYDHrzi8L |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 9.06 KB |
MD5:
0997eb7cf7917c38fa277b40342910c6
SHA1: 2b0aafc6278005e10a69659fb29c501a78f9a015 SHA256: 552307fd585aaaebfff9d03bcff648654b0d470b10780b1512027c6b54a46a64 SSDeep: 192:G/ODRIn8eCsdvLAxhOF2o3k53Z9l6mWEZ/BPrcS+gp9yF3JH:GcIn8eCsdjAxsF2n5JzXZ/BPx0B |
|
|
| \\?\C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.61 MB |
MD5:
70fa70ed91dd0ea93765fca7345e12fe
SHA1: 4f42d1748d4d534c3dfd0c5b664d91c80fcbca5d SHA256: a721beeacb965420f49fd829f627a1afb720cad2e80fabee97da6ed62464298b SSDeep: 98304:Ef0pKGBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDKBOyNCQcg5W:27GBHTK8KXZ4UuY1kB1iKFK4g4 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 14.77 KB |
MD5:
393378cff5bd6027fae01c47fed140fe
SHA1: b71745e7a92b88090fc073c73df733dd452352f1 SHA256: 5d5c9e7dceb6ba4daa47fc04ea1ba38f50a2cd880d4c27db42d25b3ba6ea6312 SSDeep: 384:2bc+hBcBdgzV3w0Fdda0XWO4acIalj8iMyeczggsFsEehmQFYHv7GnckZ:uhhBcBdgzdw040paljllv0yhmzHv7GbZ |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 6.77 KB |
MD5:
62baaf95daefd1bb629c5493c94b192e
SHA1: 5a5e7746ed553b65c08c0184fcfdf65adffff5eb SHA256: 20cf4328fed86c342cc5e0ac20117fcc1b99388a13dd84d4a6602b52ceccdbcd SSDeep: 192:W5riA9x5BOEqaVALnilDX89qt4J5WoS3Tk0:I7L3q96DX8RWHA0 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.42 KB |
MD5:
9e6af408ffe8c2cd0a17189fb7e604e7
SHA1: 26a901d8f1f2cf62d18183532af38990816b69bd SHA256: 40f163c16190f24c844366930c184001f75fe9184658c4805a741004f041f6d1 SSDeep: 48:aubloMJroD5wxGiOkWubzAhiCVDQUxcvAJJ4w0sLhHO1LZTcR3SBVX9l28Q4:akloMJrOzxu+s6aA34cdHO1Vrp9lb |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 8.16 KB |
MD5:
af97624508e793e990edd34c8ddd9d35
SHA1: da82db79316dbb825d7e2ed4e1fd54c618bf9c5d SHA256: 960cece71082cc2d60e67632c6924899fc98bf8cad5abe9632ffbc6e5bc398f9 SSDeep: 192:I0i5+dLdbwuos/MYKlaxzBw94gKpTsG+ma:IDYJbE2zC43Td+ma |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.82 MB |
MD5:
40489ed798e80babf37a952b01b5544f
SHA1: 0338a0079af923fdd93a91dfcb7baddee4d430ee SHA256: 0cb7de47483215c00f133c377162fbfbfe15b1776b8fc65556e0156839608799 SSDeep: 12288:LOI1zMntulWZRFsImIzgiPeV1ol7mxugC+bfVUu0SeQsmDnZQCYGiYCTOzVh:L4ntuo9hbPeVgwtUu0SegZQtnYC6zz |
|
|
| \\?\C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.79 MB |
MD5:
b1340a930c864b9f78c42ac55df53504
SHA1: 1e29eca4371bf2accbee72a2884cfaa6a43c703f SHA256: dd9a9e078782af4b924095604f9bbf6e6a8e58e80470d50d99f8f6efb39a6cae SSDeep: 49152:oJ6tDuv7GuMRau8yuXQFKUYcs3HVKf3rhKLroY/MD3E+U7ZihepAaxSl:oJbGnRau84KUYcs31KfFKLMKM3E+KiYe |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 7.75 KB |
MD5:
d8180ca4925a0de49d2818895320df6c
SHA1: 12fea09a16aad5555d0cced07d654f94eec65bcf SHA256: 45a8661b59d416b266426d56e150d9002dc298b340f8d8e126de17b534903da0 SSDeep: 192:BTLT1tJfdBJvZ6pavWTF8xewICbLFaepHFaD2OIsBo:9LTzJjJvmavIF8xbbLEepH2Iv |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 11.86 KB |
MD5:
40c1895191c30e5f9a62582044c7c668
SHA1: 76aafffc23ef5b9cfb418d39f7c7a82d24de7c7f SHA256: 51434d94f64eea7615e2b25efdc86b623c07cc140d742285710e9866b4e9333d SSDeep: 192:2W8CJSOhWmlA1Uv5ShpIiEGYwjvgquoGelw99PHIVIrYu0eQ4zn/sCC:kCtRiURSXIiEGYwMN39PILu07 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 770 bytes |
MD5:
88a44f1ace67f3561a0d63f69a1e92f3
SHA1: 9f73a176179fe468c225b42cd9de4b12c9bbc820 SHA256: 8b3f2d1d0232c41bcc2871baf5219c1a8b20ceb28e87969f990d736143d1b85b SSDeep: 12:op8OI2emcpjQRhFy1X4aLO1iNTmqdtc40p/yBYgCO+OCpVrz0T/2Un:oFI5dpjQzQLJ3P0dyBYgL+O0rziV |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 754 bytes |
MD5:
452e0b830a19e4eadef34a0ffa115464
SHA1: 18c7c1eaff58c3085f111d98fa0ff72e54395142 SHA256: a3d5aa2b52212a330c0664cd1ac2a0cbb3da32b3d672895ec7a22cba5a042866 SSDeep: 12:/d+U5q9VGp0ImkJyopdGqCw7NyGUYG0APt/rn0THjpVrz0T/2Un:/8oqLGwkJbdzZByGfG0Ctz+nrziV |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 12.64 KB |
MD5:
f8026dde385a908b6c25796d76b25111
SHA1: 850a22edd87d1dba849675a4b4465dd447a812a3 SHA256: f7e64e7f8fefb5134bdbf2312351a595d353b8872bcf086ef96142b8972f3072 SSDeep: 384:gw+COXQxQJFoSshOwweJdsRF8E0P654LOQjL96P8C6CSKA:h+7gxQJFE0ww4dgeEym4rjL9rC5Y |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.31 KB |
MD5:
2b8c8fb0b7f33815a0d3a0861f287d28
SHA1: 40d9087b653797886ca5c7fcdd775ed930c807e1 SHA256: 237319848ad60b2e47e6723b7a77aaf6c63480b263563a5e00d3ab1006eb365c SSDeep: 96:8QB8EhzXF5XnlDyeTBU+Vljcy+HT3IAgRX:N1NVR9N/jDyrc |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 12.44 KB |
MD5:
7b684c79055962d9320249d44b0d2f71
SHA1: aa650c25208ace895701f71a9656c907894922a2 SHA256: 9049bdc01ae9eda795b634f898f80ba8724929b98d856e34e473763614287973 SSDeep: 192:xVBiCDp6+NXjsrjBr6iJfJ3VGEaFtRLYiootKxpQ+W/4xt4OhleCdfqTm:LBrwGTsrVr6+J3MTtRLqosxQ/40OTqTm |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.64 KB |
MD5:
3ad5d3b93626bd1dedb8fb696bb55225
SHA1: 3c8d6b7eef9ff46fb5970c7e27218a203c3526d7 SHA256: 7d64e01979a04d3dbf56d2d03ea6c975456b279a68f811f380380fd731651f2c SSDeep: 96:MXotNTLh0at8QpMf8jKCi6HUOfI36HxGAW89:MXotRh0atv+f8jliEw36HxGbM |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.38 KB |
MD5:
64d72aafba0cde817d572737ec1a68f1
SHA1: 88f13a39776b132bb9a380b3f6b0826dc0689e74 SHA256: 3e9af7940a41230871da243fff6a8f378e20b238d01f9899d9a5efaf594a3c52 SSDeep: 96:GpqvxAbpPpRi6iR0zVdgQlT2/M+IgwkzdcLDFn8bWnH+45zwBJmWFNuZ:Uc2pPpNY0XBlq/M+IrkzdcLDibWHF58E |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 10.60 KB |
MD5:
1ccfa8ce73ed0c49f9e14082789796ca
SHA1: ed4022e7e373c30b45819dc6a9e94e86b22ddac1 SHA256: bb6217e1e75d9632990a93df752bcea813255d81d9817115434f4c57a8b5e267 SSDeep: 192:NBf7i3WWKN4ZamRAd/0tHow2pTW8YicmgpL2fjC8MfYtxleVqsKKj0b0cCeNBB/:PTeWzKQmRAl0Now2pCyc3aMA3OWrCex/ |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.78 KB |
MD5:
c2458bbf228417aee7f37a5f63cc8dfc
SHA1: c36856e0ecc3daeb3d806feda655e8fecbab43c6 SHA256: 8d63ad350d714fcd475e472f79dff68169413bfd2071141e331a1b9e549f6513 SSDeep: 48:gsgKGYJzHF6j0XjSARQ5dQM9L2WPu4yanmdW67HSojMah/9Pr5gu+aAoxw4:xgKGEl64XjSld1rm4yPUjKmuoO |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.16 KB |
MD5:
4d60a92f45230e68aae2ce1833e21cac
SHA1: a4841a7f0038bc3099f9594b6b97223ff718d157 SHA256: 8a61608b2bcbda910a5c81fbd0e25165b1c61b80c3638c4106bbccf0427f99b0 SSDeep: 96:lZPjrvMnTdHhKaEo4+ktRFtu+jzagV57NPzzgKFIUncCSRj41EQ6kktsAEfAkI:3brTe4PtRFtagV57NzFvncCq41/GsAw2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.08 KB |
MD5:
7c6e559a02533f80367d839e2af31738
SHA1: 13209fe11d780dc1927d080c032cb7ceaac03369 SHA256: ad6aa1aac04fdc611fbd18531da5027b373591fce42df3d05d095f5b411d5e50 SSDeep: 96:Wa6eC+7KivsNq+N3FvTK5xV+e/rt5lSIvORiP3Ze0g9pKc1:O+loB4DFrTTGgPJe0g9t |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 7.64 KB |
MD5:
38fa27c28010f6dcefbf914a65501606
SHA1: 71c3c1419f2267e3aaa690cfb7f7fbfcd3aebaa1 SHA256: 748bdc36a6d3f0b897c8e9dc8956ebc89bdb227b40f43a172a23065a66d6f3a5 SSDeep: 192:PF/nv7gAUfSuGsiMRxHklQ3E3MoXfJaYWQ3J3VGOKtzhO1xlf:P9GSfs5xHklNhaM3TglO1nf |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.36 KB |
MD5:
4bf19de9403716712e7f7214a965407a
SHA1: 2b5e07897dcc8262b0d209d9bab7e3846e3baaab SHA256: e672a59497388abb0789350628de9e0bd3ea0b5fb5741bfb05af132a8c15858f SSDeep: 24:/kd4LbaPgxkC3LoxoWBFdOguAuHmqDlI1lIrjgf5turfqKpEi66forziV:6abaqZbOFIg5elI1yrcf5turSJP6fo4 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 7.06 KB |
MD5:
c9bd4829ab8d4fc405624ead1c8696e0
SHA1: 361f074ff967f0fd0cb7f87e55463f8d1769ef51 SHA256: b78b724b36b3de79b25739a367cd2a76df212699dfb879a86206b477765ab1a4 SSDeep: 192:GO9jboeAsLa8Hz4wLujJQ66fcYMIEfe1gTa:GqjboFIa8HhLIQ66fkIE21gO |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 13.19 KB |
MD5:
f2f4a673123eda1c1395be9acfb6e17d
SHA1: 4bbd691fd86542dc3a8303d4ecc5e4639acea310 SHA256: 27d236ac68e40a3893aa41a99924e3c324837875dcce52d3e41d48e0d57423e3 SSDeep: 384:zLiNqleXvJLv77XDcCMN6pfSqhZ69e75HvMmvN+:CNqlIxz7fuiSeZ6Q75HUmvY |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.02 KB |
MD5:
b1e2cb03a2bbb7b2b39b4cda48d9f37d
SHA1: f9501330f9eb01a2a35d7bd02e1433197f641172 SHA256: 90f39333f0bc5290e16126b9535a4e8cc0850156262c7509dea69e4ac4592544 SSDeep: 96:RJWrf/6zkEGrm+XBl5Kaqt0dvFpUSc6ssRs8avLtiYO3jhNnjwiQ0WEX:ROf/6mboRulUSls8UiYOThNkiDX |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 8.63 KB |
MD5:
a492edd0713326a7504bb0483a6f7209
SHA1: d2ec09de16904acdf04945a849f8e5b0066cbd24 SHA256: 20da2361e32e68347f8c3f3ea5e07c84b61dbabdfb8e18f7462b85918c86a45b SSDeep: 192:4jWVQWEUCk9fMST+bbDJkkzdD69GlcAvzAIy7WRiehf:4YQWhlcbDJkkJuclHdy76 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.49 KB |
MD5:
44cc6f65317a0bd189c18b6382c61530
SHA1: ea9b61a51962f3c11e9c14093aec0d86615fc785 SHA256: bbe5ba6f9bdcea6301e4a5d58a1420970283cf77a06a215d48d1a94d0ddda723 SSDeep: 96:EK4LwHONqS3vxG6tgAzB8clMqXPsryxdfA4nzy4fUAlpwCwdM3uehQ+PXX18GeFs:8NqS3pG6yONMqXPsrep/m40TcuuNPXmO |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.14 KB |
MD5:
91f7d8124d3b6deb0563c667f72bf22a
SHA1: e4cf3830030592747beab961f31345f95f6afaa1 SHA256: b832e6be8664d18d12eac89638408142bc9612cd3b182a530fbfc8367027452a SSDeep: 96:1q0gx0+tGrS7DoqgI1jzre0s89lVmh5SU5KhirXOm+BOEA:mx0+GrnYj3swU5Kh6ODBOV |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 9.28 KB |
MD5:
77ff500d86ba2b3752be4b7e5563f4a6
SHA1: e68c4effef8ff6e4d9ed84515467ab9f61ff3213 SHA256: 1fbee9d5fa2777890f071c0396690b4382d94c430396aedd5d183f8d252f8a93 SSDeep: 192:54GfOZ2LR3n95VkCSkFVMCn+4Sauwii9MB/gizbZx:54Gfv395Sfin+/aus9MB4izb7 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.53 KB |
MD5:
1765dab58fe2df0c0dd43d32acc2651c
SHA1: c5040bf187bdbe3b8fb9dc4fa7c8adeba10c503c SHA256: 887ba9c2710fd9f51d98f6be53ff870af03846e03751a9326eaba13adb694b16 SSDeep: 96:EjhHaynXNTMffK3zVJzBFdplo+D0rhXtH5wBi+HD3jhD:DynXNTsfi37ldW9ZwBi+j3jhD |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.11 KB |
MD5:
8517ee4176998f96ba73b1669c9c6932
SHA1: 4be5707a2c7d858dcf573e51ed731b2fb3b8bdaa SHA256: f4e4b4dd271b22b2bfc15379ad1f44bb3c9f8eb770aa14d6ce872e39c9d79c58 SSDeep: 96:9Wd95miwQg7Em2j2jQfPAwkSbyQ1nNvAscapj832VZEz43:YRmizg7Sj2sXAtSbyQ5NYsc4832VZEz8 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.55 KB |
MD5:
4f3518b194b73be3fc2793d3c421afad
SHA1: e0a728ffd16bad8626307fc56bfc6d98966de9ea SHA256: a56d5a7817d286489da2bc56eaa65d6ee4041b3e98f8789bb88b0afc01e35e01 SSDeep: 48:Qp3sQ1cbKuaoPHJJ+i9cP6u0YdNiqOmYtRiWwwA8zu7+s9zuzlZv4nek+/azKQyi:Qp/nGpN4J02NYHqFwAXB9zevASSNzkY |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.30 KB |
MD5:
1f97d42988c520379f9b377d03a47edd
SHA1: f1b26cefe85d7eaf7e3f1ccd31c83c92874e0426 SHA256: b1152a57a3cf79d7d8117d874d79762f1b8b91c37c4dc45737165d46a3d1da76 SSDeep: 96:5rbz0sPOSO23zLEzmopQZhxlD7Jeell63EFeteiradVMTvJ:ldOSWv8D7Jdl63yetewauLJ |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.86 KB |
MD5:
f003d1490a7575b1ad6b1a86fce1cf5b
SHA1: eda52271f8f93cd1b1dec398dfb86e39d96902d6 SHA256: f04b580057efae84f9ffe64c907cbbe255ae1aedec5ba5f91ede65d931197fbb SSDeep: 96:W1FR2eYvfY5pLxTE50tX0oebP6plb4I5Vu1NAUbdpOOViOq:YFsYJq6cejbp5Q1+VOV2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.21 KB |
MD5:
53f9e2d30583c792d22cdbf8a35da415
SHA1: 159291a2832989243e1b3d876f21e5ca3f18bae6 SHA256: fb24da8b102467e090d9aa4e51a63f8a84b9335e11010587fb8c845f3549d46b SSDeep: 48:cicclHXWWvOsGLT+f62fUhWE+MMDjzSFKRa+fARIZoAy8uy5gy29G4:cMBX5WsGLa62fUAa6XSUwIAyey2j |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.80 KB |
MD5:
e3c94ae853b87d279bed0e81a314563c
SHA1: 0b54362482c5298f5ebbaa1f86e46549a3df7559 SHA256: ee8465fda39039680211e01a53bed1f3c77b7b0e0a7243405924400b191774c9 SSDeep: 96:25zzk6vGVHRPSrYU7M85p70MOipq3lE8m+KiC5H9oJXTZVDhoU7mu1lO+PKkj2cb:2VXGpRPSrY6Mu77UnmHiC5HGRT+MfO5k |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 20.35 KB |
MD5:
897793c6e755587d6ebe6b3d126fe8ae
SHA1: 5804ebb45724628a3c0cb4dbafd4d8cb16ef2b7f SHA256: aab0892cff06756b132d317b085a494d5a79f32c24751d376366aa8cd9324d14 SSDeep: 384:/PA0zS9TEPrub+YQhxRvoZxt2A1YMxKI7EpQyt9dn:RuCuFMOwAefQ+QcR |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 10.83 KB |
MD5:
3041e1500d7b07c687756b6bf83e6ed3
SHA1: 42fdfbf3a71cd4a489e696c5974121df48a989f2 SHA256: 00ca62aa6ad50daf6441daf7a915b71422d31673931862b3a6adc82ff26b8f4b SSDeep: 192:kHXOGhAtGJeoHXErb7H2a7PaRq41ZaXm2LRXRf1yW2S:k1KtEZHGXIZqJRIY |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 14.33 KB |
MD5:
1c986b9ed92c58abf453d0fe866e121d
SHA1: 220a7ef07af9edf24e451e85f9e8422ba66a300d SHA256: d54d99e333beb644deec3ef52150aacb77f61bb30d03613e53223e7b4aaad30d SSDeep: 384:kBp2jcf2ksx9vXZsyeJj4hud/Ai9kgMm33DBZ6mu6DzULms:kijP5Xqy0j4Ed/J9RMmn90mu8Aj |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.52 KB |
MD5:
51d5c9bd4c8a40bd65b5fe6ae6bc4376
SHA1: 75b5120ff1768651aca9a3839bb90ed9a10c0aa9 SHA256: 97e83e3da33544d91274ec29916e49b7c0a6e8b1090385aa0f09e5950416177d SSDeep: 96:a6kTbAt/XcOo+jgiaERCIeXGqm6ezoeKzPjC+/D:a6kTU5nolCIbm6ezoTjD |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.80 KB |
MD5:
6332711711e26a9f129fdc78560369ab
SHA1: fbc43f5edffc7b72def68b95dcb9e7ededb1b520 SHA256: 88a07f8a31165d353b8a4e016d2222d944d219e202005ac512def879effeee60 SSDeep: 48:eAPbJ1xjeRSUVfTXT1Nbruq51BVcSCUrYiXcqmcb5/OGP4:eSTKRSUVfdZ5FvrYiXecb5/OGg |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 8.03 KB |
MD5:
23d2ac233419f524383459b9d8090a77
SHA1: 245472894ed25f3f8ca5721de4eee618a931f191 SHA256: b1971e9b5f1ff33037f13f91981cb8045d25947d643e8e5d9fbde7193612118b SSDeep: 192:r6KTW0QfR/i9vAZuJ0bI8++OoeTND7003nVF1H3O:rIaFAZSsI9+heTa0XVfXO |
|
|
| \\?\C:\BOOTNXT.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 242 bytes |
MD5:
6c50b8093f825f21ed501aa7369b0461
SHA1: 6157604b538fe8d44fe7cfb6d9c43fd1c1d47607 SHA256: 4c3ac55aa0a6a320125ca05f0be50f040ff7d92d88406c784b2fba417c30f062 SSDeep: 6:yATMGlb5HaD0kcy7u94lVue0LkuaH0aRalDskE35Hd/vM1niUUn:yAT1bHVAu9tdnaUaiwksHxM1n3Un |
|
|
| \\?\C:\Logs\Application.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.27 KB |
MD5:
d23f752d40a77ac74a584783dc17ccbb
SHA1: 0292015d691a7d654aa8e6df76b22953e09de9ba SHA256: 607f47213556addc77027aae5f304cc220739253f97d2981480873b2e4c8f8f1 SSDeep: 1536:95KZk0o0zwt2V5RJzFzmfsnRD4hgq/iz9UAhq:DQ0tw5H5zPR8ydaoq |
|
|
| \\?\C:\Logs\HardwareEvents.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.27 KB |
MD5:
80b9209cd87580798df7a2661789d996
SHA1: e2171ffd32b3cc4b5ad179243ee19b271c642cc9 SHA256: cc7ce661204d3dd319bf91ec7c946362bef59e9a5d85cb2dd95e44cbf84e2ce1 SSDeep: 1536:oCqH3ZrTkc6w8Me5k018J6c+61AnItb0vTqnlPfvF:4Vt6w8p5k0Y+AA+nP |
|
|
| \\?\C:\Logs\Internet Explorer.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.27 KB |
MD5:
c43ec78ee9e7fb6940b6f96f377d2c4e
SHA1: b8c3747b0da44fe364597a4d69745336f2f12309 SHA256: 8d4988c080584c8f88be8fe906ea26a5ada996bfc272622842dc08d9f5b3162f SSDeep: 1536:gJLvy1YdwtxwkKIUlnOIc7I9V/KQnBj7WIDj7YfCz5761fD4sfi:gsGc6rOI9ViQnBj7vjsy00 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 7.16 KB |
MD5:
04ee650493e4f9a3802698a9a2e137c5
SHA1: b83f1148877a3d5333b8a74ea8ac3c1c9ad37a3a SHA256: b71859baa5c4e4d56f963de4ea3276f4564f11f0da347da7c7bce712e7cafaf6 SSDeep: 192:qimJHHRZ37Woau1CGJJBliza5BEFZZ9jHEPj1TFold:qpJj7Woau1XJJ+aMFbN8dub |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.03 KB |
MD5:
c164eeb347f5cf4ebd7c8af774abdd5f
SHA1: 10293bda33170a96210b3b86f2a745114694a920 SHA256: 913c91004e45f6a1894eb6a3f0051bb00784234bb03a1300b0804f24261c1324 SSDeep: 48:wAxdqYnDrWB2VgU/s3qkXcTov3h4Ciwd75nWDtUlNYx4:BxdRn/WitiqkX/qCiwWJe |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 25.96 KB |
MD5:
f1b4c02e8b32ff1b7a521c73e153b0de
SHA1: 443c3b4b8ffe112925ad93dbf3661a1fef5d53b3 SHA256: 790b198cc8b2decc1c7f04fabdf0de1ae3ef9d8edc913d86f2b85063b864395d SSDeep: 768:kz+LtctgWeT7fe5gbgwH67AlT/96I20Y+Yn4:kz+LGxe/fej7GTV6I20vY4 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 27.46 KB |
MD5:
eceda1becd0d9804dd0faee95ef506fa
SHA1: 06acc6bc97c1653ea667cf7fa5c93d8efb761c9d SHA256: 04b32985f01ab5f867730be8e52b3b3ec2459bd508317c04a9aa8bf59bef1c2e SSDeep: 768:/WSA3fLIGtb/naI0rqqjiIypwGox+fMDDmwQX:/W9IGoFqiiLi/+fe6wI |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.91 KB |
MD5:
c6604a639e97d8dad1ec1f4c0b445504
SHA1: 6c3bb98fb3d6b1eb7aa92befb44042f2ce0a1dca SHA256: acad72ac9457bffc3e30c8a4aedb0cf5ed5472ebedabb3a47072070677290aff SSDeep: 96:uhFCXMwEhDFx7z+yvNBAuS2r0cvAx6j4o5Ra:uhYtER7HtkCr0cvd5Ra |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.94 KB |
MD5:
8de15368f92f845d3a9dd3ecbe631971
SHA1: e4b4206d5a5f4aed042d48bb412a52b73485d230 SHA256: 0ce379433825b80f3eef2e04b650c6c6c58e44cbbfb36bbd218f770aa63267f4 SSDeep: 96:nI/BUwKlnQl0szAlxxVVlxCFqiNxwctSX0Fa/eNfZidQTHlPLsK8dcgiBeWb7:nYKlnQl0iAlX/lxONxzMXaaGNfZidQBf |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.19 KB |
MD5:
4e2dd7be13bdfebabeffec1bbf5e0b34
SHA1: 0e6c4e1972a4a275cc6f040208d4a499596aac90 SHA256: ba0ac16729552da9a9725ff56469d9f1b82c88b8b8dc5cea6bffc4fe2af8fea6 SSDeep: 96:lrhMJ6VSEuXRJ9B/YdABVJlzGZvvqqBo/wtA+4U9:lrhMEVSE+PBwdAfWNPBo/wtAj6 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 7.44 KB |
MD5:
94b913d7b3a9b3b98de0e9156b3c05bf
SHA1: 53546f82a59bf077214e099ce8f4e36806cc2bd0 SHA256: 04f864a15446e40e39064774a2ce8e8ee205ac44660faefcbd6b7ef9cdff7e90 SSDeep: 192:H2OfA3kpVTJt3YgYa+MdyvQDk99PruUhQ1a:lPzTT3j+fQDk9F7ka |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 7.61 KB |
MD5:
76148b9c013cd0e20d8177fbedc3fe1a
SHA1: 6e3943a82b6967c2fb5433b1b2d2da6528a568c0 SHA256: 860654178ebac2b74e16654eac670159972c5251ce814151d24f7675325e2751 SSDeep: 192:6W9MbT+ZqFkOWO2VaFafcF6ah/4JWvx1bZ:6W9MmJO9kS6avp11 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 6.72 KB |
MD5:
451be594712a0afceb39e1fce9e9447e
SHA1: c06e1beb0076fdb984214e2b9e8e573ebecb55da SHA256: 5dde497b7f5f14411094e9cafb90503a42ae71ce502a4834dbbc0e29d153452b SSDeep: 96:di+HfM61QIVam0bLuxgGgezc1pixeBeSSYkE7YcCE1dycM/5LUjY:dRTwNbaJPo84eSSI7BxnycM+0 |
|
|
| \\?\C:\Logs\Key Management Service.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.28 KB |
MD5:
6750ffacb743bf2c811de6b7a2d6a0d7
SHA1: 7b35fb80d27659117be948ac7a7a1180becf2125 SHA256: 06222ab4e32e17a0f4084951a93741ff82396c437b8e68ad9d3eacc4a7983e39 SSDeep: 1536:yW+9zT0+oxdh2yuSWhixSrKmkxkU4hntc30XjLSOfZNE9RXOI3:m/6L0hrhixSrLkr+nbLZY9RXOI3 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.30 KB |
MD5:
840c579dcf7e63efb951416c45ae6fb5
SHA1: e8e8ec356400c625dae796740c19b7f9ba465a0b SHA256: 5e119a70f0e5f93ae04a53426c5d2d1626036a84f0438ee94c4435aa3fd965f8 SSDeep: 48:k0+P4fKXzuHYxqjxII6BSnwW9p75/67Lv+YvMAhgnvm9n4:k0JfKXzmxI639d167Lmmguu |
|
|
| \\?\C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.38 KB |
MD5:
1072fe45920987121e4a4dbb7500cc28
SHA1: d6b686ab24792c509e4c4a34cd0b0bc98fd7cd88 SHA256: 5e60d3afe8d384a81ecab451e5613075f396d1ff0394a768210eccc3de1ab477 SSDeep: 1536:F9Ek0GfZhjN8aDCP+K63GPyhB5Kp5dICGkDl119H7dVUOD7tpagtQ:FKknRhjGaIkGU+pTIgDv195VUO3LagtQ |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 9.27 KB |
MD5:
aaba2edef9d3a6b26c600d008f639005
SHA1: e85de73075b680fd995eec87031c6619e9a5a2d7 SHA256: dccd1138d846723555f5911e72d60167291449d193b57f465a255e3524baf386 SSDeep: 192:0qrPlWNwayh4qjFk/OQPlxO9ah6tEiKnZ62OmKprHRRdI4mVCUMb:0XwayhFa/O4l04hQEiJhmCrJgVCUW |
|
|
| \\?\C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
943bb9f3ccebfb87b1d4dfcb74d6f060
SHA1: fa987eed050bab91c0e77c374798c5b55cd51038 SHA256: 97dc0f1012aae91d5e5e5a8be19941619c6eed01a0fac6dbbcd1618640fb6af3 SSDeep: 768:d0SQ3z0gbcwwGoI4dM6119x+9QFtOv784GOUPCSStW9A33uN/Q4ul3zNGw5RckPY:S7Zu9jv+OujUqks3uN/Q400oZ4NAtUz |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
f9662748f6bfd4d3afd72fe0f128395d
SHA1: 684cb9c99f2e82eb4c212ebe97e13fda66e0c4e9 SHA256: 1cd84c18abfa20b3a4e762bf08b778aac6023021a22eeacbc3cace8c8d1de1e0 SSDeep: 1536:DygtxvsKYTgqZ/nspAbKZu2fe6hMyBSXdNpU+EE0oJHUAXWnRylHZV7/:FYMmKpPhMyOdNpUDE0oOAXi25d |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
bc0094477d1de6fba31c3d95825847ba
SHA1: 2e6216862a66015f7a293459f996f5e53f0e590d SHA256: bc3c21b391a603ecb7dc8a76d07eed12cd8ac17b9034c5a1bd6c52d61d10956a SSDeep: 1536:l16LKjR041PfdpmlOrEtQnIYiPIo5+cIctjpRnA+c8nvetSty6Y0Gt6E+5:aLKp1dpvEtQnNnW+cn9VA+LzBY0jE+5 |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.35 KB |
MD5:
0a6a7781612d1d43e327f5fa3531e591
SHA1: 1717809bb727e2ddf0f669db79e2c35008480938 SHA256: a78bda628105ad0ee699ccd320bff19a0b5f3101df572b6bd1cd6c59ec35bc11 SSDeep: 1536:xVav/f3WjZVIVDDQ5omz3hC7HyYPzJfoYT4Bco06QAYO90dsjWh:/av3mjDKjmjhJYPNfoYGcP9jO9lje |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.94 KB |
MD5:
2726377dde0c9ee5d905a3655c67a092
SHA1: cd83c2abb9b3abf351c6a96662525893f354f4b6 SHA256: ad9ae054808c69d3875b8cd1ae0cb97fbcc574ddcc7809f2f9d69cd2ca4e9eb7 SSDeep: 48:hVfRHKvp4LIyjuRkBYPctWyJ4bYlWAhGUy2mC+PKlHpekt16tDbwwT3NLu4:LfRqvp4L5sY2ctTJ4bYlWR2fsKlHAG1A |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 6.16 KB |
MD5:
0577fe7147d774ff0443aea4f0dc8d7e
SHA1: 82e927c7f2fe40f110f485d58ef9aa4a67c251f1 SHA256: f28c456ed9e300517bde2290040a9713099574c1ed39c57e3614d15c872e2d94 SSDeep: 96:LMLGe+xu6CELAWhLXIzEGo8HGkziO/Mfz/ZOIoxDrxpjkW9PN7efNz0qbpZxNQVN:LMLGR9CELA0efHto7kVnjkRNQqbHPIN |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.58 KB |
MD5:
ba87119cf02845a1435b271ad9a3fc55
SHA1: e9b8c1e758d7d932dd106c14a3fecbd4b1504d6e SHA256: 9ebf945f5334e1565d6a305dfdd53e2817d03f29a722528c015c9ec94999760a SSDeep: 48:Bj7GXn4w7QiPWPuzJwrQgKWbyC55jTMVwL+iu+ErVmweKk/Yi5nDPlZuNp4:FGX4b0za3bbPTDSBVmweBnDNK+ |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.81 KB |
MD5:
940be1587f715c7facd69ad5833211a6
SHA1: 6c83142d2a610055c4c7ca1a815c0771c641587a SHA256: 8f0a86805eafd6925c561de2f577920ca068a1a0e96855d9f3f8d09c3a3c41c9 SSDeep: 48:55aAdATNuAN5MantlZLzvgPu6bNmZstlKIr7b1/7gVqtD9GuDEVFhTHjpbezi5dL:5xdaEAN2antLxUNmZszr7b57kqtXDcFx |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 6.72 KB |
MD5:
3d0e7026b974b45bf7d4848e97c2d611
SHA1: 6465a737c9b6b8a460d22197db0c3202d1c47b40 SHA256: 608baa0d0ecb1f978596ca31e1022f9002a8405e534af088e2d84b9700db385c SSDeep: 96:M2sjNalX0kOswIGKtTM1wk8zoY7XRoboQUmyFh2lFyr8QF0F+pII4hGmL6Qe9Zhv:MbjNWOsyKtNhzzXRg6Wlk8aIbGmWfcL8 |
|
|
| \\?\C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.00 MB |
MD5:
4de4d80f5b97660f1a9567fc48359a32
SHA1: 7364659c4161f6c01ef97b2ec9a749ccb3a8296d SHA256: 951e55760a987a2504b41434718d497e98217699fe7b1d4ed5f350bf5d212d2c SSDeep: 24576:ew99IGPIMFaLMEymDs76QO7ZJn2uI0YIjY/30EGqKaQ+jlw+XeO+:ew993PWMEyyS6QO7zn2Gq3tGqKkBwPp |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.75 KB |
MD5:
d32ca3793e1bb4b00ddb081c90d66963
SHA1: a01fa8fa4b24496438c899900f06e11131b4114b SHA256: 7eda7a89c9295b8437d622842828659df13a95a00ce9e40ac7552a85f91052b6 SSDeep: 96:SElZE5SFoCAc1fq3fr2D0MLqimfQCsWC0eIYjTPywudLGAyftvW3n:SePoCHh+fr2DbmI5WC/rj76y6 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.53 KB |
MD5:
fb0078693a484a53d466d93c6d1e82c6
SHA1: 08636d48ce5d483bf260d2f729b085eff5d7b5cf SHA256: a082e4c6424be626958d9f417118ff3c2e4ac461ebb0db1db31aa193b7097511 SSDeep: 48:2JU/W2yVciHiQobT8D51jTPb6sYkWpegblB41fqRk1WLz52arK4:iUu+iCQ48D51jPO/blBQfu20 |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.35 KB |
MD5:
12ae320a626db7959dc33bfe57f287df
SHA1: d80acdb6ba9f01b70a8d737258294fe1c27fc31e SHA256: 3db7269dfbe565904209a39ce2c07d9306d9698f6d42d27e37cb25fd766185fd SSDeep: 1536:83C7uhw8qg1Wlyasb2mVmgHe9n6RQ7oucPUxje3/+fbTBzo:80UL8zsb23gHMn6RSPcCq3/+J0 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 7.74 KB |
MD5:
fdb586aaf8ec87028fb2a8e1362cb1b7
SHA1: 72ce0c735aa5b744774f6b96f9007ca4ffeebebe SHA256: edf3ba18a9c6e3b4a60bc620f26ffa02e66d07b4eb113b65234e5d366e61fad1 SSDeep: 192:a2LjdH4T0DsyefvCjGFiFm3Zhikk/DKy9Xpa6+M0gg1k:RLjh4QXkvCjjmJsbFa60hk |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.31 KB |
MD5:
4d6f76339c6647977afcf0c4eec6f261
SHA1: d1a56cc0df838ee5519d195a0c4655761f6c836e SHA256: 1e818c0d48431684931ddfdbc487b2fd673b467e3c2330a4b7b860fd9b46e590 SSDeep: 96:ubQ27Q1NeVDMIwvsmuiHyzfQlqEj2MPjQ/qTeMwk:KQf1NsMhvsmPHyzWq49rILtk |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
a7dd945ba1958d58e45d50c00a8f9b52
SHA1: 1c36694de66906a5e3c81df8301064c1c4162b4c SHA256: 15f29e716d3b1a890225438f3d01745cb3820fb981482eef7f2c5581770992e1 SSDeep: 1536:7/iBrnXTxK3Wu1KqQQv/MOsMWPtTcdh+SnoPu8Sihq:7aBXTEJXQQv/7dUSnGuA4 |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
050ce3929eb20b439cb7dae81c452761
SHA1: 0cd8a580c36dae1721a4f363ec5819e904aad793 SHA256: d8e3ce56b60a15487442731f218f4d736f856a477d1e7cd38beb4670c4cd309c SSDeep: 1536:bmL2yOq89R5+RayXaAdqqEulbZoaHYAj4JoWA5dqCKLyNi:q9oR5JyXarqEQYAU+VBK+0 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 8.53 KB |
MD5:
e405243ac327915e436292266e177dd0
SHA1: 88fb9dcee423ddfb579e1be7dfb5cd7ab6565902 SHA256: da90533638b63fdd68a876614b5680a30b7282c69e65852b609f31642477accd SSDeep: 192:fvZu1lFctuPhM+LXyoAtL/Gx571r/2DGixJD6c8DDNzkBJvbO+6g7JR6y0P/Gv:5aFctYa+LXsV/0571rIGiX582Jl7Cp3I |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 7.86 KB |
MD5:
17e4242eab839db6fc7d3f7ff2314f9e
SHA1: 0be9ab01845d90c805cbef62afc6860d8a1add5a SHA256: f2981e317439690fb075666647b51b35c9d26895d6fd63ad4a56864030a549e2 SSDeep: 192:XaUoXxvlI8xJ/92hzMZivdJmJ2yRhI//QZI079iq:KU2lLJ/9olXmEyRhI/wl |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
0332846219069315795ac6dd6ce8f14b
SHA1: f870215f02b15e44e9e5091ff0ee9cd5946c7e18 SHA256: d4122bb466a2a55c3df299975c528a934606d55d8b8070f12d7326261644b768 SSDeep: 1536:YrPVNrs1LTExGF0o5aj2RYkuBihGxsFkGt0Tqtljzj+eBwPi:W9hslsuaOYXihGxsFrtRtteEwq |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 7.86 KB |
MD5:
ff0b7a96ec90cdfc450d717252e014ed
SHA1: f14102e42af71333f6842e9c7e5074cc0d63ef97 SHA256: bb4c020f23af8b3147be3ffe71e593462fee577573efef203d4d214b8bf633cc SSDeep: 192:2+ohMGrpiE+Y6RC2uL6IejuoC59e2uqJtU2SQg6APrI83CfKRqmXE+A:3oTrpie6vqne6oC59uirSQgJPrI48kV4 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.67 KB |
MD5:
c22f2e5f12e80691c056af7b9a9c81b5
SHA1: 37936af9a54ebd6aa1d8f61b14b282d4a47a6757 SHA256: a26a0ba8d1b14906b352e3900cc888231e0eb7d240cbd66b4c6dad70482f0898 SSDeep: 48:GXTfX4at4i/9CxhNGjxkcAKe8MGhB7QQOfRO927T3qeaNS2WiP7tClORqvgAARxJ:aqi/YhNGjyge8MGhB7QXK27T3StaoA6D |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.22 KB |
MD5:
7c053030784972550a0cc9534b863f15
SHA1: f30ea2533d37960ab5eb52803a2555f1b770c20c SHA256: e84180ed65dfae84574b3a81577099b6f85d790ad41171d462b75e583ce54f44 SSDeep: 48:IBVVvhlMW6wlZ2FQUZzpwtdF7vT2KGqOnHb+C8eiBv4lJbA4:IBvhlMkZ2FQUZzGHF7L29quHb+C8jBve |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.52 KB |
MD5:
bad57aefe9d70d33dafb6ad916199dd4
SHA1: bd79124667e33ae7b0f4dc00a13fef4a1d46dc1f SHA256: 1bd23300651fe79408b046fb997b46e5e26b338127ddf06c4dc74f1ad4fc1c31 SSDeep: 96:FQ4lKNd9hz44xG7G4csjpT1L3cec+hU2Ha2w2UiF5MeaB:vINd9K4x6G7sZ1Lsec+hU2HoiXMeM |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.44 KB |
MD5:
32a07aabca2f23f3577273f341385e7d
SHA1: 7faf1e78353eadd9762ebf57cc949995bebae666 SHA256: bb7e2947c97c8be9085ca799a6a1e0ffeed9968536f40928428b0bcbe020c80f SSDeep: 96:CMAJfFOrlup4HGSsj7SYRurj/9G2yfkU4B0YHQwg0:MfIJ64HGSc7SsejVGCdB00Qwg0 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.39 KB |
MD5:
e2dd4145f1019a880513f2a016c07834
SHA1: 0b31801f02f7f17991917300c601fd9daa37d736 SHA256: e43b241e1078da4c26277ea8a358e5511bda793451d491e3015658ca756555fb SSDeep: 96:CGyHujlDDTtcR2UyZu+6sZlLUjCmQ2ulp27VhHKfsfp3v:git5cAUyZumZJmQ2yp2nqf4p/ |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.94 KB |
MD5:
60daa18b1222842fc58eb3bc048d7141
SHA1: e6f8f2c3f018da6e5c5fdad9a721cba4273af078 SHA256: ecaf77e6738da9811a39028598199bbf4e9b11a93324d3469025ab4413cedc48 SSDeep: 96:RWQSa3QoDPsXazulSg/t3N8Xux/8jOodQYvIS0PXRVsvGTpvVXa:RlSYOqulhl3N8ex/8SouYISAQvGTp9q |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.13 KB |
MD5:
a1e2fe3ccc31a969af78330ba705fe50
SHA1: ccf24e950690602e85c00d384cf7b1388e1460ca SHA256: e1c15e88ef9d0fdfd94f08bb58db010ec5474bc2270891bed0bb092cead2bdd4 SSDeep: 96:ALdXrjgli1qND7OZdfgKl72OOZH2LLUBIg2g4cRuXE:0XnAND74Sa2LWLLU/2g4cRuXE |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.00 KB |
MD5:
eb723fc383ffa1277743291bbb93e719
SHA1: d4b4b077228235f7511e1847a9242ae1ab30e5ef SHA256: 28c79c75bcbd435804c51e848b95de2b291ea5ecf8ec781ffe5fd0e41e381082 SSDeep: 96:fw+9zK0spNzGxtKnUHRRvjRSjbBgIhKL1M6lSliqXUBwS6rdGLC:o+0pdjanOQL1M6Ylia7S7m |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.13 KB |
MD5:
0fa824cc4bacf6e1e996d8cb430efaec
SHA1: dd7784091117ecbf87dfdaf380149aad54cdb8f2 SHA256: d2b51153b697c2b435c3d99682803273b1710bcec8005221d7aecc8ca493bec1 SSDeep: 96:prKDaopOb3KmKGes14WZAEhSaB/FM75/R0x26VLGng6SWL03ihkmn7A:02o0b3KtGes14WZAEUas5Z0IYAPe |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 26.50 KB |
MD5:
163cb92b5aaa63f31de3319422437e2b
SHA1: 831bca33583b52d57c46c2d19c9be6e23697bd36 SHA256: 45875bc4aff4565272bc81ee75be444e3251c855a903e292b9f98b3924d233a0 SSDeep: 384:8yEqCRP51HUVF2W8UiN9O6WAYB1WMkq+nhNUZrZouPI2iYAQzHvnSpgvttQC9K6o:86k51HUf2GijcAYYh2iuA270ivttMm9A |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 28.52 KB |
MD5:
6f05ccd717ac5bdfcb95e86335f8c406
SHA1: 04cfb794404da353474f49067dca992ff64467f1 SHA256: ab5c5a9bdaba7e0c314190acad4ed541742fe4c570e901bf54dae29112f6c265 SSDeep: 768:S8iXPfulPryogmb0F7Ix0r6ODHSnL2i/7dHVqIlYDRasWf2J+MB7:S8UPYPryog0a7I6JuL2ijlz2DRs+J+MB |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 11.61 KB |
MD5:
c2a7cc1cec24c934ba9234aa8e154c59
SHA1: 808f1e71858ee1446f8d6372495f0dd865b3540c SHA256: df23042b9af58fc4b8b1b972b1d311fef36ddf33c46c4b7c8b9ee9b327a898d8 SSDeep: 192:04M9a4yAluQyfRWu2qjhX/n/0W+J2kFSTKjtwvwUyESkitciHYEMivZEq/8CTjB:/f7As5V2q1X/8W+kkEGj6vwTMKYEM8E+ |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 22.24 KB |
MD5:
93e58a7c8bbed12f0beadf3da115d9e9
SHA1: f60f62582d56740114fc1dbdccb99dc5ead9be22 SHA256: e6ec6e9dc2e35284ff08f2872f3dbf92d4a169726022c5f78eaf3ad1aeade307 SSDeep: 384:dCNL6nJBa73yy0lfP9mxfxDX9lxEdPecvIOBwG9JudqWGIhw4LZHQ08pA7wL6:dCNLqjpy0l981eRnvIOBww8lwMHQ0wYz |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 16.05 KB |
MD5:
8211cb6f594e246648c4862f3bc14cd1
SHA1: b744a9e58f39dce94790b84da7b65086a2afcd01 SHA256: f3a65d62b579c22a2f1bd7668acacad0218c76a4d97116bac8d7568293518e5a SSDeep: 384:kxqBBz9yNNt6Uew+nACurhughR01zGusDhEVFrDdZUagqMhh1nSeX:k4BryNzCur70MdEbxW7hfnSeX |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.07 MB |
MD5:
d1810ce722a293718558619bd4488812
SHA1: 9a5ecbf9dc9e9ee9d1c68f7821fc4e2169d69592 SHA256: 284164cc4e71f0fe21888179dccce43f3050deb248a825fea58f8e3efaee73cd SSDeep: 12288:lyaUwomKU+1ooeQnfyEaFEUHVKln6TV6OqKWpYmWi3/biwEdIYzNoT8mgYdNF4eL:kwoma44yBE7lnfnb3/8d1+TrClkHNQs |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 17.08 KB |
MD5:
bc3b0040ec30ce5f4bffebb6aee37660
SHA1: 78ddc256787394e66893209e9edbbe73cd406a7e SHA256: 94cca881ec369e453349e18f45aaeae76646ae80ce4c9704a6796c876144c228 SSDeep: 384:/2pVlqWxEw5TLNRB4kXpdDm8XlOxhEV2sLAfX+57cihC5yq:/2v0WxE6RB48vDmwlb2sLAf81C5 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 15.99 KB |
MD5:
1e12968555081dc06e2c8e7c02e1f205
SHA1: 59cfbac411d03b1f948dfa6bb70e2b0afa050081 SHA256: 09b904277af19283e0079369481afa84bea2d0d20901fcb78facb68459fb9657 SSDeep: 384:YWHtfabJAMbRXymzuFcZWB8m5GV4sjGtVPz7Jn:FgbJnHuF0WB8m5i4X7Pz7J |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 16.53 KB |
MD5:
ee4b4d51e2f36dfa18d99ffd2653166a
SHA1: bbd1569289a215977ed08739c02e0af7cbe43ab6 SHA256: b7d1d1c5c302c99f07fbe13bfe982e9277a05e1e9749c72c90b4d7e5285260c3 SSDeep: 384:5iYYdCkOqRq6iw7DlJMuFfS8dIEt1x+ZkosHTbRQA+S8t/VNEd:IGpqg6JTF6E7cWfTbRQAWEd |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.05 KB |
MD5:
21961f616b8885c02fb031e2e266e3cd
SHA1: 51fb5dc78faeef1d868e50020c45c8f69acaa8ce SHA256: b9579e88f12535dc8561906a7e5c2879042aadc948e4dd73c44fda8e2e3cd069 SSDeep: 96:SF+1fN97T8OIKn7lM5LCXWpBVi+jDZmhiMj3DzKTw1B1nbtkfo+eYHqK8P:g+1fN97T8OIKRMhXDiWZ4P1TnbtkfVp4 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.22 KB |
MD5:
e2377748a5aa12d309cf56537e7954f7
SHA1: c231da158dc1d30b748f68ff7cfb5382d97f88a9 SHA256: 0f3fd1f35f51985eee8a9019911c5b948aa6ef43e754024eac06e2443a1e6a59 SSDeep: 96:f+fVLdNk59TUUpPJzZ/47Hoh+ie68Hu+YrdbD7dJr1GaH:fOLGl1R9/0HWe6OuHd7x |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
18a931d143a25fa25264f7abb081617d
SHA1: 8d04b63065cc4a8f452bd5935724e42acd2533e2 SHA256: 3c5c311d425b6d6320c20b09305a280a4f5bccf300f40d867c5fea9eb7ca8efa SSDeep: 1536:jtVS1qorJX8gHHh8MbpJNQBtVzsLaxBGUSKr:pYsKJs+Hh8MbpJN+l3xUUSKr |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 24.00 KB |
MD5:
7ff41b8f12c8c00d811d50abf495cb20
SHA1: ffd5e3e2206f1eff5481f4e06a3644c08fe2597f SHA256: 17a2275c099120e3d34856307426d111c2b2aa8b59d809dbf71361d97dc211d8 SSDeep: 768:51OiwHagixQOJtdtUczT3KMxF59ic9S1GA6GIN:SrixQOv7TxxFw8A6n |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 26.36 KB |
MD5:
5dc702d93fbb48b62cb4010344f7fea0
SHA1: ba6a101ee6c22bef0aa82902cc72e4d8ce8e4fa9 SHA256: 872d52bb8864c4c82d0fcbbf978264c7e2328ec3f94aa68b73c3f8da6b144ccd SSDeep: 768:zsjeO57eme82UmQH7lC5wIBh0IP7ihibe5aw3DHY:w/IQr7lgwIBuIPb233DY |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 24.44 KB |
MD5:
277e13069ee1d1272a10dcce9b592513
SHA1: 05b1fdd6fd22811fef208b6b7e27f1addbfebc01 SHA256: 683b89f3343abddc29b13bd008e03576dd62a36bc586772ebb27f7909730d54b SSDeep: 384:9mdD4LDC8xUqQq9hy1j1wkyFY0B0mTw2O1+R4oVJ5bWaicRjwlhYHUxSkbL1NT+w:9U4PCqkZdoYC0EPHJZlwhUybL1d |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 47.11 KB |
MD5:
6e89d0922a97c855a2f2cb6e441e685f
SHA1: a542aae817c5153f64b9ac729ba980af7f3e4750 SHA256: 37349c5db7a38e73fdd52a6e87abc878d99a78117f8118097e841fe1fb60d534 SSDeep: 768:QfL7Svs8hQdFPeFtDxWVTCAxGrqAUMLYVB1unEeeSWtWjTRnjA1ug8D4sm:QP+Z2vefkVJArpUGYLInEefxBAU3s |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 39.50 KB |
MD5:
214620d13431a1e969839909a6a828a7
SHA1: 871dbe049d5130f2e5cd06fb051f404f86658623 SHA256: 17d7086c15a0e4f59154c3466ab20a0b576b9ac585826278e2ee29a4ce37e5b8 SSDeep: 768:IX6uY3Cf+eJN+KGyFN84JfFe32GyjtfSsWoDmIws8tsC3r1:IKuYWu7yFBu3AttWojws8sY5 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 46.91 KB |
MD5:
fba56697fdf6ac1add5b09fa3c325bdc
SHA1: 959548416ba0719841eccb7ebf28b39a2bd9da3e SHA256: ec23b65b14654ff57042d3adb77974d300a7aabca505b46583f413b0349d36c0 SSDeep: 768:9/CBqVxWBWbepaDEgmhXx/9AiZofiUCwfttgIZT9F/ImMpcJ0EB2N3iWOO5GswQv:xwqVMW6pVbhB1vZiiUCwLgcypc/UD0Zu |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 14.44 KB |
MD5:
d5b13fc35554857fd61307ecdd871b67
SHA1: 4c358ab16738a5d82842f78bf20d6d73f235b9f4 SHA256: a09cb7a7281112d40867b1ba8ae922244c864e1f0a0a20d77ea36523cfefae3c SSDeep: 192:UpeayyPvFJUJDDLxpUNm1cSox5Vq4yWGKRkExKETEYhyKgPgD8sjVTLYkPCPUYyt:0eay6+PXXcHizE9EYhydupTxHU+h |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 8.02 KB |
MD5:
0821c10f78465437bd6a7b4115ecccce
SHA1: b95c2587037f85e215fa8f8a65daf45ede61da6e SHA256: 40f63c48cf06512e33a6bd8dde1379aa2e46ffa13bbab059b8b4ef22188e1882 SSDeep: 192:XtTpQqRDHgAAcA0Z1uLnT7nKGvYL2MckttpNqj:MqRDHgAAcH1uLKGyTtdm |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 20.31 KB |
MD5:
1d7fb0a4f2a2eb3cec5c3103e6566bf9
SHA1: 2e44348f0a1575f0c69ae072d29e716966b3e720 SHA256: af50fd985d890169eb0ebba06c4e00b3ec9605256a6a59ff3fd2d9cc13cbcfb9 SSDeep: 384:2VBZMZDd5dH3LvrNXbSZGzdvy3CVrFcUgWEkGQxRNV0YR3X17pc:MH2NbrNriGBvy6n1Mk/V1u |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.82 MB |
MD5:
233a7b0f9d7866bc18bd978cf58c4c7b
SHA1: 9ef52667f4e1daf8e5c76b95df8e491b978e501f SHA256: be2394cd9b0e70355a4be56e55e5a27480e650ef775eb5f40fe5928bd68a4e95 SSDeep: 12288:OvywAhpCsdc0X0ugP4tuCkg3JYf2vGK2X3FG5GgTp3okGjFv0Ne6GAH/cH752Uiy:umQNZ4tH5YevwgNCq/c9R |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 13.44 KB |
MD5:
87fe41086eb3249a4f3cc12a47bfd52a
SHA1: f6aa33c3bb1449e7d14f6d655d21a8db60f1dafb SHA256: 4c36bc66b0b3eedefd89d38e3fa5a9d012a7eb5517adb0bbe7012baacebd9c4a SSDeep: 192:GJMSKgcHy/DkCyJm1qOm44RvK3Dx88wt/6HRx2uT5vNgFP9a59ktfD9Qx4uDyOYc:yM6V/zcOERilbOhuTFNa9a5gfK4uWo |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 19.96 KB |
MD5:
fb927384f2df027cd07e3ac4abc98da5
SHA1: 8590ca9bc3ab84da6547feae6b3f7eee641d7117 SHA256: 9cd7e643115d8e7de47215c5fce4b90bc978a0cf9732e0ba75949a3b00c5e44c SSDeep: 384:SEdTzX0ZO2i/MK+OWna3mBknnD3QMgOZ3LZShHXTPOt4s9NbN86:SEdTzui/UnaYyn7QRU3dGHjPOtnNby6 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 20.22 KB |
MD5:
6033c2328b91800491c912659b093c15
SHA1: 4c95fe2326d880382f57815aec2bbc925c570e1f SHA256: eb3e415b83b64bb20666cb8baaef2ee5799a76f3e878ad79cb9c96902f8b06e4 SSDeep: 384:q47ZQxXOWmu1RsC39iEIQhvAOXXKI3LGVWVghvDv+L/or+sjJUJAFg:97ZQxXLX3su9fh4OXXKI7KDWYJUmW |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 15.61 KB |
MD5:
1d2d4a7a29d0eba01e9ad21142a000c1
SHA1: 36c8513225d0268f067b2209cfa6404fa8832fbe SHA256: c4ec009c478bbe05375e6aff1c377edd8fe9b1d42a51ba416c578629ac2d6da5 SSDeep: 384:hP7nrP2RXqDOju/O0JkyzM6svfWCJDQAc61IY:dzyR/wJhM6SeSDQaN |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 12.92 KB |
MD5:
c15aecfe98d536745cf8f53ba7f44e05
SHA1: c5eac8e94145999f73f4300589cfbc2e786f67f4 SHA256: 25ca72c7dc1d9a29b7df2560045b4141919ec3277323b17ca5f9eefdc8bcd460 SSDeep: 192:SmCNYqYYGb64tx+sS6gpG/Gw2zwrPwQ9fe6Ymoxb9mLEYNMzV9/zfhKRb:2K7+cg8/1gwrPwQ9fe6wV9pXfsV |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 9.72 KB |
MD5:
557e0081d59ae7ec8aea629efe919ed4
SHA1: 09431d5f10042f50fac6ffaa92a887a0dc873459 SHA256: 1023730193693638b3900b2d03f9d7c68e2a9645671604f7153005d61072563c SSDeep: 192:ULRw92lvWScWjJJ+98P9q0KwrBN2StQvJ9YLwLmImV5mddnRE3EOoe:U1VFDDlw92KwrzrtIJ9Yfd5MS3EZe |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 14.39 KB |
MD5:
27ec565dd32163efcc7451eb3b1575af
SHA1: 3fe491cce2d8be338d15bad1d56b31d66892146e SHA256: 9b4957d8fbafc392114cbfbe44777304b6ecb7e576389ce0cc5e83297be31e05 SSDeep: 384:cwvZ6jQhysqrLxWahCtNBW20LJ8G4KsNkw+b3Hp:pvZ94sqHK027klzJ |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 8.81 KB |
MD5:
33cf2869f081869ebf4b9c0debbddba5
SHA1: 49134d1a724220aab96779f2fdf1cf82b949a80c SHA256: 4c291ee4b3c47905498aa02ea8a2855e8aa1e0003b0c3aa45b2acfe04c026ff5 SSDeep: 192:E/A8Lzw77R7okYgUOA7n2jgohRWnAJjAbT/ERWQApqatc:YA8nw77RWgUOAzkgohsGj67EIQAy |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.13 KB |
MD5:
88b40e150a83ed0bfb06448cf924c5a5
SHA1: ca495feaeb62da2d5167e7d046ee51977f6a3cbc SHA256: b5ae416fb71ffa6ff05c764840bd64b3d17fcb43dd23c4f7fa6e8ec1bf3b1733 SSDeep: 384:algouLJY5VtkxD4adp3ZPHqsLSYmm8C89hwS7o0vP:4goeuYxpssbmmrSwS7/vP |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 11.05 KB |
MD5:
4a073f19b60fe7d7b718eea5809908a5
SHA1: f480ef89243640c38a5de2f93af7cdb349b2c696 SHA256: fbb60d3f6d707de4e52cb732b7314515748db7a633640ee4de0c891c28247bb1 SSDeep: 192:E+w69MQrSOcff5OlCKC0WakQOFXRhQhLGf1ZGEZzBlMzscOH9VVDAHOglZNY8CTZ:E+v/rp2BOlrzWhFXHSKeW3MzscCVVDlV |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 9.83 KB |
MD5:
7f1530eda422c5d34ac00b747119963f
SHA1: 919674ed8ee770803fe9347ac1d50b2c41338462 SHA256: e3454e0d4771212f37d0b6ad84059d005060c297bed2376d668f1393e0386955 SSDeep: 192:JxSx9PqzW/tzciIcWYBCi9oufQcqNBxkusWBo3y4syGS7OosX2TY+IoQnSG:Jxe/J/fQBN/kgo3my1Soo2TY+PGD |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 7.92 KB |
MD5:
f461bffd8b5935611ea05744bee3d7e1
SHA1: 7611e6b11045337cb145cc25142581cfc3995a75 SHA256: 01fa257c900d88521109c0eff9a970912544c10b7f949311bd51c01ec3401519 SSDeep: 192:CenEl3gaS2Buc6wRDWfAlVOROiSv5y8Jan0y5YLF6w2e:XiRXBJ/lVjicPJRnFtr |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.24 KB |
MD5:
4a5c5a3d04d4463fb8907a323fc40291
SHA1: 650063c47584ffc425dc7cc6c0fcdf675a3d2e78 SHA256: 5b460964f6a350d48404d9afc3058104b6f604de45628c693fa7e79a65c77992 SSDeep: 24:TfsErocX2BBnpCJHN4pNdu15RlR205x3Om2E5AriTnNguqcrziV:TsbIt4p4R32055OjvrgNguqc4 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.11 KB |
MD5:
e5aedaa5f1fc866ae749c9d70c3066c3
SHA1: 370641311f8a2c25d069c06b231b30376bcd0a81 SHA256: 94a9f09cc7abd00bf8d15d5057649663852e60b2fa7ad610403835ff7ffb8d18 SSDeep: 24:LOvQRCevehos5dDhtqy3K25Hcxrm3g+IZrqzbj9wbrziV:qo7eWsdDhtq0K224LuGHx64 |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
6102776c54731faedd9345c6d8599566
SHA1: 4fb6b12c632a0dc7bd0037283185b383d562d6c9 SHA256: 96f2400b76c2023955c51bc35c59f0fbc95942035167cb64905f3830fc950c4a SSDeep: 1536:AuQuuoaHBV97ND1Eu0Y4f1Zqcm6F+ME4er/Kv0meIKA7JNOxF:A9XnH3ZEufa1Zqz6FQDryv6iJNOP |
|
|
| \\?\C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.36 KB |
MD5:
14c54a6275dc7f2cc051e6944d7b6869
SHA1: fef2775e7ebf2733674240be5b8f05a922d69a6f SHA256: 5d03a25922c1c37bad5e0641bf6080d9e7cc359531246cecc939740cd151378a SSDeep: 1536:V8hVnPaoJ8LMKGK9zjvbZLNJDRpy+itEwTV7hjQVr7xnRzT9d:2hVPaoe4Jaz7bZXfy+IEa7NK7PT |
|
|
| \\?\C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
00c7d60f65e20baad3e433f5f1efdd87
SHA1: 7c2f3b89d5ea44f8ef1e7caf9eb3e3172e3c81ea SHA256: c5048bd39941b9794760717d68e01c8ec99f67d790c8bd91b7e9868389e2d598 SSDeep: 1536:w2lgGAbarg8CGNrpiu+FA0tv1kGc/z/WZj1ParEtHWtcE3Po6OidL:bgGAOrgwNN92/pI/WZjNa49Wtc8w6b |
|
|
| \\?\C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
d09774ad31176d90fbbb97e47f54f6c2
SHA1: 32d5f2c70f29aa98c736618ba468864e458a2485 SHA256: fadf0fc111637f419c673d0705a45e8294614dac5e250c39fbfeb153c6772b52 SSDeep: 1536:7GThMVSkDgav/ULj/3yI1Twi1YRzMFRGLQAGTbdjZnZbzXo8e:qdMVFpvKjp1Tw5mFpPV9le |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 12.47 KB |
MD5:
ea81860ce1e47b3616d26f12fdff9f43
SHA1: 5bb6521aa2b349fcec96993055932d3dc8fe54fe SHA256: 980c07afd6dafcac8877365e271721fd5198c3e526a693ba008ee1de995eca07 SSDeep: 192:LB4u6M98KY9XaS/iP8NqJ3roTq1IW4Gy+1/dsQJr3aTiemuefIWWO7SDf:LBGM9VgXaS/idJ8eGH+3sWqTi/uXWkz |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.67 KB |
MD5:
b1d56b138027e6172b2b6eab7068f02a
SHA1: 0b257fc76b76ff1d8b9a5fa69c75607f5f062b77 SHA256: cf1742abd4f89a1a4bfbd13d13cb7c9b57c291a175f6cec6a98cf4cd45c7fa90 SSDeep: 24:s5UL1Jx+Bgx4hg52NCQVCtrceAijHLoQBg3vh86jzA//5RfCjNhWkDcv8Y/3g0y4:six5GYRq3bKpgS6z6/51CjNhWYk3y4 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.91 KB |
MD5:
c0f1b28cad5e760ab31cb2cb4810df36
SHA1: 13aebb713838e5de31e4d5133f563663a705adcc SHA256: 4a7b612a4542e1d344244d999ac2a2f8409d08b1a57672e2419dbed6ee5f9eba SSDeep: 48:kaYH1votiDHRFIlRyKl8eqakQXpsQegSNwE+gCK74:VO1voti7zIma8qkRaSNXx6 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.72 KB |
MD5:
c91edf99f5db9d887582fdfc7558c4d7
SHA1: 0e99c8f7ebc816d0bc8b59e07f79afa9e6fb250b SHA256: aa0bf5b70d3e481b417bad8ddaa85c5487c7ac10263494299edc3e0f377b0d64 SSDeep: 48:nfqp6xY6ti05byKhGnjH85aqJcYW48AST4:nIf6XTAwagcYW41Sc |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.14 KB |
MD5:
d0c068d554547eae2ef9df404323ff5d
SHA1: a9e796ee9d9a2b1a0b9f8e8e006efbff34f0b108 SHA256: ab4478e73ed9b391705bd81ed8506c5f35d5d2c8a176c40b54032f5af0440cd6 SSDeep: 96:ChA3cvOCxxc1Ivsr5SFDRlw31pAWz/77OGaKZFJm7kyOHLUEd:TAXq5S7lgLAWz3LaK3a7OrU0 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 8.13 KB |
MD5:
85317f6e9adf771e2f7d535ff403689c
SHA1: b8898d5213608c9605720b75d21f42580743a310 SHA256: 8d0fa5c1f260fe30e386dbbbf02276a1dfbe6a4fb6f70613c564d56d2ba31191 SSDeep: 192:eX8xuQf65FfOn3fmrqqC8g9wxq9ygAkEKoAy55fcel6bhRXCD:eXjQf65Ff4f+ouq9LAkLFsuhx2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 10.16 KB |
MD5:
2ff9452b50e5efefc5592d3d2f7d1f58
SHA1: 0824655a2d6c6a70f990aff061e443a0b1435536 SHA256: 86286afd9297f53f87d49a1fe02ff8abcdf79b9090e7f39cbb60d64883e2fe05 SSDeep: 192:7qsxiEUCU7t918C/CcEFq9BKMNWQWOip+grbI8QgYnnZswXwMG3fJTo:NxShT2Fq16OK+grnAeTRvJk |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.17 KB |
MD5:
ba4348d274c1d4a4257ebc051bdb2267
SHA1: 16b40b4867c37a67e4a62600add4470cdbb90aac SHA256: 42f3c0e28ad5c07bd18bdd814133a5679dc7bad90f184daa696570b2533de6ec SSDeep: 96:DXLM0J0EQHFSHvgJNb34V7hz6lNQd0/1RXolHlTkLkYQNzsO0gs2tYM:DXI0yEOogJNboVlz6lNQdAXwFcq3Bj |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 14.35 KB |
MD5:
8017c73d41dc35e7ec7c8edfeb9b31d8
SHA1: c5378974f12267521afe7a84b0182b56b458320b SHA256: 9013f5d65db2cbdf45ad9316a8f3b095980ec446c42ba43a34fb67c0fc53c41c SSDeep: 384:YWWafTwHYF9aPWDXFBLJP3C0XgkNgqF/xp/9rHWXXsr:YCE3PWDXFB93dXgF+x8O |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.75 KB |
MD5:
7d295299fc6b57827c96c97a0d5c8d49
SHA1: fcdf74771738e24154e19fbe8f253c5a3e8860fa SHA256: 7da62665fbf56ca92962ed0b1f42a512ec8bebc79a110f46ce62dd5b2377ee84 SSDeep: 48:mM7EQ9TVMhplYMfcFNIxGT4JcNN03qpTb7QKulqJ4:m4EuCQMfWEA4s06pcKuYe |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.85 KB |
MD5:
da3c6a68d23acaed8f6bb810a01c6978
SHA1: f6f597d9d3b7940a4cdbb0e6e7f2513001403592 SHA256: f27c07fdc33acc49b88d9318eb80c151dc2db6610a7399d919ed32944ad81a94 SSDeep: 96:nhNrct5/j39YMm3jCs1ZqnYYSSMQ8kIWKXasy54PMMUld:he5739YOMqnYYSS6kIDXasy5QUld |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.94 KB |
MD5:
01620cf866aa4ee51cc4a2e11ddf2559
SHA1: d5bad7094c029deef16690e3ee249114b9bc1e70 SHA256: 7c5c6fef7168f7e5bc37d6aee76510a7c0c5ffd862014a4f59af6aa0221f9a3e SSDeep: 48:ie6ujTdL53YxohQ9LPdXP9nLGMid4anjBwjF8YQs/i4:ienHdLtQLdPdCMidPjGjF8hOV |
|
|
| \\?\C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.35 KB |
MD5:
b74e989c37542f5081a70998ec44e7d9
SHA1: 3072cb97077cf3b0e1f9f05ac75ecedcb549da67 SHA256: 4663713d273b44605e53be93355a2c0390e11f78006ed5917b57aaabcc83355e SSDeep: 1536:1ydz+XcvU5WxTvhpl3Q1YawvJCOU/jdRm+89gE+VD:1k+6hvhplg6XvogByN |
|
|
| \\?\C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
737ebd7852c7117f1a9222e5ae1d25fb
SHA1: 5e3a7f12b63fb7bc480c94cef172effa2b4e871b SHA256: 4500b7ee2ed0840e2f12c25819b6a92a9c88eabd2676a21ff8061fe621bf8d6f SSDeep: 1536:AcR/0K61t+7v/W/cy3CQL9IUczl7uqtI/ZlPvIC3goR:AK8K6eGcBQ5IUClKqtEZlPpH |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 9.33 KB |
MD5:
3b6b37a2e1e86d4b1f75add3a3432c00
SHA1: de150010f7e81c8ed8ca7143d172170f4b5296a5 SHA256: 8eb66e82f6dc230aded81711b78f133496af299020269856fa0ca5cb599e7aa8 SSDeep: 192:PZi/wrtQEuCQlB0fjv1JSIC83xF8U5T//DEUmIS39HG+yAQuW:PoGT28v1hCSF8UVAU6hbQx |
|
|
| \\?\C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
92afc5eb70cb96487b0e770a169bdbfb
SHA1: 3a966ab658c4253175f979525da382a19f633f75 SHA256: b1e9b92fb426ccc7886dd471a1abb0c5ab3a0bcf49d59916c2a57e75bc97c19c SSDeep: 1536:O/NehQpktYJOJ15p2Kb98N4210i6fO5B2QuqkK:OlePi87LxX0f+QLeK |
|
|
| \\?\C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
6659fc7e09e2b927b786064d5cb15812
SHA1: b47b3566117bd16d42a84606460793900f7ed0d2 SHA256: 040ae111f9291eae43893920fde0893c3ef4cdebee465879e7448b7e9c4ae9af SSDeep: 1536:BlSgpzf7JQC91yzE2vsCIk0tLHeBCC3nzuybywWMdTT:Blvpzf7JQ593Idt76LDuJen |
|
|
| \\?\C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
8bcf62100d99ff05a81e7fee0803e184
SHA1: b76c7f0c3d7c607d96410c65afbba268c45de2ee SHA256: f4c1560263b7aa747c5deef5feffa0546769428b1ad624bf1a8677b7bb8ed11f SSDeep: 1536:xQ7Md9TFSODbc85G8WvUQ/Scr/NQqi0JADyBOBaV6X8+P/KmZR:5HDP5xDQ/3DSG8n4Vd+62R |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.86 KB |
MD5:
67c13621ab98ca1fe30e2fa330786dcd
SHA1: 3d7cb1a263ff956a2aef2aaade3f11443bf6dce5 SHA256: 2fdda6a27b867e9ba65742eb507c4dd5e32893e1d91dd05ca6fb5021845e976c SSDeep: 96:DcAWUKPJLN2EPEGprb8cbKoYtOZRhjTWxuvvv8BSIq+1yH2TEM5HaxzJiJ5mU:76n2EPEGFb8SiYh/vXv8cIMHhSHd5d |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.83 KB |
MD5:
58121fe1e8c87ee70e308d0a9977253d
SHA1: dc4cf081f4a53835d08ff5735a30ad4388abf738 SHA256: b1454dfe1993fb638e61ea25939b5a0a932d4913a437db5d54d15141e5cd6fb9 SSDeep: 48:SWwWBu6ySqjxJbeSJlvtqGR5IDeYwu9TtDwsvLuHFmkXw4vjdIZtl+vCGXNhQ4:pBu6yj+SBr5hYD9TtktHbguCZtIz |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.39 KB |
MD5:
1b746da7e3d7f14c905287d123cd955b
SHA1: b3b9dab2d7586358778dc83c07c9314fbbf5b155 SHA256: fa34f4b056ff080edd1530e7b32b7193f7aab1f0eadaa89376b0e33bf6e8ed32 SSDeep: 96:T4riab8A5Nio5zc2u0Tcu+gDqSqVN6ypO/sIA5ScP/7GNJ7xsXIibJsZSFyj:7aAA5NR5H366YO/sIA51iNJqXxsZSFy |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 12.44 KB |
MD5:
f43275301428d168b0b61fb62f7eb0a1
SHA1: 74a465e143da67f0f5fc0ee0dcdd042919f4282a SHA256: 7b38b913e47af80a4065684a54d0f3c70db38703eb44f531ac1f9b104fdd9983 SSDeep: 384:bRrAeJaLypZ+jcuFD8QggoP9IccJoG421xqZTBiT:bUo+XhboP9iJokc9BG |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.94 KB |
MD5:
afb7a6961e48b7ca30af5a8cbf95a7d9
SHA1: 2aba8043da2acc0edb74b2243dbfc7ff64ebf5eb SHA256: a0f3b45efbf3b6e05c64dfb9a49e48bbcf5ceb704f3d3c83be63505d41148935 SSDeep: 96:p8/Ac62HrvJBgvBFTPIVfyXrivK0sQi3mk/M3yMCJy:porHrfgpydybivK0seqM3wy |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.19 KB |
MD5:
33929218dfe1dc956d04a82dc10a6233
SHA1: 36bbcce7b98d5bf02bc6067a74680053db3f86c7 SHA256: acdaada0854551e05143bb064064c57d8e4633209c6bfebeffb136cc2c43ac41 SSDeep: 96:99cYopuVLM5mBRfiVrgq0eWC1QHCIZaPj:99cYowt6mBFiVMaQHJc |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.31 KB |
MD5:
7ca567e6206d9bb824c02069c53651f5
SHA1: a794f36863e3e2f2c29a738ea219135cabded925 SHA256: 62995fb0a373a01f53401bef6bc5039ca464213795f89c7523c47e7f9ea519d4 SSDeep: 96:JHhe6bKD+ttz4nwBuCHLmH9wpb2pA+v7l9AqIR1pTD9FhdmrN/H:No6uD6OoL29s2e+v7ZYplFerN/H |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 13.03 KB |
MD5:
9920e3f0803ae88c93bd318418b12522
SHA1: 4c6521f6e1b2c72f50f5bf1229f0214bfb5bb88a SHA256: f31037d06a1b796bfc6773556bb3d44d7cecd384cb12bb3075e4da484c07531a SSDeep: 384:42GKTIjijgavTzpfT2UewM3sp7MEIyrBB6n:rcaga71iQpYEIcj6n |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 26.66 KB |
MD5:
cae933b86188623f9dad808ce5f15686
SHA1: 06f5701285ebb80af43d816c333d5cd2a7d85a2b SHA256: ac6fb3ac3c183431b1bafb080976de55d8fd4262d49beb4ed8e9095e8e4c8ed6 SSDeep: 768:+v8VJL02nU890X9zmvD4G6iFwXoAHJmeNiPeTOzvH:+vM6sUdZkD4XiFyPNCeovH |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 7.08 KB |
MD5:
9abef33f572b51cb430979b43f2f3bf6
SHA1: 9d830c12132575d59f7d742570380282203a3138 SHA256: 154b00f318ba73e83a162053201e4fc281efcade22e1e4fdc14c9ecf9c955e2f SSDeep: 192:tgtd4qGBPOLNeaYrAgyQGU2/ANlArvpP5a2nnQIo:tcKmLNeaYEgBGU4A7ArvpoDN |
|
|
| \\?\C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
130997c7294c95e9373f02ed9d193233
SHA1: 405ad86408bb63b46c9624ed72cc912efd9c37f5 SHA256: bee80509466ab2e899158927c7380985ad4de8bb10b156d3a7af15cdb6225425 SSDeep: 1536:duDJQObBT+h3f75JHXg/v093noPwzjlcTTH1rAQ2q:kDJQObJ+h3f9J93njjGTpr/ |
|
|
| \\?\C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
5752e516f401b56b5a7c25df0f01a48b
SHA1: e1ad4f018eba1e77e8d2c970a7ab5623e6f16af5 SHA256: 566d118372a2d879a35eb35ac2a3cb789d9fc7a2d574302f2b2038bc4fbf3df0 SSDeep: 1536:t9wVa8DSgTEmiWd4WIi5fHsMQn6OIEHyAzWw4jHZUBfcnW5nq:t9QjAmrIwf7QnDyASwHcnl |
|
|
| \\?\C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.35 KB |
MD5:
4dbafe69ec08f8a2ce88f6ee37d53572
SHA1: b098afe785721e974df46558b31d2faf33c44ea6 SHA256: 47296f27f211ae9d645a4259b74b335775954d141b712ed9751d879eef63a57c SSDeep: 1536:1QghezOchwubohAMIemvaz+Bni5DiXYC0z7EgqsVrVG7:HshyigzsufE3orU |
|
|
| \\?\C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
0458df60bec1c1b42d9b0de5c997274e
SHA1: da066b3fa8635da7788ca11669fa2fd833876c37 SHA256: fbe255b3b0e670184007d6499976d03c105e1761eb54e9db69948638dee1ba48 SSDeep: 1536:iilXlrthJktSBJDEM9CiYWeaNJdOKlD0xvD7oTYhTlkMT:ii75sWjTYcJf05ITIlki |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.03 KB |
MD5:
740bf955786de98ea201e34106001a51
SHA1: 18def8d511abe5b24f70d8ef0608151fd6ac5b62 SHA256: 59992aff92242c1aae06814add409edd6b1a84c2d2484595f6885b51edbfb679 SSDeep: 24:RXJIAUpwrXkfj4e3F4PGgWnJ5Mrq6hqQdV4GW1jQ7SrziV:RXJIVmkUtO/LMrn8Q/Wt4 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 27.16 KB |
MD5:
2cc12a009bb38a6e0cc27de358ca3c21
SHA1: 43a14ea26a30cbb3a3d0e2adf000b3b89e78075a SHA256: 21ad5858d73f96d70f1472dd624afc4bdfdf1d5bdce475f02f7569f36d1afceb SSDeep: 768:OJFeqVekNEnBwHjmmFRhmEbKxljy+43sZsKIZdp4l:OJFeqVekNyBwDmmpB6wst0pe |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 11.47 KB |
MD5:
c0d7c62708084c9ae29c551f300fe397
SHA1: 5e6c9a532acf33debe61a9784586c06f26db03aa SHA256: da92811ea5e57d10282073147e0033a6d367442bf2f446dccdf4834f4fd956fc SSDeep: 192:g3wNaUu5L20FUqbRb5pEFEkVlhcQMWua9o8bC07j0l8YshhLn+FqbT+ErE5AgKAR:SGWC0ZdpivoWljbCS0AMqb8AgV4G5 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 6.36 KB |
MD5:
6025e402c636a7d969ba0abd9e4c93d6
SHA1: 69c032e610f50a2b9aba757c5e7e57394b7b7e4d SHA256: 70e4842d251da0b3fda8250cd6448ea058feff28916003b39ffad2202c6cf60b SSDeep: 192:+BQnPAhpMfBLUCdBHTYNmfRrqgqGSGCBiH/JJ4KouAcTOr:LnGutnHTYEfJTvSdifPWFr |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 9.61 KB |
MD5:
3dbb69ed6143ec1d92a9eaa4dfc8a00d
SHA1: 644a84859fd83e5e378b631205bf643501ffaadb SHA256: 1315fb3c11a78aff4b9c3dfeebf5c5e76d564e395572bf7802fc0ef1ba73b2da SSDeep: 192:PyaFSMEdAluBDzCT05tYGypxzAiGpTK1UvYJgBx+AoN+0uHe:Pu3w0DAx0DTKQYEo3++ |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.92 KB |
MD5:
a1518a3da47dbd6dab30ebd4887cf1e7
SHA1: 617c88a083ecdcd4d9fd99a9c8685f6d634930d3 SHA256: 56d27b58a69976aaffa57f343388b081fceadfc177274e400af0405054239c50 SSDeep: 96:XfW5ItAPxwB5NTh7jjWKoy/L6Z48z0jg0jLM8K9oP:XfoItbpXtL6Lz08yLM8K9I |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.52 KB |
MD5:
85675f96e6a88ca67f8353294d890d4d
SHA1: 23d1bc1ad8fb8945595a22025bcf38a03cb6d64f SHA256: 5707314ed6f14ddcb98a9f54c7854eafb6f4afd29f2e6a02a823157bcd654e4f SSDeep: 96:4s5rL65Hu+mu2nZdMPQOH12aRbz54tu1ZAw/:4ArkO+mu2dM4sjRbwY5/ |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 28.56 KB |
MD5:
06bdb1c208c7dd36f335c630b9ca5514
SHA1: 2bcf4568ffdc33cde446f1c5a278d00262aa6bb5 SHA256: 9fd8535d0465d371b42022a443ba7dbdc71d2c7f629156c354b2659a007cc649 SSDeep: 768:M4Ba6JjgXc7gEKDmT37zuV9GKqInw0HAvs6jcP:zJjOwFKib3uqKlnw0Hn/P |
|
|
| \\?\C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
972515674ca109610da6d9156b0542aa
SHA1: 531d156ff0e8390cedfb7031be0a583f4167d2e9 SHA256: 211ab13e322118a71d9dfb8c16f609a90d6b3dac4d3dfa692602ac55567257f9 SSDeep: 1536:1tWGqF/LuBFUDNSlNd8dybW3mS1xcy1PAckG3JAX/4OxAe/SVbc3:1/AjuBtNWdlDmckG8gOxAGf |
|
|
| \\?\C:\Logs\Microsoft-Windows-International%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
bc8781ae7575f1d5cc91167aacddfbff
SHA1: d5bd3cee9444d1dacea463bdd5da04eda3005900 SHA256: 2f4a580d2533f67ebb81b806f319c95826fe0bc4f49e9822357126a700a97a0e SSDeep: 1536:8q+fBYXTDxdbNV72j0ytd8gNak1J6PJidwTEkb4KkSW/z:tTDfbn72j0ytd8nAyJ7SKkd/z |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.66 KB |
MD5:
b71e2704dc3fd37f2b2a85d1067b37fc
SHA1: 2a4b183de5a4c11731d3a51b6bcad6137580fdf1 SHA256: f01a95bf6bb1098f5fbf6ae5d9e3e5d85a1b693781f13b467a5dbf725dcbe654 SSDeep: 48:tnLlHt8JTFQcRjHA0EAOqhkC8daX4tVhL4:J0PxgJAOU83t7U |
|
|
| \\?\C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
49d095e0b6db095acf95b54672475661
SHA1: 4b13cb550564f87e56276267840cb70d7b0acd4b SHA256: e4f1fd276b10706c4516bae44e34eb8d7e61cae769aac49c7fd4e3f65b318036 SSDeep: 1536:QmYDoPPlB6M4AltRT03UMxfPWVg5nKi3DmxjIxUadrOg3CD8oOqIU:xj3Cf2RT0ksf+65nTmxkJJvOOqP |
|
|
| \\?\C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
5ac8321f423c34b460bfc09b5e22999a
SHA1: ceb2e0e0589c997d36db6c6efc10e69f48666a83 SHA256: 04da13320fb6d5959ed8e41d1f7303ddb7c9fe101c0a76b93ba19723216a50b5 SSDeep: 1536:gwJvuFGJS28fJ111wkx36U4Ix9dpDjXxNvHdf4efLYqyTU6HB5sQ/MS0JL1Z3haG:gwJvmqSTL1ykx6U4Ix9djf4IcqyoqNMd |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 8.03 KB |
MD5:
f22f2ca4b015d48dd555c4ac5e9ff523
SHA1: b97626b4cd594cac6273f7fa8c6d830b924a3df8 SHA256: 9d80d4f0da22e09907bad5ff8e22e16eebfbfdd9bfb7724549300324ff5dedc6 SSDeep: 192:WwI0qzslu5dWiOhh9UPRVxepMXC5ChDCOk9EHUJtEBHJ+mARIZQ:Rqzr54qPRV1XCOBGlJtEB+RIm |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.56 KB |
MD5:
11ba3a32567606a8d0333ddbe03efbe7
SHA1: 13807adfc737ff4916e6846e4a24bffff3d10230 SHA256: 47fd797eabb5a76ce88933023321b9dda9efe59820890fdad7f3435dc79c8a5c SSDeep: 48:Y/WPM30We1k0ElfXoT1Vx7zRpoRC/URLdi2IQQz7JWx6r/+vvTCLodTH4:Y/h30Wea0ElfXCVJToUURLdFrcYQ/YJO |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.27 KB |
MD5:
58dc2a276007520cf15cb3c8bba14b87
SHA1: a5801f2da16c050da0580ce091da4ecbddbc9c6c SHA256: d4614dfbdc66bfcb420b63eccac35d1ed4f0e8a2b83729539c152a9ce9d1f979 SSDeep: 24:CWb2DhcrG4LA4IZYQFgo1wafH//+rmNrziV:Vb2Dhcq40XZk7Yf/VN4 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.36 KB |
MD5:
1a6b2b63bb8e3f2107900c03b52057e0
SHA1: 7b2a85162460c91480271ba0c8ea0c91e5ff028d SHA256: c32ef640734b5edb979958a3d026fb1ade34d534fc1811834b19e455a738e9fc SSDeep: 48:1cuv/xH1KspEvjfZx65UTihzM90zYTdNkoT33z4:FnxssCfZc5ZPzu/kM3s |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.92 KB |
MD5:
0389991c4db9b42f0b69196821fb749b
SHA1: 3fa728495fa71ecdeae9d32a95ffe24ccf5caee7 SHA256: 6a6f51fa799c8de0e803e2840298728d2d37740b40e407f0e39485bf95b69941 SSDeep: 48:E8SJ4sQYLFyIKXytmUpivylTXq/bYAerU5Kv4:1bYpyIsUpialTXqperU5 |
|
|
| \\?\C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
99b03c52f06b449edcf7f195fdf56ab6
SHA1: a49790d14ee1576f11593b50ec3b281f2f20497e SHA256: db8eda82eb2b5c0b06768ae4a3afb6deb796b175098bae292c021617224eec35 SSDeep: 1536:MxhtI9LYP6GNIz5fVMEP+Bx1AaD6RTQSfbz4YNCq3LRubN13JGmi:MH69sPjNy2EP+f15DyQSTz5QdLi |
|
|
| \\?\C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.35 KB |
MD5:
408c13d80128c1fec66ab15230c16392
SHA1: 28d78b0ac0b8785bfa97e5f5bb5581412251afe8 SHA256: b709bb7c07cb1ba6d327135f6aaea37c5f52d91aa72aacbd3c637c301ede927a SSDeep: 1536:XIC0ziB4XF91R1CM9w1DYruqZcE0hocKOvEJEf23:XICrBqFHCZ19qZ90hzKWzf6 |
|
|
| \\?\C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
ae8f08cdbe5f1229ee958b7da7edbdb7
SHA1: 4a22f3bb501de0d16e7becfec6333919675ab064 SHA256: c7b5e9e59ddf4d86e229c6afaf443dfd4f6d6f1ad32e54c872747405f40e5151 SSDeep: 1536:Qax5H6fMSC992N5mRoccArUMntvwKzxfyK47Bk5R8z0hVNlt:Q9fyeDmNrDnHzxfN47Bkn60hvlt |
|
|
| \\?\C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
542a8b890268e464d46c88679b39b2e4
SHA1: c47898600fcbfa8339d1d3886cebfa6c32cc1a7d SHA256: b0511d2ecae5189c65dd96a4efa7ae983738b219e40d6ab593202a2dc939e04e SSDeep: 1536:p9NrW+uCiGVrlb0t8S3sWvn9X4R3n2qaKOQfxnwq:NuCiYrd0uS3V4Znzwq |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 19.27 KB |
MD5:
18e4c4caf48659cad0e10e6222c58fce
SHA1: 0d6f1a2a47e20fca4888c6b17781cafcbb6a8aff SHA256: efd0f2c1b2088031feca7ac51e9a63ba01be302eafc0b7dfbbff055c5741cb1f SSDeep: 384:4oo12brDIUo+jVm8d0aXE2/DHHdpNz1GfyzH4Yaj:4bivc+jc8dZXE2/DHhzsfyz56 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.11 KB |
MD5:
67148a965dc6fe29a7b74f7cb18e3527
SHA1: 93148fdf020ffce3a82369c06d0d89d653c20812 SHA256: 2b69cb5f528627592f7301c894f09099ccf74071070f52074799831239188612 SSDeep: 96:Ej2xcYFKt05ZAVrzJpo7xM96tMnFrMZJ749RmbO++EWmo/aLRf0eds3:EKx7sGbAJzJydMKMnFrMZxURm93pFpdO |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 12.74 KB |
MD5:
b694365b93b68ebaa3668db69eac384f
SHA1: cbfabcc2e1aeb6e1ea0969815b5fc1fa7e9c9ef7 SHA256: df11349809b1d61980c7cef830dda2474a07976b02f7629420f55e3551fb0e06 SSDeep: 192:eEUprYoeSiKL5lrJDwAU7VGA8cPQ4b8Ms43zfIuXyK68Fa4M8ZXj80skA+VxL:eEUd0S5ldsdnb8JYyIt9C+VJ |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.28 KB |
MD5:
e29e872dfc526369befa97a6618f0f87
SHA1: 8230c2d7bcd8b1d268335c787a85837dbcf88bcc SHA256: f04fe217684658d8e48f372de67bf5849c0593f052250e2e1fd7b3c74ffc4cfb SSDeep: 48:G0XAqIrBkc9Xbc+MNKqwwmRJs0h1l//ekIIe8iy166SHKtkhbKmgSa+WEfzV4:GqIraqLZMNXDeh1l/oU18Vhbv7Wkzy |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.42 KB |
MD5:
4cc44e02ae9607716f02f8221faa5075
SHA1: 4f1b6068b9f7bb2af2a5ac4df204178014281a43 SHA256: cd17e6106ccd213eb059cb105bac889804b0ff878645904705a6afdafc4c4716 SSDeep: 24:U6g9IUoKqMAGjINrXZYjIuBNAzMos3SiEqO3TbE7IkVwxgfmIg/2Z4PHz+Xc/TBX:DlKqqoX0ZMMos14beImwSG/e4/6s7Bld |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.25 KB |
MD5:
4a5b042c691577a2bb0f6a345b3221a6
SHA1: aace31b6681cd60c368f07181382fe26ce3289d0 SHA256: 454706a9e209a9e03281af88d9ee5de1cc282a1dd1b2e622530b648de527933e SSDeep: 48:zpFkXGUHfwAacLnzHNCZ57EP9AbCh9vYFQSk0AtMDkOF34:HkXGIfYcLTNE5YPYG9DtGw |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.69 KB |
MD5:
635c6d0530407ce64dbb89ed30fd2fd0
SHA1: 58d3a42c37d6a4ca310d5ff9c8d45e4d3e43c438 SHA256: 59d2ba419e29bb7bc8a1dac97fc245f24b660c92099b95b3a94db64d9be90dd5 SSDeep: 96:v3DZsCqwBXcSnjnnwUjQMdgGqY3rMbzyR10Hq5e62b3S6Wyq+TMu8tPsSNzikqxf:v31ywxPjnJQ2gzerMbzm104+DK8g9iR |
|
|
| \\?\C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.00 MB |
MD5:
e3b544d46c543cf3d8e849ffa5a4fe7e
SHA1: 645e8171c02236de93f4d06b541c23488272e5fb SHA256: 10f0c4a7970f67e997f33a730801f4e92f3de0496a61e4cd8904252ab3516ba8 SSDeep: 24576:Nx5xP+WMOpAa0YteeJAxgngbhv8EzbDeYX:Nx5xm9o/HttJAxigV0gD/X |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 8.41 KB |
MD5:
c918dc38535f80f9ddd8cd007de349a6
SHA1: 56aaeebe0156af83a70678adc706a12ece892cbc SHA256: 444aab5ea8c76cdb314a4a995a373b3ae3b010f2ee626bdb5d8008dc54ea1a79 SSDeep: 192:Ic55QwvVAhyXUWwA3krMdQmx6EN/ax5YnyzYS:N5iwEfMdN6E1wB |
|
|
| \\?\C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
fb8f669fe38054a0d2144e99fa7d67fc
SHA1: 6e6bab552fe0a62ab847f60c5439680e93772b6a SHA256: 8b3cf89fa4e7c129a783eb53f863ecda703fac4cb2c19280f279d0d786d66362 SSDeep: 1536:yhckStVhJt3Ymts2UCKuzCCKlywdBPsR/oIxEVE2M:tBtV7t3Ymts2UFuz+o0sAY |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.67 KB |
MD5:
5b81ab35337f34dc355bc551ef38880a
SHA1: fce8c73c89ec119c9ecf69e2cebedcbf938e4c7a SHA256: ae79815353a51287484d1c2ce36f86ec0aa3f365bf6135e3f300a3513b81271a SSDeep: 48:ZxWJ/j+5LlcyImvuD8din52mrBaylkqi4wGplS77UXT+Q2us6g1MjbKvGLEI4:GoncT1Dh5jroylkV4wG48ylqgYKvF/ |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.88 KB |
MD5:
933a548b9d8ad4d09260cdb3921816d3
SHA1: d3a579d3f3268a25a5fac4d25e20d384624ca1e4 SHA256: 23613f2b2498c918676c1e9112391587069329e60bb12ea2c315bf938815a3fd SSDeep: 48:M4G4ckazegJmjCBdLyp7FKKIydPo2DUAj1HlPy0wH4:M3mOYYbJOp06 |
|
|
| \\?\C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
2a10f8901f559450c51937cd8f0b3a27
SHA1: 6b0abcf4353a6cc301cd6b798b9db4173ff2502b SHA256: 872b0fee00256f5593e68e75528e854cf31ba9f89d7a4c55993e2d5d529fed63 SSDeep: 1536:2CARl7W4FuNAz82XXygUKjFNdUf68rtTXXqgFKm8dhVrA+:jARd0A5HvxN6RdqgFKvVc+ |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.05 KB |
MD5:
86f14b935ef4f6aca4ebc436e647335e
SHA1: 94b5c51c6e19fd9e2df010b386d461ed1a785e16 SHA256: 86aa0c16eccb9154ca9429a9b8f62728e6797d3d30e25a622172e0f9dfd03c54 SSDeep: 96:LniWp71fOH/FkzKMHVsOsermKZs5ULghiaJaFMOr/pd6RPwYNwD:LnbRmfGKMHVNseKf6EhX3cjuPw4wD |
|
|
| \\?\C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
5b4fc62cb5ad9c3352c972bfcdbb2d19
SHA1: 999897300353eba08089af8483107ae447127b2b SHA256: f9b57c234242de8ba5aa257b8c616edd0ba7465a4f07dab111406d5196345e85 SSDeep: 1536:oUtWC64Ek/ghDNEru9wvTB980zLr/u0mrZ2mNShSyp7Lm53D4FO:VWnkGqbv715E2m6pv0B |
|
|
| \\?\C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
34ee35303fb804fb227aded77112df95
SHA1: 7591df3425456f82c877c22a69ec59a6debc6cb6 SHA256: 2b9cc155b2b54a561bb9fb5ac02abedcd62a1b290f7b94da7b203dea435a67f8 SSDeep: 1536:qgHAGNDf+gbNIyOSY/UAg20s7LY7fnAneZjie4DMhR:q4Nb+RyOSOUY0s4UneZjV4QhR |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.96 KB |
MD5:
d2e39b7a9ef18023f076dca9f4d9aa59
SHA1: d08c901def78ae85ea7af23d253e630f39496494 SHA256: 5de4bca2705dd6fe1789ac72a6aeb7ea1e549b0b56165cd4b80f7779126f8c6b SSDeep: 96:whHK5B3XLVXPMUBF2owyFA4h6M+78bHquwFyB1ok:whHK5B3XxVwyRi7Ud3 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.63 KB |
MD5:
87a4962eed2ce1cab794e2b31fed4d56
SHA1: c1271f9a42936f2ea556b70f98ad3fb65aeae2c6 SHA256: 45da186e522451a8c5c82c2abc1214cf5acb4e63583c97e0ca94165d4d908633 SSDeep: 48:/RjesYjmHjyJ6+FBP3sqkZrhAEnRe24IuDTSEgDMcWcgvDsis7xAqCoKm4:/RKsYjjE/3tnRe24FDTWDMcYsis2gKx |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.69 KB |
MD5:
72d9c583add730761c66ef190f76fb5e
SHA1: 12e30466b375f0f9d4172ea49dddb5329190370f SHA256: 64f477f53d635c328698004028a172c0b309a92c79757cad978951e32b4954ed SSDeep: 48:S2A3Qg1BfEB60e06g+VzDnOMZhpHEOJx8hACEzR4HqlUvJ/+L3iAsvTRVQB93Msc:Sp3ZzGjr6P3HEFbO4HI1ET/Qp2q3Bi |
|
|
| \\?\C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.30 KB |
MD5:
f55836cb9cf5382f63ef9d51ba5f120e
SHA1: a2633284f5a7731ed30a1ed38fa6758d66e07ac9 SHA256: e8acb62de08e449029ce2961c06bbf84e5dfa249b47c9e86e045665bdc69f9fe SSDeep: 1536:envLMrteNI4TNG1DsI+LwzmvRkI1XoNw3CBFRXbJTpWuWlc:h9M0rzDI10w3I9pWuSc |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 7.25 KB |
MD5:
1438e960b3f0497b7a4cc3c468345c47
SHA1: f2028bb729178fbce7b0751ab12758d641162ef5 SHA256: f7f1e217445b1c83df00e4e8b4a444652b84105bdb7e60ed9def501e47fd8935 SSDeep: 192:/YEoHfUQjhQld0L4cZKWz1AElTSxCMvdecORAn:QEmfNNQliLn1AElyvde3en |
|
|
| \\?\C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
17c2bb3d1548eeb6e7914c9cb28afd10
SHA1: f8391dd2d36aea049d1f800964304a3e2bf7af34 SHA256: d6d217fb3cef0b55e729634fe2f10e6f77acc249c006804e35d4edfb25026671 SSDeep: 1536:SqYNYem5OZNtKXQbB1JIJKGx52llkh/Sn7IxlxG3BO/6HL1+oF:KYem5OpUwJCKGx52lUwIxlxG3BlHL1l |
|
|
| \\?\C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.30 KB |
MD5:
5d937cb28b98aa404ae00636d3c09b82
SHA1: 626340a1ccec94f97a81d56aeced28e2aa582c36 SHA256: c90f93ece7c8e6395c629672cc667bb44756bf1586205949037b1a0855002807 SSDeep: 1536:4UYy+HWVQe/XERPsyuIHsK3/QXClaBjvpoaa3IZi6u7y6shUtasN:Qy6WVQe/eK241a3Ii6Ay6f |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.66 KB |
MD5:
c17c3c8959ee44e649a97fa381170e66
SHA1: 244730f0882e512345fa9fc518e62a14ac0c3b8b SHA256: fe7dbcb4cab1e6b46c7dd58d8aef502a572acd149292113111256665278bb91d SSDeep: 96:fNHPVbIBfFPx9gGURWiwFg3/VA1CrkSjMtl/BqwgQ8eJ1:fNvqglnwaVrQl/BqO8eJ1 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 14.89 KB |
MD5:
338fb63cc868db326b5bbbbf87736cd1
SHA1: 2df6e1eb6a4c6abee526fda712bc8367ece5167b SHA256: 2e2783fb6fd9d7145fe75b98634f144b8dc77089aee8feb0d9e5b3df0836e192 SSDeep: 384:cPBxhb998EqJXr44sI6TQTXUsRRq+W6k83eh8RlGJsN+Jd7CdL:cJzwEEkXDTQTE+Rq+2831RlGON+nCx |
|
|
| \\?\C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
f1da2a4b1d490b7f5882bdc07fec350f
SHA1: cef56ad3257be1b7a3f300b0965ddbb727651161 SHA256: f2984d5e7f084f7fb2c51c2bb5e2b1f98fe8fa5782d22df7a7b3b5a1692a4963 SSDeep: 1536:HWMKKjgbDbMtSLQVkVmaY1XGr7P6OfU6/Ft7ve8LaZqO8YyfOL:HWYjuDdpmaZr7P6OfU6/Pve8LaZtfymL |
|
|
| \\?\C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.30 KB |
MD5:
390487fee5e4bcb6996e71b881555ce8
SHA1: f6fdad36e1f8faca067e975a51774b3d40bb3a37 SHA256: 546b717908b249a6bd917ad59d4163f109e9a794f78eedfec5d24ab7eabe9855 SSDeep: 1536:8XuFaq0ZkDoOl0v8UStvD4maUeTYJck3VJ0JLXJgExFojk:3Fan6PlHLvPpeTYJck3AJLXWED |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.08 KB |
MD5:
aecd761636a5bef4fc832c57ce73b11a
SHA1: fa80fec9599ec08d9a742d2c80059e679d01a8f1 SHA256: 9ae25e193fdddb2a5e85e969dbc387ffd0dc6e0215334039163927e74a80bcca SSDeep: 48:Rvyu0Af033Xz0Fzf5dFud335LfHIOWFDjCBhVh5Y4:RA3z8LRSH57oOOyB15P |
|
|
| \\?\C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.38 KB |
MD5:
2a56c24631b11ed575dda5a33adf9507
SHA1: de0f9354bd06a3a2b57798584204b8f6b32377f9 SHA256: f8ad053af63129f0eb6e6e7358abf7aaeca3bca67e697f56f9664ab179f144b6 SSDeep: 1536:3ZJpwAQZvManme1q0L2pHMUtHF2lQ3VwFm+29ZtPZQA:bpaZv/nme1J21Mgl3wFh27BCA |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.91 KB |
MD5:
1c0fadc6ea9581395683029430055e1d
SHA1: 8330958c4a961a6ceaa1d30a58c28d4cf330a91f SHA256: b3461c5cb2003706f52aeecd448452b1232c53e3adde375dae35cdf470753afd SSDeep: 48:vhf0MYbXZ/eMf/RbdnpWsAM1G9CAeO+FgZbouXkuKcawCyPxFp4+Y16NUd2nWb7i:pf0jZlHgsG9CXO+NuXk7WbPq2Wy |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 10.53 KB |
MD5:
8601e1e21a8da333e91e512b77e47d6d
SHA1: 38f196eae93a1e1dbd72e7a2b2d4f46685e19e05 SHA256: 19031a4600e5f75c79134439c813bfe1eab88d3fc61161b7de7f5a8da8df31a9 SSDeep: 192:/uqxa/v8SvjqeJOTofgh73a+0F08zqzSCsylznh9Tz9PsIpDlfHYkp80uC:/uq2ZvjDJOEfO3a+0FWLzBhRzCaHnp8G |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.38 KB |
MD5:
89b557c043919ef5e76843de5d2e65ad
SHA1: 9bdcf0866aa89d7796cc50c34166c611a97e3a1c SHA256: c4723308ec1740a8becb1ff2799c2fd111bafbb97d7218269d961ccaa012c6bb SSDeep: 96:6340lgqAisXXKACrm/1hA01pmLQk16AS0OQPzP2tu2jur:6oI3AigKxo1hvpmL36mOQLP2v0 |
|
|
| \\?\C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
d9d2f1ecd2f444cb4d4a6cc3b72cbc01
SHA1: ede23287a71ac4f5d4fca83e47f22837e53b7cee SHA256: b469f78261ce33497379f8ff8f12234e122730b37d7d2742d9c16f7bdc0eb0a3 SSDeep: 1536:Xn5mErgdXieFRoiqS97pCYOVxtnkp/oeLoFQ8+lMYb:X5m6MdFRASPCT3Zkp/oe0t+lMYb |
|
|
| \\?\C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.36 KB |
MD5:
ac11b0eb67cb3389cac5b659050af84c
SHA1: be18a21ac14330c120a7a50c4c4fb281cb8824fc SHA256: 822406a0b6269730ee6211a4008836f9fe446b1a249548b55482bfd9989943b5 SSDeep: 1536:fxNet2kjd2tgic+aBbx9H5kUUGluJI+SlWoqeZJ784b:iDjYpstx9H25JI+SlW5Ui4b |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.72 KB |
MD5:
2d9273c1a360f988a7916cb4cd522eb8
SHA1: 85ca22cf60625a706d8f0c831cba5ea60b0cb2b8 SHA256: a7ca26490c20d8566e9c29bca58cfd0f735acd42e5b0c2e8fc3b89135f158b42 SSDeep: 96:PPdbVYBYBhdkeddZZsqSUH0eM9N/j+a0kCzPOZ:P1+BUhU60J//4kEP6 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.61 KB |
MD5:
85b4dc04c8553020b737597daaa80c88
SHA1: be64187aa5511c4be055ad72330b874e0afc1763 SHA256: 6a9bf8744a0aaa53904a67dcff792a19b3943f008d4d820137367ac9f9034ab7 SSDeep: 48:/yaCdt6myVrfnwmO28Tr8/oYnp6HX/2u5tSC6Ht0boWZqurtMwThDuG+Rf1aK4:/yDdAm6n3O2kr8/oV+MYCEt0TZBtPDuU |
|
|
| \\?\C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
a75c666cc3877f4dd3839cfe46747279
SHA1: aadaf362bfd320314b5e36f514df97555a2fad7b SHA256: 43578f735bc5abaa9f33605a0f70bbeac6cffc30c3da5bdd766b36f15d83de50 SSDeep: 1536:AKaOoD/jQ76ubzAbe4GIyO50hiAQiMdbMQWHKwKgJku7:XaOoX+WSbwqhQlBiHNHJp7 |
|
|
| \\?\C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
fa4a3ca49e6378c30884c9af450b9f12
SHA1: 7ecdc00d4e7c485a29ff41477d5e11767a29076e SHA256: dde250d7a534815a9b3da5f63ede995fe4ee93a411f5eec9488b1eea3222d5b4 SSDeep: 1536:rb5Jzl7JusbByEcO5xacwwHggQgrcwVYMRq/Q+dnqkTNigpPTfvhJCGvm:XL57LyEcO5xaNgQZwr+7VRJCX |
|
|
| \\?\C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
e28f51473ff153b2efdd2a4488db9fad
SHA1: 12dd6ad7aee691f4b8af74fcd030fb245175a34d SHA256: 46e20c339fa004a39c02acc441a0e55f4a175c819f5a1059179f6789dfb070f1 SSDeep: 1536:Bo2LlYcQiPYRX7BfFHqk5z/Xh1t+PI3T6/7kENdFW/OHbSZp8/prv:uGJYRXtth57vDT6/YENTW/gbSq/V |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 4.10 KB |
MD5:
8d35af1a17102e8717534fbd0de4aedb
SHA1: 4c0c2939854ce8af1a4c1c62bec9767f8f21e8bc SHA256: 439b77fa00a54ebec2db34c3266fb01ae22dd461a78d04ca3b8ff43602c26582 SSDeep: 96:reBK3pdII+XIJsNkYUIkSJs32d3nxQwYaF:r4gi4GkYUIpJsGxn6aF |
|
|
| \\?\C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.00 MB |
MD5:
d357e67999e76a13a9fde0e54805a17f
SHA1: 723e6c00cd43d8a99a7b653badc17bf805d882e8 SHA256: 33bf6bc3702e89817d6beb6d5a717ec62d2116077357182a2c743513208daa00 SSDeep: 24576:dyF41tTdPGDTJ0uG2JPrbYOVJ8c2iJ/SODS/+lM7IqXs:dT8TJ0krFucRW/+lOc |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.46 KB |
MD5:
4589a9c61c9790b2f3233917d1dfc8ed
SHA1: f09dbdac704fae47db40c9e4d52d8afce7208608 SHA256: 799650d4dd228ea7931a363de558f53f6816c0ceefe02dceb9cfdbbb01213f78 SSDeep: 48:3t5GSvPXPWjJTZTfEynvv9vkovvzWGhzrWG1rM7zBSY7vEjd24:TGSHfuTZTswvvuoqGNrV1rKlvEn |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.46 KB |
MD5:
e95af65ad7f60dd8e11b17e6e9303bd1
SHA1: cd6ecc8d6a8924e3c0e17cfe55a890febd100785 SHA256: a97800c70b3e4b5e6e2f9a5e58443d7ce443cfafbbf11286a35140380dc59167 SSDeep: 48:lzXRgN6MmKCWqoPhATEO3/BIlJVoi1RaFDJJBa2D4O4ZnXOFbTyp4:TkEWqoinPelL1wJBV8O4ZnXO5Z |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 48.63 KB |
MD5:
0796287421a0e88f5723f3219f0216a3
SHA1: 3ef32cbc6e63b43c2b99a74b2ced44304b38c04c SHA256: 95b1cb6013eec83959f3898081cd428a95a5ac50396a9c3243d45362984b3c3a SSDeep: 1536:EwoZWrKFhnYpEJ0KTineJqBm4+B5RfkZ0+QR0:ExYrKnY6JPvMkB5Rfk2+60 |
|
|
| \\?\C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
d7405da01ea94eb85403dfbd5305fcd9
SHA1: 4827947bd04ed39024ada91eecea9900650e9098 SHA256: 4a9379d50fd90286723cd0a9fc65b5b81228ad8bb1a46caa573ef3dbddd7f9a3 SSDeep: 1536:3Ium5CDZaTg480JyV1IP5VcUvnMlrABloT+eP1otq5RnVm9EVePPcRh+cYTYcrLh:kCDcgdIPcUUlrAXoTTgW1FVesOcYTY+h |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.13 KB |
MD5:
d4221e2c9effcc9f4a1caed182fcd82c
SHA1: 2b71a203b9c9c34b57e911edf636630bb9338083 SHA256: bdf25af8498229579de671c1132536c1477ca2df35e5bae642f9ee5226459fc6 SSDeep: 48:kB8e22Nuf91tZrLK+Z3FfRk3GUyO+618AoUjKWx7nXTJdF362Xttj9pjQen9j407:IFy91DrVjqN+61/jR3vXt79Vt |
|
|
| \\?\C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
896394f6128ea49ecd6115138da3dcca
SHA1: 45d179c01b4fe582beb45efefad023c9b38a47b2 SHA256: 47438d06240b0c2ea37123de0fa997d6651c67244fc200f9d629194c122d0548 SSDeep: 1536:cNmylGN9XJb22WECP2BsuvPzscx3hBlQeAYSJHuZT+1Kzy:cNm6+5JxWjisuvbzP/ABOZqT |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 5.39 KB |
MD5:
0edd7e93395caf8308d43d944e53c58a
SHA1: fdb6a857e08d029bb0326be547ba8864457c4224 SHA256: afaa8c56d820dc151411183f977620a48decb29eacd513cd8d68850cc47f1546 SSDeep: 96:Yqwtb4iYyLUQVkywqwtW+XAVo8OQTBaDSHdvtci5Q7lSS:Ynbn7pw1tW+J8OQTI49Wiq7lv |
|
|
| \\?\C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
c77051cce4071d21d6b3e7f0654e2fc7
SHA1: 6d1cdb5b3d5e4ddd744fed299040ddcc876faf4a SHA256: 232df296b8ceb1c756b113f87171f90d1d400c30799a3b7a370eddb8e2b7ff62 SSDeep: 1536:Wcp8RrF4/AGok3LogHguGXvNNIgDu9SU3it1mCrm:Wcp6rF8AK3LogHzGfNOgDut3itxi |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 30.64 KB |
MD5:
9b7461c6a79717f75eaabefa2848c3d8
SHA1: 5e6ff90bc10ef1aaf2c50f3c75aaa4a84e41e822 SHA256: 91707edba4f419971e99ff83bf394f1cd3c1f19ea7dca5e805016b1913877c17 SSDeep: 768:DrQBuvicAHuXjraOuw78wMrlIHb4QNu3dgGurn:DrLHE8jr+w78wo8bDu+rn |
|
|
| \\?\C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.30 KB |
MD5:
c08d2d3b4f63303a0ac94b85f2b69a51
SHA1: 0b921db510cd0d01389b4955491acb68a7552e17 SHA256: 51e03ad0a561505f51016c8da40fb4cafc3e25d5a495927edc2784c261b8670d SSDeep: 1536:iHtK/vdotOm9US6fE/X59Jy64mi41wG+jbzsGU418nqU0Joho:iNqotTUVfE/XbFxGNqqU0Jwo |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 8.31 KB |
MD5:
44d50a5d8f7b2e886fe2801900474743
SHA1: 4a7be37e6e84adbf0212114d993e884d278fbae9 SHA256: d5cd41af5fe4cec549c4697efcd3c380ba1b2176d5bed2affe737b0af870def2 SSDeep: 192:h/IG1GS+wbhiC4PbwFXBBOxrpIcIvCe50BLY4cSFMz5CSMLNLW:qG1G/5zbwqxrecIjALNFMzwSMLtW |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 10.33 KB |
MD5:
a86827a1ae32b04b1fc1f32403d7de6c
SHA1: fe1f1cdfbcc72e9ae08b806665c96f9caadfeee6 SHA256: 6296c8c9c6eed978dc98c7bd361a598d3db793bd01f0882cfc769f9e66df76b9 SSDeep: 192:sES6hzt8fA6uvMmdLKaIvZD7fL31FtPlzhSXNvvFEPMVvgQn:sESE+UdddY7fHVSX0E5Hn |
|
|
| \\?\C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
9c0305f15086e440c221bf870f54cccf
SHA1: 5ca83e193cb3e3323b4213f8ac9949e3c2b8e1cb SHA256: b5c3b5c767d32953cb7bfd81d46447513067a979093ac72b6c216a4ba964e4ba SSDeep: 1536:c62h5k77y/7qITplF5ESqmlNBvD4TbELuRIB62p1ZNq:Ghu77Q5xL74ELuRI82p1Z4 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 29.17 KB |
MD5:
2cff941bf48b66143fc5d4b5fb56bd61
SHA1: f4a78b9fb1bc7275486e50630fd2750ca1aa19e3 SHA256: 233db9feaf305974580ed3862a5890a8a9c0b5b0f1079a57e621aa900d3a8c19 SSDeep: 768:7HUV4s9ZWYtyRPZm5Ds8ul0BP1dzdEMtL+RrWmqQWS/b5RS++:7H4EYtyRBm54yZdEMyrWmJTXSr |
|
|
| \\?\C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
0d5a9771541f6d27b62064d8e02f717d
SHA1: d4f67e0849f70b896fe1dd057f1839bdab5e97e9 SHA256: 4a4b03cbc2a6d34cc2abb039ce631e78d49055fb4be0c17b7b331f0527fda047 SSDeep: 1536:mfylTpqEnP+K2ak9HMpq1KlfP/22wBGzVdWperOxlK02uctbU3/Msd/:UylTMEnP+Nak1Mwqv2yzrWprAZF1CUsp |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 3.02 KB |
MD5:
cc588f3144f6cc1751bec6c910842b2c
SHA1: bd07ae2b88ced32a2e07c9f9ee0f17d44dcc49fe SHA256: a5ab4e6d31e63a5701a9cc516669770ac5378858507d3a929226d544930715c9 SSDeep: 96:8rqLkE85arEzs6glDyWgp4+axcqsddHPqUtKb4Uu1GA:Q2kvNvgo3p4+axcXIU6o |
|
|
| \\?\C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
1c0ebaa652d6cbadea3c7aa75201f750
SHA1: 9a34e47bc92e7b15b603285f9e848ee991831583 SHA256: 27dbbb691de07c5b9d5a3552d19b96355561e0b5672984a6561321a78eb61913 SSDeep: 1536:znrG1KWxxoJOg27Nsr/w5TlI4lWtRwnO1OtXrQ:znrjWx4F0wY7otRwO6XU |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.88 KB |
MD5:
8a4a9a37c93733c0138e28992c32daa4
SHA1: d1c70db63755982db717b096a0a00f93813f7b98 SHA256: d69dc74cb9659459290bad24c3cadadb8f6c64c726ee56191a074677578d88fb SSDeep: 48:vXjNF6JvuyHmNyKpzrh6853OxdmLdBK8vCTwgNfzEWgGPggYsmH4:PjNF6EyH2bpz9z534mn3vCTwgCuggYs/ |
|
|
| \\?\C:\Logs\Microsoft-Windows-Store%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
f038b5f5f4d6623a30a2607835442866
SHA1: 85a712214b6675a7407dd2160418abb98795364e SHA256: c2247c8d9615f75a491898cd1fc6483192aa053265f9c68a789b181637edb620 SSDeep: 1536:NWHgsj2S6KwyJzPWL7an8KBc9D7K0a/+c4mUy03zKx/fw4y6Yhik:NWA9SlJC/an8T9HRU+cjUmHwRL/ |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 37.33 KB |
MD5:
26ae3ca8bb771e5442ad6a5923f004d1
SHA1: e1d5a98dd8b688c09778ab802ed9181081521a5a SHA256: a596535192b4757a07c8b2e0917ab8fc1e7077ec23eeac0119a98836ff2f6b49 SSDeep: 768:65vERBZZMf74gmjLGY1zWTCuLES9poz4mPuoxTGZh3AYiktxX8Vq27NOTeCkuX:fT371SCHSgUmDUZh+ktR8q27NOTeCjX |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 39.33 KB |
MD5:
bcfc11d91b364d422fcd352de885d616
SHA1: 7a92a9f5fac4eaef03ac6e544808710d673ba812 SHA256: 8e6358867e8a4ecef15454b375c21bc518c2a86ce95f585f9e284a284763e117 SSDeep: 768:C4QyQO8KvdJWMz9Og0E5t26Qhm67v+Hqip10n0+2h+GwIiu9d+VfqwfsvmU1:zQJFKv7Pv0F6QEscqiHONi+LIiu98VfU |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.02 KB |
MD5:
032b2fe505b774d500c870cd7645f46e
SHA1: 7fe00d51025a6244540eab1631590eab3695a185 SHA256: b2ffc3f709ec9940f6582e6bbb6cc2c5ad16f01a310daf7cfee5067fcd6d5527 SSDeep: 24:rT8A27CJbl9fMRjI3zf1cwZI4cHcDYfNy3SsdeJrziV:n8feJblyRjI3zf1hZI4isL3oJ4 |
|
|
| \\?\C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
d958f852c4509ea432cca18df79bf39e
SHA1: 4b12f39d6b6b326520ac352d89d9519df6911178 SHA256: 61b9c2902b34923993d642aa63932e3bfe1979fc3eba2d24100494220293823b SSDeep: 1536:edfkX0y+09dmG0Tcu9rFYZ2+jg1fC+TXszI5Vk1EvHj2:eNkX0y+smZzrk/+zszAk1a2 |
|
|
| \\?\C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.36 KB |
MD5:
004d95ebbb2657546bbad098ea568305
SHA1: 2d7eed4f4a047e6684ebe1ae265ce7e97155ab86 SHA256: 882d5971584691fc79fca25724d2d4fae4f329446749cf7acd5ebfb97a5085db SSDeep: 1536:HNOR87AjbYnM65HZtHNnC/IKJ1e3E29Y13yGwo8aQHbR:0R87f/vOIU1eFY1/wfR |
|
|
| \\?\C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.38 KB |
MD5:
70773def9c8ace6a829d37e9ebbd1112
SHA1: feadc43490653973654d88cedb43ffa814ff4676 SHA256: c2bde76c6d82f57b8211a3ffd9558b516b6940ebcd4bd517d26fb14b9eda5b3d SSDeep: 1536:xyNKM/l3zxkcSDl/PDHAboakdrTEZLDWLwvAjroFqQIYhEjWBjEuXDqQx:xmKMtjxQDFdrT6LDuSAjXU9xtx |
|
|
| \\?\C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.36 KB |
MD5:
ab1c1d79dae5ba95e6e0e0fdca5209b3
SHA1: 5d2702b0117738fb54149890bca7a911e0ffcbc3 SHA256: 5ca58c7952d511adbe8f0e064a359e525523197667b374b300261a17e9456087 SSDeep: 1536:lO4kd9cSyGhTlbXrGiH1b7JkLc6/KPrQydRys4loM:lePTljrHHNKgBLysy |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 7.89 KB |
MD5:
560687670408d68219b4e03b705c5052
SHA1: 951cbf0f9d6e73b55956e8539c859d6bd02dbff8 SHA256: 49e1461b2b3a077a6dfa71601c7f4cfce8d7b6272584abaad82e291d5b4c1d46 SSDeep: 192:vLelMyA3KfsCO03pTVxKPd+IZpRucI/hqFgN/:+A3GtOqpTVxMMIZVI/Xd |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 17.42 KB |
MD5:
e8d7a7ef36e9f02f66a194e22e140404
SHA1: c700fb1195e63dc63b914356c75e5cc520e8ea94 SHA256: 2e37b77009dd72a707c4e1e7a40dbeac9767647145813c3b6b6952042de48f07 SSDeep: 384:QMmaS8eAZWjJu1yf5h+IpNwdBsKsArstclKUIA2kXpm:RBZWjE1yf7ck4stcdInYpm |
|
|
| \\?\C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
8a326c347cf1d4718dc62279482503d5
SHA1: e4e0052aec7dd7d266ace807caee1a64b0aa27ef SHA256: 6042d9b18c4c92c845b4360c4be8f1505981f5c36958a465367b4f11a985f4fa SSDeep: 1536:sTKN2/PofCmviiIq4N0G1mEQLnEbLMq1rtrDS/OEA:hN2/gqmviiIdyG1mfjeD9+OEA |
|
|
| \\?\C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
74a890563cbefa4c84c4bd806ef9764b
SHA1: 911a21cb2b1f20107fb198a302fbf076a9c8163d SHA256: f84a156ef21a90afa462813f5fa8f9299f589556f34e886b38fbbbafee2f8662 SSDeep: 1536:xfBy/KAjjWkz6X/h8eYZP6UrJ/A5XFxc3i4kivEAoa43W4:xfCKcjj6X/gUUrtsVElkgEA3yn |
|
|
| \\?\C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.35 KB |
MD5:
c77b031d2b55e19a38b5ec4908a87b7f
SHA1: 27aa6ae2718b556d42b83fcaa50affc5eda622b3 SHA256: 483459c83ea1736306ea05901520f71c6e021172e62a3b38c29372976651293e SSDeep: 768:feyl+k5BncHTnIgt8WDdlGIHdHPa/UiGFOiLBC3uPEbSsEs1rOZpaxdec6JZzE5C:feXVnIg2KTd54idsuPEUmGpaxdeVzD/l |
|
|
| \\?\C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
6231579603e611ef54ef2d4dc94f94c3
SHA1: 03c1f61882014fd9720d43af55c7dc461dd2872b SHA256: 6872e8707f15975dd12ee0ac4526a129f8880168c7ab704754aa8da9dcd00306 SSDeep: 1536:0/5WqI5Yb54kIdGfQDpzV9tjK/aKr8z1zjSdYs/ADUvYY:0kCukZfarudoz1mzSG |
|
|
| \\?\C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.38 KB |
MD5:
7dd3fd9b29456879ccf692105e73476c
SHA1: ce864d34d601dcb6366dc8b4ce9afecbcabad7ca SHA256: e2863a9c8afe53ca207bb52f4b5d659c0388481e643d1442b6453875263735cc SSDeep: 1536:SEKbLFtigvL1M6ckUqbdaYdMwO/juQNjZ1uacG4sExzoglA:sigpFUqpaZLZtZ4bsEZA |
|
|
| \\?\C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.35 KB |
MD5:
36e80263911501bfd9ff2d27f60b706f
SHA1: b9a670b5793dc4a46358cff2ef151b0b6c6a8e9a SHA256: 6624bbb545c30856f13d0e2a453048d010e38350ebc2c7e65b064492c82bd51d SSDeep: 1536:x0g3jiRmExd6sbbE+zSZ2c8gyx/dTx1JGbSRdC6fL:Gg32wod6QE++Z2c32lT3JGbKTfL |
|
|
| \\?\C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
a49332a76da7e16c0b16c1c6c0e2aa04
SHA1: 83b20f7c4f04c46be24e001af8f1bcec3cdea0ec SHA256: f202534c4393ba4c0b8658bab39b2e1f4067a0454b4a1eb576859fdfc10ee040 SSDeep: 1536:+vVF2vDElQqkzIQ5AlWE5aUoXTXJMMInX+MP97:+2vDE6qa5Gl5uTzInua9 |
|
|
| \\?\C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.33 KB |
MD5:
6d96e9eb43f5f76c30ceba9bb00bcd49
SHA1: ecc0523818c61393023d2a62c0a0b34cf85801d5 SHA256: 6c0d1fce964e3c0d775fdbca78c358d488605d4b4b446e5fe54903da4d0b4feb SSDeep: 1536:Xey0l0RQDF1B8b9671hIFeobas7Vc6r9+xVYqbj4IF6:XXPWh4YbjobaceWc4I4 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 42.24 KB |
MD5:
68ae243e77ad878b9ae16575c3aa897b
SHA1: ef7b3957a35380aea969461e3ce4edfceee89f06 SHA256: 6fd99ee4dbfdcd979f78e066f71159144099160588b6c4968dc9738fcf0d41d6 SSDeep: 768:W+gor2vJWFwKcJI/M5BQIyezlVJ9F12lu7QDxYA0LeacdJl3YerLQUggCbMNos6i:W+7CIFlcJpDF12k7iYA0LevIegUgg9Nz |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 42.14 KB |
MD5:
5fa067b503a7dfb01c0e49c05f80b801
SHA1: e8c1698298cc7b695c376f3053da03fba86b1333 SHA256: e9f710359ef5224cb558b8bda6d2274d59c9e79811b64b48a1b4291ce89a353a SSDeep: 768:HvYNb1AAlQY5/689fo1dUjHHjesFcFPcXHx7gbTtgcGTh6InH6G9aevo7x:HgNHlQQ689A1+jnj1O+3uB0hTH6YaMo1 |
|
|
| \\?\C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
9fc3bb9def028b614cd0c8870f930c47
SHA1: 2697ba7f83089568a313d4870d7ed4aa809eb779 SHA256: 98a1ec7f151dca1a7db384f4561733e247d53f083169122cf09d222215b1073e SSDeep: 1536:nKeOQV4FMcaE+5E3Y4BtOPT/bXiL76KOmAeaASxcp6:nKeZzE+abMf/KOmHwQ6 |
|
|
| \\?\C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.39 KB |
MD5:
71a4969951f685e0063da29cc2e833df
SHA1: e43755dff2c62312ea272961f3e55301ae0ececd SHA256: 3b675c28c6c33a6c3175be9f451f821a1c201df852f2f403e954d3e309b9e5df SSDeep: 1536:C6vBfLr2b0fyw/Rj89CIXbRhyBunfUsD/4WjhTc0GX3CQJnCLdI:CkBf00Rj8EILRMsncShTbGCQs2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 962 bytes |
MD5:
1416eb3ef16ae99d26df30f29fb1776f
SHA1: b59cf6e14aa7f88beda58306b7197f275420c520 SHA256: 95adffa8dc5734effd3bafc06ac510f0934133a7dc11d1834ffd07ae4250463d SSDeep: 24:QV1Oq2bm4FhaKNWYL/eGJGfECRBYurziV:yOqUyC/ZCRBYu4 |
|
|
Host Behavior
File (3980)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | \\?\C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\GetCurrentRollback.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\GetCurrentRollback.ini | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\preoobe.cmd | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\preoobe.cmd | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\preoobe.cmd.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\SetupComplete.cmd | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$WINRE_BACKUP_PARTITION.MARKER | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\SetupComplete.cmd | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\SetupComplete.cmd.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\SetupResources.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\DisplayIcon.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\DisplayIcon.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\DisplayIcon.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Print.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Print.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Print.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate1.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate1.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate1.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate2.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate2.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate2.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate3.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate3.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate3.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate4.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate4.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate4.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate5.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate5.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate5.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate6.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate6.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate6.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\eula.rtf.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Client\Parameterinfo.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Client\Parameterinfo.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Client\Parameterinfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\LocalizedData.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Client\UiInfo.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate7.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate7.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate7.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Client\UiInfo.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Client\UiInfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\DHtmlHeader.html | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\DHtmlHeader.html | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\DHtmlHeader.html.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Extended\Parameterinfo.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Extended\Parameterinfo.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Extended\Parameterinfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Extended\UiInfo.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Extended\UiInfo.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Extended\UiInfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate8.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate8.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate8.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Save.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Save.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Save.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Setup.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Setup.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Setup.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\stop.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\stop.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\stop.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\SysReqMet.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\SysReqMet.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\warn.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\warn.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\warn.ico.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Core.mzz | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Core.mzz.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Core_x64.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Core_x64.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\header.bmp | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\header.bmp | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\header.bmp.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\ParameterInfo.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\ParameterInfo.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\ParameterInfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUi.xsd | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUi.xsd | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUi.xsd.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SplashScreen.bmp | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SplashScreen.bmp | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SplashScreen.bmp.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Strings.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Strings.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Strings.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\UiInfo.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\UiInfo.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\UiInfo.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\watermark.bmp | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\watermark.bmp | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\watermark.bmp.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BOOTSTAT.DAT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\updaterevokesipolicy.p7b | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\updaterevokesipolicy.p7b | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\BOOTSECT.BAK | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\BOOTSECT.BAK | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\BOOTSECT.BAK.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\BOOTSTAT.DAT | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\BOOTSTAT.DAT.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Content.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Content.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Core_x86.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Core_x86.msi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Core_x86.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Extended.mzz | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Extended.mzz.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adojavas.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adojavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Extended_x64.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Extended_x64.msi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Extended_x64.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\README.txt | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\README.txt | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\README.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\Welcome.html | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\Welcome.html | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\Welcome.html.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\AppXManifest.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\AppXManifest.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\FileSystemMetadata.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\FileSystemMetadata.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.HTM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.HTM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.VBS | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.VBS | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\SLERROR.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\SLERROR.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Extended_x86.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Extended_x86.msi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Extended_x86.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\RGB9RAST_x64.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\RGB9RAST_x64.msi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\RGB9RAST_x64.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\RGB9Rast_x86.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\RGB9Rast_x86.msi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\RGB9Rast_x86.msi.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Setup.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Setup.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupEngine.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupEngine.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupEngine.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUi.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUi.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUi.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUtility.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUtility.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUtility.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\sqmapi.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\sqmapi.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\sqmapi.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\BCD | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG1 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG2 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bg-BG\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bg-BG\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\bootspaces.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bootspaces.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\bootvhd.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bootvhd.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\da-DK\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\da-DK\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\de-DE\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\de-DE\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\el-GR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\el-GR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-GB\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-GB\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-ES\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-ES\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-MX\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-MX\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\et-EE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\et-EE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\chs_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\cht_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\jpn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\kor_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgunn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgunn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgun_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgun_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryon_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryon_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryo_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryo_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjhn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjhn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjh_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjh_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyhn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyhn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyh_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyh_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segmono_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segmono_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoen_slboot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoen_slboot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoe_slboot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoe_slboot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-CA\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-CA\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hr-HR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hr-HR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\it-IT\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\it-IT\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\lt-LT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\lt-LT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\lv-LV\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\lv-LV\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\memtest.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Copy | c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\ph_exec.exe1.exe | source_filename = C:\Users\FD1HVy\Desktop\ph_exec.exe1.exe |
|
1 | |
| Copy | c:\programdata\microsoft\windows\start menu\programs\startup\ph_exec.exe1.exe | source_filename = C:\Users\FD1HVy\Desktop\ph_exec.exe1.exe |
|
1 | |
| Read | \\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini | size = 1114368, size_out = 129 |
|
1 | |
| Read | \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini | size = 1114368, size_out = 129 |
|
1 | |
| Read | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini | size = 1114368, size_out = 645 |
|
1 | |
| Read | \\?\C:\Program Files\desktop.ini | size = 1114368, size_out = 174 |
|
1 | |
| Write | \\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 144 |
|
1 | |
| Write | \\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 144 |
|
1 | |
| Write | \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4144 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4784 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml | size = 4464 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 656 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 176 |
|
1 | |
| Write | \\?\C:\Program Files\desktop.ini.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1424 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 8592 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 14160 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 15280 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7808 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 160 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif | size = 12256 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 160 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 176 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 176 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 160 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 160 |
|
2 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 105504 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4240 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\README.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\README.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 63936 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\Welcome.html.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 960 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\Welcome.html.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\AppXManifest.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 786706 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 145184 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 288 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 174544 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 94480 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 36352 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\AppXManifest.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 262144 |
|
3 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 387360 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1536 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 800880 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 496528 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 253728 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1114368 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 10576 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 19456 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 763376 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2160 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2160 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 215888 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 343344 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 14928 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 357360 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml | size = 65008 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 9232 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 399536 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1456 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3760 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 527968 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3376 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 9840 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 384 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 9040 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7232 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 14880 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 6688 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 8112 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7696 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 786722 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 262144 |
|
3 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 11904 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 528 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 512 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 12704 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3152 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 12496 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3488 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF | size = 2608 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 15312 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5328 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5040 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4960 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7584 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1152 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 6992 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF | size = 13264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 8592 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5376 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5024 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 9264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
2 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4400 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3968 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF | size = 3392 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3136 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4736 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF | size = 3040 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5696 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 20592 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 10848 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 14432 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3360 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1600 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7984 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7088 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1840 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 26336 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 27872 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3760 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5840 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3024 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7376 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7552 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 6640 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2112 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 6064 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3424 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2640 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 6640 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4624 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2352 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF | size = 69648 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF | size = 338 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7680 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3152 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 8496 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7808 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7808 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2496 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2032 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3360 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4304 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3232 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF | size = 4816 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5008 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4880 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5008 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 26896 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 28960 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 11648 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 22528 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF | size = 16192 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 17248 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 16128 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 16688 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4928 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4080 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 24336 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 26752 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 24784 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 48000 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF | size = 40208 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 47792 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 14544 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7968 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF | size = 20560 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 13520 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 20192 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 20464 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 15744 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 12992 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 9712 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 14496 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 8784 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 18320 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 11072 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 9824 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7872 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1024 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 896 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 12528 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1472 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1712 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1520 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4000 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 8080 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 10160 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4032 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 14448 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1552 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4720 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1744 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 9312 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2560 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5760 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 12496 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2656 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5280 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3792 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3024 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4176 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 13104 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 27056 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7008 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 816 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 27568 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 11504 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 9600 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4416 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 6272 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3776 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3360 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 29008 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1344 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1456 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7984 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2384 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1056 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2176 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1728 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 19488 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4992 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 12800 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3120 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1600 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1216 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2064 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5584 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 8368 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2496 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1680 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3904 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3808 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2448 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3536 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7184 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3504 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 15008 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2736 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 10544 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3568 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2432 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3952 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2272 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2272 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 49552 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2976 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5280 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 8272 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF | size = 10336 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 29632 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2848 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2704 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 37984 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 40032 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 800 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7840 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 17600 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 42912 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 43008 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 720 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Delete | \\?\C:\588bce7c90097ed212\1049\LocalizedData.xml | - |
|
1 | |
|
For performance reasons, the remaining 2935 entries are omitted.
The remaining entries can be found in glog.xml. |
|||||
Registry (20)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
6 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
2 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 528392, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 528528, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
2 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 115, type = REG_NONE |
|
2 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 528800, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 | |
| Write Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | value_name = ph_exec.exe1, data = C:\Users\FD1HVy\AppData\Local\ph_exec.exe1.exe, size = 92, type = REG_SZ |
|
1 | |
| Write Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | value_name = ph_exec.exe1, data = C:\Users\FD1HVy\AppData\Local\ph_exec.exe1.exe, size = 92, type = REG_SZ |
|
1 |
Process (4)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Users\FD1HVy\Desktop\ph_exec.exe1.exe | os_pid = 0xf98, show_window = SW_HIDE |
|
1 | |
| Create | C:\WINDOWS\system32\cmd.exe | os_pid = 0xf7c, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE |
|
1 | |
| Create | C:\WINDOWS\system32\cmd.exe | os_pid = 0xe3c, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE |
|
1 | |
| Open | c:\windows\explorer.exe | desired_access = PROCESS_QUERY_INFORMATION |
|
1 |
Module (33)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x75e90000 |
|
12 | |
| Get Handle | c:\windows\syswow64\advapi32.dll | base_address = 0x761b0000 |
|
1 | |
| Get Filename | - | process_name = c:\users\fd1hvy\desktop\ph_exec.exe1.exe, file_name_orig = C:\Users\FD1HVy\Desktop\ph_exec.exe1.exe, size = 260 |
|
7 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x75ea4ae0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x75ea4b20 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x75ea4b40 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x75ea4b00 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30 |
|
7 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CreateProcessWithTokenW, address_out = 0x761c0c70 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Wow64RevertWow64FsRedirection, address_out = 0x75ea6b50 |
|
1 |
System (42)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Sleep | duration = 5000 milliseconds (5.000 seconds) |
|
1 | |
| Sleep | duration = 1000 milliseconds (1.000 seconds) |
|
38 | |
| Get Time | type = Ticks, time = 126625 |
|
1 | |
| Get Info | type = Operating System |
|
2 |
Mutex (34)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\0001B419773000 |
|
1 | |
| Create | mutex_name = Global\0001B419773001 |
|
1 | |
| Create | mutex_name = Global\0001B419773000 |
|
1 | |
| Create | mutex_name = Global\0001B419773000 |
|
1 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
3 | |
| Open | mutex_name = Global\0001B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
5 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
3 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Release | mutex_name = Global\0001B419773000 |
|
1 | |
| Release | mutex_name = Global\0001B419773000 |
|
1 | |
| Release | mutex_name = Global\0001B419773000 |
|
1 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #2: ph_exec.exe1.exe
102
0
| Information | Value |
|---|---|
| ID | #2 |
| File Name | c:\users\fd1hvy\desktop\ph_exec.exe1.exe |
| Command Line | "C:\Users\FD1HVy\Desktop\ph_exec.exe1.exe" |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:00:36, Reason: Child Process |
| Unmonitor | End Time: 00:01:06, Reason: Self Terminated |
| Monitor Duration | 00:00:30 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xf98 |
| Parent PID | 0xa9c (c:\users\fd1hvy\desktop\ph_exec.exe1.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
F8C
0x
F80
0x
F68
0x
C48
0x
4BC
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| ph_exec.exe1.exe | 0x01080000 | 0x01094FFF | Relevant Image | - | 32-bit | - |
|
|
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| C:\Users\FD1HVy\Desktop\ph_exec.exe1.exe | 69.50 KB |
MD5:
99e04531bf6237e855a1d1de9f2dae1b
SHA1: 46250ec773b4b9a6d99f8f93455f1b5f3ef591fa SHA256: 92552ad15838d6861e2768859ac2c9985e895012504bcf2f1968f8946dfd2429 SSDeep: 1536:YFOPbkyoTwtPto0Rl0DsN9/TCecZfmFA3prqdKYNPcs8QNlt3h3:YYPxAwtPtoe/TCxmm3prqcYSQNH3h3 |
|
|
Host Behavior
File (6)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open | STD_INPUT_HANDLE | - |
|
1 | |
| Open | STD_OUTPUT_HANDLE | - |
|
1 | |
| Open | STD_ERROR_HANDLE | - |
|
1 | |
| Copy | C:\Users\FD1HVy\AppData\Local\ph_exec.exe1.exe | source_filename = C:\Users\FD1HVy\Desktop\ph_exec.exe1.exe |
|
1 | |
| Copy | c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\ph_exec.exe1.exe | source_filename = C:\Users\FD1HVy\Desktop\ph_exec.exe1.exe |
|
1 | |
| Copy | c:\programdata\microsoft\windows\start menu\programs\startup\ph_exec.exe1.exe | source_filename = C:\Users\FD1HVy\Desktop\ph_exec.exe1.exe |
|
1 |
Registry (19)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
6 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
2 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 43388936, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 43389072, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
2 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 115, type = REG_NONE |
|
2 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 43389344, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 | |
| Write Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | value_name = ph_exec.exe1, data = C:\Users\FD1HVy\AppData\Local\ph_exec.exe1.exe, size = 92, type = REG_SZ |
|
1 |
Module (13)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x75e90000 |
|
3 | |
| Get Filename | - | process_name = c:\users\fd1hvy\desktop\ph_exec.exe1.exe, file_name_orig = C:\Users\FD1HVy\Desktop\ph_exec.exe1.exe, size = 260 |
|
6 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x75ea4ae0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x75ea4b20 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x75ea4b40 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x75ea4b00 |
|
1 |
System (26)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Computer Name | result_out = NQDPDE |
|
1 | |
| Sleep | duration = 1000 milliseconds (1.000 seconds) |
|
22 | |
| Sleep | duration = -1 (infinite) |
|
1 | |
| Get Time | type = Ticks, time = 127390 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Mutex (26)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\0001B419773000 |
|
1 | |
| Open | mutex_name = Global\0001B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773001, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\0001B419773001, desired_access = SYNCHRONIZE |
|
11 | |
| Open | mutex_name = Global\0001B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773001, desired_access = SYNCHRONIZE |
|
9 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #3: cmd.exe
186
0
| Information | Value |
|---|---|
| ID | #3 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | "C:\WINDOWS\system32\cmd.exe" |
| Initial Working Directory | C:\Users\FD1HVy\Desktop\ |
| Monitor | Start Time: 00:00:41, Reason: Child Process |
| Unmonitor | End Time: 00:01:07, Reason: Self Terminated |
| Monitor Duration | 00:00:26 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xf7c |
| Parent PID | 0xa9c (c:\users\fd1hvy\desktop\ph_exec.exe1.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
D94
0x
A6C
|
Host Behavior
File (133)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | C:\Users\FD1HVy\Desktop | type = file_attributes |
|
2 | |
| Get Info | STD_OUTPUT_HANDLE | type = file_type |
|
11 | |
| Get Info | STD_INPUT_HANDLE | type = file_type |
|
3 | |
| Get Info | STD_ERROR_HANDLE | type = file_type |
|
1 | |
| Open | STD_OUTPUT_HANDLE | - |
|
25 | |
| Open | STD_INPUT_HANDLE | - |
|
44 | |
| Open | STD_ERROR_HANDLE | - |
|
2 | |
| Read | STD_INPUT_HANDLE | size = 1, size_out = 1 |
|
36 | |
| Write | STD_OUTPUT_HANDLE | size = 38 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 2 |
|
3 | |
| Write | STD_OUTPUT_HANDLE | size = 52 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 24 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 36 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 2 |
|
1 | |
| Write | STD_ERROR_HANDLE | size = 51 |
|
1 |
Registry (17)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 4, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data = 9, type = REG_NONE |
|
1 |
Process (2)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\WINDOWS\system32\vssadmin.exe | os_pid = 0x39c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Get Info | C:\WINDOWS\system32\vssadmin.exe | type = PROCESS_BASIC_INFORMATION |
|
1 |
Memory (1)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Read | C:\WINDOWS\system32\vssadmin.exe | address = 970391863296, size = 1952 |
|
1 |
Module (10)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | NTDLL.DLL | base_address = 0x7ff931f40000 |
|
1 | |
| Get Handle | c:\windows\system32\cmd.exe | base_address = 0x7ff7b9ff0000 |
|
1 | |
| Get Handle | c:\windows\system32\kernel32.dll | base_address = 0x7ff92fdd0000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address_out = 0x7ff92fdea990 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = CopyFileExW, address_out = 0x7ff92fdee830 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address_out = 0x7ff92fdee300 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address_out = 0x7ff92f1b0a40 |
|
1 | |
| Get Address | c:\windows\system32\ntdll.dll | function = NtQueryInformationProcess, address_out = 0x7ff931fe56b0 |
|
1 |
System (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Info | type = Operating System |
|
1 |
Environment (20)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
7 | |
| Get Environment String | name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps |
|
2 | |
| Get Environment String | name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC |
|
2 | |
| Get Environment String | name = PROMPT |
|
1 | |
| Get Environment String | name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe |
|
1 | |
| Get Environment String | name = KEYS |
|
1 | |
| Get Environment String | name = PROMPT, result_out = $P$G |
|
1 | |
| Set Environment String | name = PROMPT, value = $P$G |
|
1 | |
| Set Environment String | name = =C:, value = C:\Users\FD1HVy\Desktop |
|
1 | |
| Set Environment String | name = COPYCMD |
|
1 | |
| Set Environment String | name = =ExitCode, value = 40010004 |
|
1 | |
| Set Environment String | name = =ExitCodeAscii |
|
1 |
Process #4: cmd.exe
208
0
| Information | Value |
|---|---|
| ID | #4 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | "C:\WINDOWS\system32\cmd.exe" |
| Initial Working Directory | C:\Users\FD1HVy\Desktop\ |
| Monitor | Start Time: 00:00:41, Reason: Child Process |
| Unmonitor | End Time: 00:01:07, Reason: Self Terminated |
| Monitor Duration | 00:00:26 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xe3c |
| Parent PID | 0xa9c (c:\users\fd1hvy\desktop\ph_exec.exe1.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
ED8
0x
324
|
Host Behavior
File (155)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | C:\Users\FD1HVy\Desktop | type = file_attributes |
|
2 | |
| Get Info | STD_OUTPUT_HANDLE | type = file_type |
|
11 | |
| Get Info | STD_INPUT_HANDLE | type = file_type |
|
3 | |
| Get Info | STD_ERROR_HANDLE | type = file_type |
|
1 | |
| Open | STD_OUTPUT_HANDLE | - |
|
25 | |
| Open | STD_INPUT_HANDLE | - |
|
55 | |
| Open | STD_ERROR_HANDLE | - |
|
2 | |
| Read | STD_INPUT_HANDLE | size = 1, size_out = 1 |
|
47 | |
| Write | STD_OUTPUT_HANDLE | size = 38 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 2 |
|
3 | |
| Write | STD_OUTPUT_HANDLE | size = 52 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 24 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 47 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 2 |
|
1 | |
| Write | STD_ERROR_HANDLE | size = 51 |
|
1 |
Registry (17)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 4, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data = 9, type = REG_NONE |
|
1 |
Process (2)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\WINDOWS\system32\netsh.exe | os_pid = 0xe5c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Get Info | C:\WINDOWS\system32\netsh.exe | type = PROCESS_BASIC_INFORMATION |
|
1 |
Memory (1)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Read | C:\WINDOWS\system32\netsh.exe | address = 244404350976, size = 1952 |
|
1 |
Module (10)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | NTDLL.DLL | base_address = 0x7ff931f40000 |
|
1 | |
| Get Handle | c:\windows\system32\cmd.exe | base_address = 0x7ff7b9ff0000 |
|
1 | |
| Get Handle | c:\windows\system32\kernel32.dll | base_address = 0x7ff92fdd0000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address_out = 0x7ff92fdea990 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = CopyFileExW, address_out = 0x7ff92fdee830 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address_out = 0x7ff92fdee300 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address_out = 0x7ff92f1b0a40 |
|
1 | |
| Get Address | c:\windows\system32\ntdll.dll | function = NtQueryInformationProcess, address_out = 0x7ff931fe56b0 |
|
1 |
System (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Info | type = Operating System |
|
1 |
Environment (20)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
7 | |
| Get Environment String | name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps |
|
2 | |
| Get Environment String | name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC |
|
2 | |
| Get Environment String | name = PROMPT |
|
1 | |
| Get Environment String | name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe |
|
1 | |
| Get Environment String | name = KEYS |
|
1 | |
| Get Environment String | name = PROMPT, result_out = $P$G |
|
1 | |
| Set Environment String | name = PROMPT, value = $P$G |
|
1 | |
| Set Environment String | name = =C:, value = C:\Users\FD1HVy\Desktop |
|
1 | |
| Set Environment String | name = COPYCMD |
|
1 | |
| Set Environment String | name = =ExitCode, value = 40010004 |
|
1 | |
| Set Environment String | name = =ExitCodeAscii |
|
1 |
Process #7: netsh.exe
30
0
| Information | Value |
|---|---|
| ID | #7 |
| File Name | c:\windows\system32\netsh.exe |
| Command Line | netsh advfirewall set currentprofile state off |
| Initial Working Directory | C:\Users\FD1HVy\Desktop\ |
| Monitor | Start Time: 00:00:50, Reason: Child Process |
| Unmonitor | End Time: 00:01:06, Reason: Self Terminated |
| Monitor Duration | 00:00:16 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xe5c |
| Parent PID | 0xe3c (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
D68
0x
EE0
0x
714
0x
8E8
|
Host Behavior
Registry (7)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Get Key Info | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 |
Module (15)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | api-ms-win-appmodel-runtime-l1-1-0.dll | base_address = 0x7ff92e3f0000 |
|
1 | |
| Load | IFMON.DLL | base_address = 0x7ff912430000 |
|
1 | |
| Load | RASMONTR.DLL | base_address = 0x7ff911a60000 |
|
1 | |
| Load | MSVCRT.DLL | base_address = 0x7ff931a40000 |
|
1 | |
| Load | C:\WINDOWS\system32\MFC42LOC.DLL | base_address = 0x0 |
|
1 | |
| Load | AUTHFWCFG.DLL | base_address = 0x7ff911730000 |
|
1 | |
| Load | DHCPCMONITOR.DLL | base_address = 0x7ff911720000 |
|
1 | |
| Load | DOT3CFG.DLL | - |
|
1 | |
| Get Handle | c:\windows\system32\netsh.exe | base_address = 0x7ff782f50000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\netsh.exe, file_name_orig = C:\WINDOWS\system32\MFC42u.dll, size = 260 |
|
1 | |
| Get Address | c:\windows\system32\ifmon.dll | function = InitHelperDll, address_out = 0x7ff912431310 |
|
1 | |
| Get Address | c:\windows\system32\rasmontr.dll | function = InitHelperDll, address_out = 0x7ff911a75850 |
|
1 | |
| Get Address | c:\windows\system32\authfwcfg.dll | function = InitHelperDll, address_out = 0x7ff911731430 |
|
1 | |
| Get Address | c:\windows\system32\dhcpcmonitor.dll | function = InitHelperDll, address_out = 0x7ff911721610 |
|
1 |
System (8)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Cursor | x_out = 453, y_out = 300 |
|
1 | |
| Get Info | type = Operating System |
|
6 | |
| Get Info | type = System Directory, result_out = C:\WINDOWS\system32 |
|
1 |
Process #8: vssadmin.exe
0
0
| Information | Value |
|---|---|
| ID | #8 |
| File Name | c:\windows\system32\vssadmin.exe |
| Command Line | vssadmin delete shadows /all /quiet |
| Initial Working Directory | C:\Users\FD1HVy\Desktop\ |
| Monitor | Start Time: 00:00:50, Reason: Child Process |
| Unmonitor | End Time: 00:01:06, Reason: Self Terminated |
| Monitor Duration | 00:00:16 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x39c |
| Parent PID | 0xf7c (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
344
0x
388
0x
1008
0x
100C
0x
1010
|
Process #9: ph_exec.exe1.exe
17896
0
| Information | Value |
|---|---|
| ID | #9 |
| File Name | c:\users\fd1hvy\appdata\local\ph_exec.exe1.exe |
| Command Line | "C:\Users\FD1HVy\AppData\Local\ph_exec.exe1.exe" |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:02:17, Reason: Autostart |
| Unmonitor | End Time: 00:03:03, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:45 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xe34 |
| Parent PID | 0x7f8 (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
E38
0x
E48
0x
E60
0x
E64
0x
E68
0x
E78
0x
E7C
0x
E80
0x
E84
0x
E88
0x
E8C
0x
F2C
0x
F30
0x
F34
0x
F38
0x
F3C
0x
F40
0x
F44
0x
F48
0x
F4C
0x
F50
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| ph_exec.exe1.exe | 0x00C40000 | 0x00C54FFF | Relevant Image | - | 32-bit | - |
|
|
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| \\?\C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.31 KB |
MD5:
407c5e5cc36f432acd0b76535afeb3ce
SHA1: f3071d1cf8e18f32e9b7edb3babdf8dd40bd0369 SHA256: f1f61f1833a2b45e9f7aed7d1e10032a925bc4d7c5cf77a1353a7041d3802bd5 SSDeep: 1536:+n+afTHZXYaL4L29KSl3uLrCsy/QhqxpI15ZFx63dbX6tMiFxI21pF:ZaRYaL/fB14Uxm1v63db27v1j |
|
|
| \\?\C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.00 MB |
MD5:
49dcb15e6d05133b6604e2090b70dab4
SHA1: f6864434151039d3ce27a0f3e89c5a26979c72a0 SHA256: e8196b0a450b9771bf79f56551aba9c4789b3767d45f938c5376420bc2e759da SSDeep: 24576:AuqcKcETmx1F7fRLkUar5Gxz3ytB2a8ERT2CeRG3ps69Hw7:RKcNrFjRwy35qTTeR4VQ7 |
|
|
| \\?\C:\Logs\Security.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.07 MB |
MD5:
87e88456c6f35bf27012284ed72d4c6c
SHA1: 77d2f450d7fbb95dd21c7c13b330e1009270825e SHA256: 51f2c05756da4d098ada598d6976af8c4637659ff6bc7d8dc1b3633b2ed8bf75 SSDeep: 24576:LrbFVjv2qtGQ8q3ECafGSs/UX52pWrDIjEqihv3Th6OYZk7KogcbxfZM+:Lrb/2Ob3eGSs/4+WHlqidl6OYybXp |
|
|
| \\?\C:\Logs\Setup.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.25 KB |
MD5:
5b1994ddf521dcc8ff1d1569df053aba
SHA1: 9c4816c0f5bf2fd2361e1b83cacac70069bd56c5 SHA256: 2fbcfe48849ed301ecbe2358b61facb5835896d7a0834d1b358fb3311fda0671 SSDeep: 1536:R1Ejf3/65hAv+f9+dJ5a34xLP4n9em3DQzdtMiWPq+Q3DGMutFHmJiTG7UCL++o:QjP/mh8+f+aIxkmdtMLq+P6J1HL+3 |
|
|
| \\?\C:\Logs\Windows PowerShell.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 68.27 KB |
MD5:
093328b9d45b7845a43a05c8bb071956
SHA1: b111b732de8214e6b39259fe0502242081e1aef7 SHA256: 23dd006d443d9e4d6770830bca229c0cd22210a533380d29db420d5d310116a2 SSDeep: 1536:DHooQk/XoyZspbMJLm2lHKooA9WfytMvwy1uZ:DHooQk/4+suU2RKrmWfytOy |
|
|
| \\?\C:\Logs\System.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 1.07 MB |
MD5:
83727b9f64f3235bc5cc4525806a2c8c
SHA1: 6fab6e0048524ff7f6d036d48e4ae968dcc0b657 SHA256: 1c5d409f331ad1c0547573d109f071e31a2fa049512dbd3f5d5cb1157bcf8a29 SSDeep: 24576:pu2A4+ZLgekpwRF3pw3pgWOjOZQGI+LoSRvaCLfNN:i42XNb63oj+I+BR/v |
|
|
Host Behavior
File (2166)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | \\?\C:\$WINRE_BACKUP_PARTITION.MARKER | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG1 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG2 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bg-BG\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bg-BG\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\bootspaces.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bootvhd.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bootspaces.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\bootvhd.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\da-DK\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\da-DK\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\de-DE\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\el-GR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\el-GR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\de-DE\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-GB\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-GB\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-ES\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-ES\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-MX\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-MX\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\et-EE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\et-EE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\chs_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\cht_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\jpn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\kor_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgunn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgunn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgun_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryon_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryon_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryo_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgun_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjhn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryo_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjh_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjhn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyhn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyhn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyh_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyh_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segmono_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segmono_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoen_slboot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoen_slboot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoe_slboot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoe_slboot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-CA\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-CA\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hr-HR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hr-HR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\it-IT\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\it-IT\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjh_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\lt-LT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\lt-LT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\lv-LV\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\lv-LV\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\memtest.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\memtest.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Resources\bootres.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Resources\bootres.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Resources\en-US\bootres.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Resources\en-US\bootres.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ro-RO\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ro-RO\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sk-SK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sk-SK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sl-SI\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sl-SI\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-RS\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-RS\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\uk-UA\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\uk-UA\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\bootmgr | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\updaterevokesipolicy.p7b | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\updaterevokesipolicy.p7b | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Content.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Content.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\bootmgr | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\hiberfil.sys | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Security.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Security.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Security.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adojavas.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adojavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Setup.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Setup.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Setup.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\System.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\System.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\System.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Windows PowerShell.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Windows PowerShell.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Windows PowerShell.evtx.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\pagefile.sys | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00448_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uiwin32client.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01178_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01178_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00074_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00074_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00076_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00076_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00077_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00077_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00086_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00086_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00090_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00090_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00096_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00096_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00296_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00296_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00297_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00297_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00306_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00306_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00336_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00336_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00361_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00361_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00369_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00369_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00382_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00382_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00403_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00403_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00414_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00414_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00419_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00419_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00428_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00428_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00435_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00435_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00438_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00438_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00455_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00455_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00459_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00459_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00543_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00543_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00544_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00544_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00564_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00564_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00586_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00586_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00775_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00775_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00779_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00779_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00799_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00799_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00814_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00814_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00965_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00965_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01074_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01074_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01084_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01084_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01176_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01176_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01191_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01191_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01193_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01193_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01196_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01196_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01548_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\FlickLearningWizard.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\FlickLearningWizard.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01657_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IPSEventLogMsg.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01657_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01658_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IPSEventLogMsg.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\micaut.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mip.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mip.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mraut.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01658_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01659_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01548_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01659_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01660_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01660_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02068_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02068_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02071_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02071_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02075_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02075_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02088_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02088_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02097_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02097_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02115_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02115_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02116_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02116_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02141_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02141_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02153_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02153_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02158_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02158_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02161_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02161_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FLAP.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FLAP.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00057_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00057_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00084_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00084_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00231_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00231_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00235_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00235_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00236_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00236_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00241_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00241_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00260_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00260_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00276_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00334_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00334_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00443_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00443_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00513_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00513_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00524_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00524_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00526_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00526_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00527_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00527_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00546_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00546_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00601_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00601_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00602_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00602_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00612_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00612_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00623_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00623_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00625_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00625_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00636_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00636_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00669_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00669_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00681_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00681_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00685_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00685_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00687_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00687_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00688_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00688_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00693_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00693_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01013_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01013_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01015_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01015_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01058_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01058_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01065_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01065_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01080_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01080_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01242_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01242_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01291_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01291_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01329_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01329_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01461_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01461_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01618_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01618_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01759_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01759_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01875_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01875_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01923_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01923_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02155_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00276_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02166_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Copy | c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\ph_exec.exe1.exe | source_filename = C:\Users\FD1HVy\AppData\Local\ph_exec.exe1.exe |
|
1 | |
| Copy | c:\programdata\microsoft\windows\start menu\programs\startup\ph_exec.exe1.exe | source_filename = C:\Users\FD1HVy\AppData\Local\ph_exec.exe1.exe |
|
1 | |
|
For performance reasons, the remaining 1166 entries are omitted.
The remaining entries can be found in glog.xml. |
|||||
Registry (16)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
6 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
2 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 37360312, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 37360376, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
2 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 115, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 37360648, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 0, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 |
Process (1)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Users\FD1HVy\AppData\Local\ph_exec.exe1.exe | show_window = SW_SHOWNORMAL |
|
1 |
Module (36)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x75bf0000 |
|
15 | |
| Get Filename | - | process_name = c:\users\fd1hvy\appdata\local\ph_exec.exe1.exe, file_name_orig = C:\Users\FD1HVy\AppData\Local\ph_exec.exe1.exe, size = 260 |
|
7 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x75c04ae0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x75c04b20 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x75c04b40 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x75c04b00 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Wow64DisableWow64FsRedirection, address_out = 0x75c06b30 |
|
5 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Wow64RevertWow64FsRedirection, address_out = 0x75c06b50 |
|
5 |
System (49)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Computer Name | result_out = NQDPDE |
|
1 | |
| Sleep | duration = 5000 milliseconds (5.000 seconds) |
|
1 | |
| Sleep | duration = 1000 milliseconds (1.000 seconds) |
|
44 | |
| Sleep | duration = -1 (infinite) |
|
1 | |
| Get Time | type = Ticks, time = 67718 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Mutex (73)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\0001B419773001 |
|
1 | |
| Create | mutex_name = Global\0001B419773000 |
|
1 | |
| Create | mutex_name = Global\0001B419773001 |
|
1 | |
| Create | mutex_name = Global\0001B419773001 |
|
1 | |
| Create | mutex_name = Global\0001B419773001 |
|
1 | |
| Create | mutex_name = Global\0001B419773001 |
|
1 | |
| Create | mutex_name = Global\0001B419773001 |
|
3 | |
| Create | mutex_name = Global\0001B419773001 |
|
1 | |
| Create | mutex_name = Global\0001B419773001 |
|
1 | |
| Create | mutex_name = Global\0001B419773001 |
|
2 | |
| Create | mutex_name = Global\0001B419773001 |
|
2 | |
| Create | mutex_name = Global\0001B419773001 |
|
1 | |
| Create | mutex_name = Global\0001B419773001 |
|
1 | |
| Open | mutex_name = Global\0001B419773001, desired_access = SYNCHRONIZE |
|
16 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773001, desired_access = SYNCHRONIZE |
|
14 | |
| Open | mutex_name = Global\0001B419773001, desired_access = SYNCHRONIZE |
|
8 | |
| Release | mutex_name = Global\0001B419773001 |
|
1 | |
| Release | mutex_name = Global\0001B419773001 |
|
1 | |
| Release | mutex_name = Global\0001B419773001 |
|
1 | |
| Release | mutex_name = Global\0001B419773001 |
|
1 | |
| Release | mutex_name = Global\0001B419773001 |
|
1 | |
| Release | mutex_name = Global\0001B419773001 |
|
3 | |
| Release | mutex_name = Global\0001B419773001 |
|
1 | |
| Release | mutex_name = Global\0001B419773001 |
|
1 | |
| Release | mutex_name = Global\0001B419773001 |
|
2 | |
| Release | mutex_name = Global\0001B419773001 |
|
2 | |
| Release | mutex_name = Global\0001B419773001 |
|
1 | |
| Release | mutex_name = Global\0001B419773001 |
|
1 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #10: ph_exec.exe1.exe
20
0
| Information | Value |
|---|---|
| ID | #10 |
| File Name | c:\programdata\microsoft\windows\start menu\programs\startup\ph_exec.exe1.exe |
| Command Line | "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ph_exec.exe1.exe" |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:02:18, Reason: Autostart |
| Unmonitor | End Time: 00:02:23, Reason: Self Terminated |
| Monitor Duration | 00:00:04 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xe40 |
| Parent PID | 0x7f8 (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
E44
0x
E4C
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| ph_exec.exe1.exe | 0x01280000 | 0x01294FFF | Relevant Image | - | 32-bit | - |
|
|
|
| ph_exec.exe1.exe | 0x01280000 | 0x01294FFF | Process Termination | - | 32-bit | - |
|
|
|
Host Behavior
File (3)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open | STD_INPUT_HANDLE | - |
|
1 | |
| Open | STD_OUTPUT_HANDLE | - |
|
1 | |
| Open | STD_ERROR_HANDLE | - |
|
1 |
Module (8)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x75bf0000 |
|
2 | |
| Get Handle | mscoree.dll | base_address = 0x0 |
|
1 | |
| Get Filename | - | process_name = c:\programdata\microsoft\windows\start menu\programs\startup\ph_exec.exe1.exe, file_name_orig = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ph_exec.exe1.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x75c04ae0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x75c04b20 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x75c04b40 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x75c04b00 |
|
1 |
System (2)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = Ticks, time = 67921 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Mutex (4)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\0001B419773001 |
|
1 | |
| Open | mutex_name = Global\0001B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Release | mutex_name = Global\0001B419773001 |
|
1 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #11: ph_exec.exe1.exe
20
0
| Information | Value |
|---|---|
| ID | #11 |
| File Name | c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\ph_exec.exe1.exe |
| Command Line | "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ph_exec.exe1.exe" |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:02:20, Reason: Autostart |
| Unmonitor | End Time: 00:02:23, Reason: Self Terminated |
| Monitor Duration | 00:00:03 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xe50 |
| Parent PID | 0x7f8 (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
E54
0x
E5C
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| ph_exec.exe1.exe | 0x00B60000 | 0x00B74FFF | Relevant Image | - | 32-bit | - |
|
|
|
| ph_exec.exe1.exe | 0x00B60000 | 0x00B74FFF | Process Termination | - | 32-bit | - |
|
|
|
Host Behavior
File (3)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open | STD_INPUT_HANDLE | - |
|
1 | |
| Open | STD_OUTPUT_HANDLE | - |
|
1 | |
| Open | STD_ERROR_HANDLE | - |
|
1 |
Module (8)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x75bf0000 |
|
2 | |
| Get Handle | mscoree.dll | base_address = 0x0 |
|
1 | |
| Get Filename | - | process_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\ph_exec.exe1.exe, file_name_orig = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ph_exec.exe1.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x75c04ae0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x75c04b20 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x75c04b40 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x75c04b00 |
|
1 |
System (2)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = Ticks, time = 68296 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Mutex (4)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\0001B419773001 |
|
1 | |
| Open | mutex_name = Global\0001B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Release | mutex_name = Global\0001B419773001 |
|
1 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #13: ph_exec.exe1.exe
5141
0
| Information | Value |
|---|---|
| ID | #13 |
| File Name | c:\users\fd1hvy\appdata\local\ph_exec.exe1.exe |
| Command Line | "C:\Users\FD1HVy\AppData\Local\ph_exec.exe1.exe" |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:02:34, Reason: Child Process |
| Unmonitor | End Time: 00:03:03, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:28 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xf9c |
| Parent PID | 0xe34 (c:\users\fd1hvy\appdata\local\ph_exec.exe1.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
FA0
0x
FA4
0x
FA8
0x
FAC
0x
FB0
0x
D50
0x
654
0x
65C
0x
660
0x
648
0x
63C
0x
640
0x
468
0x
474
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| ph_exec.exe1.exe | 0x00C40000 | 0x00C54FFF | Relevant Image | - | 32-bit | - |
|
|
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 15.86 KB |
MD5:
2efe893fcbb32794f2739445a1283b10
SHA1: 7eb93b6b4c22636f96ae4175339f44c3419947d4 SHA256: 53adfa187a23ac32a2a11aabec5f3689cc8e442a33eaa890a3749b23681cb82d SSDeep: 384:FwLOOkVF6IPmgiSOogOV0XTNswYEyeIA/qDDAdE:BOymgoO0zOx3YE |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.47 KB |
MD5:
0cf35d69cae651cd1cc0e0996ba5207a
SHA1: 3cbaa74350195bf0c5cba3a4435532e6608112e0 SHA256: 179da740281def1b0d07f3f614b6761e8f61246ca8268bf2b9d15f7cb095086c SSDeep: 384:4G6Gr/kZ2Jf5YJiBEKhkdhKBdhgc616FbxKuYjbW0m84QJrJnR4puxsIp:4G6UkwN59EnPWs6FbIuObW0m84QJtn1x |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.47 KB |
MD5:
6fc7e758c61dbe607500308d3747cce4
SHA1: 91a35a4b98b6d7d57e20cd7b980436af58226a1a SHA256: 461cf91f66f2395aeed3700c38e8ed7242647a90483a9020b487fdd62477bceb SSDeep: 384:WRWzTsjRXzVXHFhxX+ARbSCYjeY4Nshs5jSBc0Bh1X7Sp:WUzTyRj5wVCYjvsgZ9Wp |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 20.99 KB |
MD5:
49e2c923c22d9bedc9b8c93c094e4170
SHA1: 16cb3c41662f696f2adeb17f24cdb870fff5b31e SHA256: 6f3b2d5e2d4ce7f4be164a2db40f0c04470025a6af67e94e47976d52c9a647a6 SSDeep: 384:yRg6aKxXtCxPYQOuNrpsYTaMC8XvTI+CIk+Pn56JNU+vo3Yq/Lso5:KkKFaYQOWP3CIHfMvvoR/H5 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 19.00 KB |
MD5:
efcb12148d09ba6221b4aef455d6939d
SHA1: 20ab40ab7e6af71a14614e861a9b5de6b068c570 SHA256: 2f884256b41dce74d41f90a644cb82e7f733e1d68b96c81106a1057fba01a1ef SSDeep: 384:A5gGQ2JG+kv56XkuIwweRQ/bF/TN+F8Z/I5V9UFPHXDdAsNJ:87C5GITeoxTN+F4Ahw/mQJ |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.99 KB |
MD5:
8ffa0a1084584cd4ed405166fe8961d2
SHA1: 5ae6490baaf08221fe0dcb6c5b23c639709794d8 SHA256: 8fef9b59a17a613d44a98168dd1c2c8711c699daec6c6e27816e31082c62bc7c SSDeep: 384:mxD7dTL5P8BJ8VjfoLy5PatrMm2OzFMSD0hh8MsbjbkDXbRurCdZPk5:ABJa8V8Ly5POrX04Zb0Dpk5 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.49 KB |
MD5:
191898369a47412d05cbf6aa2f86a3a6
SHA1: a49a1ce9648c3193023a05ead25d5ac2fad2b3ef SHA256: f8888bd727093448627e0bc7265ef41023bd38de1a1d43efef0a5df4f63d100f SSDeep: 384:MJA+WVPKZKQEVibyLcxiyH7kXz7Cm58Nmqk//loeDY2Hyv5:WOhVfyiUoj7CmONmJ//hDYIA5 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 19.47 KB |
MD5:
7ccfc5e25c5fb447a7f7eac049c88747
SHA1: afbc384b387337e3a98fbd13846ac7492e36b156 SHA256: 1631bea41fc64c52af4d79245d65da991065f44eddc1feb695a3d37fea3b2abf SSDeep: 384:AWNy+nslcqgcnQFE1iv5zNqfGPhHNVauOuWhKTGL2X1EYMQWoPrM9X64SClajyp:PM+ns+qgITEhnhHrW2XCYMlgMVZHwyp |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 11.64 KB |
MD5:
1625774bf21994b4d71fb001c0cba8eb
SHA1: 49f1dd5fc49e213299f7209025d867fdbc1fa16e SHA256: 43b71be148ea99c396eb8456b2958cbb0ae4c8b04648b6ea5180e475db4e2122 SSDeep: 192:aarXrg5uklNlNh8KWdzOLF4Rz/DJaRuiFpYNFu2OLWWgH8NyZCyVjP0RSxaU5:aGXkL8KiOLF4RnJsu8pnZLWWjNyEylMs |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 22.49 KB |
MD5:
a2e53878dcbaa3f0e827f82bea48e141
SHA1: bc0225386830579e3ad037c5b56caa69dcf995aa SHA256: 5161aa581bdb5404aea4b852e1a07c04cc4a1cfbc01d5c758336a40c5b3e7ae2 SSDeep: 384:e9r++JN7q7xsva3reVCtpNZ9svdH06KcVXTTH+xY1YhV0S1ubQ0/EbkxmBCXg5:eV95v8CCtpNQlU6KcVjr1YhV0S0bx/Ef |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.99 KB |
MD5:
56a986423b9e68a270ef0de81c63f9eb
SHA1: 21c8ccbcacf6fadedf813a752fc71e9f97164b13 SHA256: a5654b7553d3ecbdb352970864dad96d5f27bf93c7bec54a2e240190e3bf7c2e SSDeep: 384:lKrCulAfXjSFX4iQusoU/QbMUdj99kVLLdNnHt/8SVhcI6HsbKWEdOYLV7Q5:lKrPlAfzKQtoYQAURLgLnt/7bVisbhYI |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 19.47 KB |
MD5:
ffc195101a72cd83ca574344154cb91f
SHA1: 933fe76474387075282d3f637449117087eae7a5 SHA256: deab9229022c07b978ad2cb0ae0c9b67223984300c80ce23a229b414a46a8e5e SSDeep: 384:nLJNWL+UcmEmmihLIEoOQniBPXTT/HOGe4rnJxt5CY9w0KtJXv4aFXp:LJoL+GzfhLDBPDruGZtQY9wvJvh5p |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 20.49 KB |
MD5:
338c4e2779ccd8321e77805b91354f46
SHA1: 0995d1dbae7a1b429084d47247e119f8dafe0b40 SHA256: d931d5921a052b823192ce5c537af52eb52cf9ee87f3bf31b8da4330aef68359 SSDeep: 384:lnOwfT/pk21M/wIrScQ81KkkKlEbe2ur4fRFknsRIB3OGej5xNZfuRBA5:dZg/wwQ8Uk3mC2ur4p78ze1zZfn5 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 27.47 KB |
MD5:
d04a954901e484b1bac99cbc2e9c64d9
SHA1: beae098564f85a98c690939b7c8b8adf6c9eb641 SHA256: f43cc34e26efb6596688f661c2740c57cdd30298edd2479e8c8339d3c013daa9 SSDeep: 768:/OzWzCxCGzCB+wyeYlS0/C79X3+VJDVlp:/OKexLw5YltS9X3+zDR |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 26.49 KB |
MD5:
c7189f828ee4725dd456233d12a4845e
SHA1: bf956c2061b12449ea243d5997e52c00c14e3d10 SHA256: d1b9b135cc334737ba69a5d9c01ad18e7ba7b1f5557ce187c1b1a569fc6de0d8 SSDeep: 768:HgN7QKCXUSpQwMumABWnxGzsiETCgZjO48Dim95:HgNolpQwMumITDppP |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 20.55 KB |
MD5:
70f37e4b5d1c77ba688c7ee11a53e0b7
SHA1: 24bc9643c5a56d744fb15e0691250ca8ef6fb398 SHA256: bdf5dd4be75fec925ea6311d750895f86ce66432a9155729a47a8ada555ba595 SSDeep: 384:Ys8REXFlutbkDBcfPYmEExmqPTSz8c+8Vq3h01RQlw9WNx82rQ1Btd4RUtWYqb9H:RIEXMb0BcpxRLetKh02KWI2g4Knqb9Gm |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 10.00 KB |
MD5:
7565eb0857d16d89d60b893a8714d0f7
SHA1: d0df2b54c4e81a30bb288d565b87747e71e36f10 SHA256: 544b34a6c09d13438f3a861e9f36af507875de959229d8eb67edad2afebc67a3 SSDeep: 192:OVek6eN2Gdn3EkNLlCBkkrRdQ8QTh++iEzbE73fsT2WiqYFmXulGm:OUHPSOkkrR2DXi8E73fSYFjGm |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 24.25 KB |
MD5:
77297990483e2e6841c8c81c30d28274
SHA1: 250e8ebbda69a5ba13660cceae55f717cb4ecb5a SHA256: 191d5c350277f03d695c4082b7094336b8eaadad45017026ee49599697713a3b SSDeep: 768:0D5ho+TINsQDNu8F9kiZ5h3CZkWJEpvGm:Shrsnxug5iJEpf |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 18.99 KB |
MD5:
56b67abc11f7ba3bc8a562a24e743d4c
SHA1: 450a3747393e3b2049e1f2140cd7294e44bc7c6d SHA256: fb7a95ac7252b3a89981f73c0f8da2dde491606e6ceb45d629ed3528c24b99e9 SSDeep: 384:PQ5Xstg5wastMdM+qiEBkSD9IJPWtXij2+2N4BFpIOSbi4Pg5:4qOX0MddqMSDGJPIXiaNGTIOh4Pg5 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 2.42 KB |
MD5:
b104c7122255762ef17f55c6df16eec2
SHA1: 7524c5a1ab321be462d52bed9a0ba9703c7747f9 SHA256: 1b2d436f41f4ed18132f3e9258cc72756285d8860ec9170dfa2bdc8c9ed002dc SSDeep: 48:yqVeVs+GEtfYRF7UTD2yNmF/nK3oSA0Vvf2uq4PbiTnEkrCM2capKeo7:Ms+GEt+F7mDR37rVX2uUTSMnGKr7 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 14.72 KB |
MD5:
0630c4d99baabef245b87f3f7b8ec139
SHA1: bc493e0933a049caa78fe67b1f7bee6b7f84009f SHA256: 5b3f71d09eb658f6de45e45703e10b495224a2ff832a41883df72b3f43e84934 SSDeep: 384:H3K6WmUGwXdJsDexjMf2OcWKBLM2XiJKGm:H6ftX5x4cWKBLqJKGm |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 69.49 KB |
MD5:
558e7f7de6909bc325240aceac7a84f2
SHA1: a36f9dc8ee421bb0b454962b00aa69705b8272e1 SHA256: b294932acd629e2b05b42d6a0d40d9dbd836a551fef348b4da4d63fec278b2b9 SSDeep: 1536:ZsZc9RMth8SUE/0G4Tbx7DpGs3wBS5XoQPCg6g8QKqJACWnbnZGdqa:ZsZcYhZKFDJwUmQBN8QKrCWnTZda |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 19.49 KB |
MD5:
90bd3bcaf6aff8820028eeedac321142
SHA1: a21e67c9f6102d5bbec26df83f679e8c2cf7900e SHA256: fa5bc1c9c97b1b093b7bdc6613859205bc8ab186626f4b899dcc9766b42ffd08 SSDeep: 384:GXrUilEzyocoKkW3+WDBlRDS1yDjlj9P6ljNMmVDvdC91acw0O2Tz5mm5:GXrUil8h4uWDBjS1yDjlj96ljNMy01Tp |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 24.47 KB |
MD5:
eac819ea274fe8361e512a26ef50c917
SHA1: 810883be95a815488ec5a2f8503020d3a8c1ca11 SHA256: 8cf934dfd77a272f8a3bbf3549298afd0f41bdd03ec84d2d87b323a1f5d9878a SSDeep: 768:/J/k5qwopNuLTBAN8MkWJOmM1i4hhTl4wp:YwpNkAxvOmM17Tl4S |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | 22.99 KB |
MD5:
bba284725d432decd5201e3921857c17
SHA1: 1d6a1d48de55064b3c2cbee4a04778c2a05bc977 SHA256: 9519e54a2fa8c73d70a41856d272248089f1b135bbebac171687f67d794535f2 SSDeep: 384:unrSil8SWra9VX6NX1nJsOxNYF6RHedCFZYA3VnJw0v57vvSX47QoFN5TxkBfNsd:unrSIF9VXmnJsOx0CeITlikNv6X477Dj |
|
|
Host Behavior
File (3110)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$WINRE_BACKUP_PARTITION.MARKER | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG1 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG2 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bg-BG\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bg-BG\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\bootspaces.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bootspaces.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\bootvhd.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bootvhd.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\da-DK\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\da-DK\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\de-DE\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\de-DE\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\el-GR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\el-GR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-GB\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-GB\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-ES\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-ES\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-MX\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-MX\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\et-EE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\et-EE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\chs_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\cht_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\jpn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\kor_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgunn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgunn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgun_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgun_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryon_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryon_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryo_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryo_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjhn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjhn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjh_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjh_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyhn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyhn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyh_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyh_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segmono_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segmono_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoen_slboot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoe_slboot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoe_slboot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-CA\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-CA\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hr-HR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hr-HR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\it-IT\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\it-IT\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\lt-LT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\lt-LT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\lv-LV\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\lv-LV\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\memtest.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\memtest.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Resources\bootres.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Resources\bootres.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Resources\en-US\bootres.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Resources\en-US\bootres.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ro-RO\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ro-RO\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sk-SK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sk-SK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sl-SI\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sl-SI\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-RS\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-RS\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\uk-UA\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\uk-UA\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\updaterevokesipolicy.p7b | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\updaterevokesipolicy.p7b | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Content.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Content.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoen_slboot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\bootmgr | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\bootmgr | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\hiberfil.sys | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\pagefile.sys | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adojavas.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adojavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00448_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01178_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01178_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01178_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uiwin32client.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uiwin32client.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\FlickLearningWizard.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\FlickLearningWizard.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IPSEventLogMsg.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IPSEventLogMsg.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\micaut.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mip.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mip.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mraut.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00074_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00074_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00074_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00076_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00076_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00076_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00077_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00077_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00077_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00086_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00086_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00086_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00090_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00090_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00090_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00096_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00096_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00096_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00296_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00296_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00296_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00297_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00297_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00297_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00306_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00306_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00306_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00336_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00336_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00336_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00361_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00361_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00361_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00369_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00369_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00369_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00382_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00382_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00382_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00403_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00403_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00403_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msader15.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msader15.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado15.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado15.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado20.tlb | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado20.tlb | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado21.tlb | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado21.tlb | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado25.tlb | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado25.tlb | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado26.tlb | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado26.tlb | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado27.tlb | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado27.tlb | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado28.tlb | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado28.tlb | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado60.tlb | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msado60.tlb | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msadomd.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msadomd.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msadomd28.tlb | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msadomd28.tlb | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msador15.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msador15.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msador28.tlb | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\msador28.tlb | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Copy | c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\ph_exec.exe1.exe | source_filename = C:\Users\FD1HVy\AppData\Local\ph_exec.exe1.exe |
|
1 | |
| Copy | c:\programdata\microsoft\windows\start menu\programs\startup\ph_exec.exe1.exe | source_filename = C:\Users\FD1HVy\AppData\Local\ph_exec.exe1.exe |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 16000 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 18640 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 18640 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 21200 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 19152 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 306 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 19152 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 18640 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 19664 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 11632 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 22736 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 19152 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 19664 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 20688 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 27856 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 26832 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 20800 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 24592 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 10000 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 19152 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 14832 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 70864 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 19664 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 24784 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 23248 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3648 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3696 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 24784 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 21200 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 19152 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2144 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3632 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 396976 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2784 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2800 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2976 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 786706 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2976 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3600 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 262144 |
|
3 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2304 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2096 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2304 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2096 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 512224 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2016 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2032 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2416 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 786722 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1808 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 262144 |
|
3 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1904 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01178_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3808 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01178_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 820432 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2064 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2032 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2096 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 263904 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1456 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3008 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2304 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 332976 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 8576 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1776 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 912 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 112 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 112 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 902336 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2528 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2336 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 592 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 19072 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 304 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1093264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 560 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4160 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 358624 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2304 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1392 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 13056 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2704 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 6960 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 13952 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 61040 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 786706 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 6944 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 12368 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 262144 |
|
3 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 996576 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 982736 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2288 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 6784 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 390336 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 17312 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7952 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 752 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00076_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 12000 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00076_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00074_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 17856 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00074_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 363744 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1114368 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 590528 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00077_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 30256 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00077_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00086_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 29216 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00086_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00090_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 14208 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00090_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 360800 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00296_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 15872 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00296_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00096_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 37392 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00096_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 244304 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 990048 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00306_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 46816 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00306_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00297_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 18208 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00297_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 18640 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 12464 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 855392 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00361_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4080 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00361_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00336_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 6080 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00336_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 100496 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00382_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 8432 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00382_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00369_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 8560 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00369_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 367232 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 20624 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 48880 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 17056 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 168080 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00403_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7888 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00403_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 10832 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00419_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 16400 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00419_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00414_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 11008 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00414_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 22688 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Internet Explorer\SIGNUP\install.ins.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 464 |
|
1 | |
| Write | \\?\C:\Program Files\Internet Explorer\SIGNUP\install.ins.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\bci.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 16976 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00435_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2112 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\awt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1114368 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00428_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4800 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00428_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\awt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 402256 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\awt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00435_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\bci.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dcpr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 159824 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dcpr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\decora_sse.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 86096 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\decora_sse.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00438_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5104 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00438_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00455_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 8928 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00455_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00459_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 17408 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00459_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\deployJava1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1026128 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\deployJava1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00543_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1488 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00543_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\deploy.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 587856 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\deploy.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00564_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 912 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00564_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00544_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00544_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npdeployJava1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1114368 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npdeployJava1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 42320 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npdeployJava1.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dt_socket.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 24656 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dt_socket.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\eula.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 136272 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\eula.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00775_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 11168 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00775_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00586_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 768 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00586_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dt_shmem.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 29776 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dt_shmem.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00799_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 13984 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00799_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00779_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 9024 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00779_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\fxplugins.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 274512 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\fxplugins.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
2 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00814_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 42720 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00814_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00965_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 15168 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00965_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01074_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4640 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01074_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01084_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2416 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01084_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01191_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3968 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01191_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01176_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4992 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01176_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01193_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1168 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01193_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\fxplugins.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 186960 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\glass.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 265808 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\glass.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01196_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2336 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01196_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01657_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 30416 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01657_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01548_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 10320 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01548_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01658_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 17936 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01658_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01659_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 31184 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01659_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02068_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2496 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02068_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02071_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2192 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02071_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01660_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 12960 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01660_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02075_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4400 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02075_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02088_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3712 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02088_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\gstreamer-lite.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 619600 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\gstreamer-lite.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02115_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4672 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02115_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\glib-lite.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 455760 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\glib-lite.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02097_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1568 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02097_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\instrument.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 123472 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\instrument.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\hprof.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 158288 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\hprof.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02116_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4000 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02116_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\j2pkcs11.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 63568 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\j2pkcs11.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02153_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5408 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02153_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\j2pcsc.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 19024 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\j2pcsc.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02141_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2640 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02141_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jaas_nt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 21072 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jaas_nt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jabswitch.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 34384 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jabswitch.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02158_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1664 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02158_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02161_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3136 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02161_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FLAP.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2080 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FLAP.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00084_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2480 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00057_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3776 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\java-rmi.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 15952 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\java.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 159824 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\java-rmi.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\java.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00057_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00084_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\JavaAccessBridge-64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 142416 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\JavaAccessBridge-64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00231_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00231_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00235_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1040 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00235_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00236_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3296 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00236_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javacpl.cpl.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 187408 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javacpl.cpl.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\java.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 206928 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\java.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javafx_font.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 80464 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javafx_font.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
2 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javafx_font.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 69200 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javafx_font_t2k.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 538192 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javafx_font_t2k.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00241_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1968 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00241_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javafx_iio.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 128080 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javafx_iio.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javaw.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 206928 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javaw.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00276_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3024 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00276_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00260_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3664 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00260_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00334_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1536 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00334_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\java_crw_demo.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 29776 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\java_crw_demo.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javaws.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 319568 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javaws.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jawt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 14416 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jawt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00513_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 832 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00513_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\JAWTAccessBridge-64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 15440 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\JAWTAccessBridge-64.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jfr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 26704 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jfr.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00524_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 14704 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00524_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jdwp.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 201808 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jdwp.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00526_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 13552 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00526_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jfxmedia.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 139856 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jfxmedia.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00443_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3312 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00527_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 5808 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jfxwebkit.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 786706 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jjs.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 15952 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jjs.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jfxwebkit.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 262144 |
|
3 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00527_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jli.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 174672 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jli.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00443_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jp2iexp.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 296016 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jp2iexp.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00546_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 3728 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00546_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00602_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1408 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00602_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00601_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1472 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00601_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jp2launcher.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 112208 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jp2launcher.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jp2ssv.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 235600 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jp2ssv.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jpeg.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 185936 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jpeg.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jp2native.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 20048 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jp2native.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jsdt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 18512 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jsdt.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00623_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 10656 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00623_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00612_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 12640 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00612_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jsound.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 35408 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jsound.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jsoundds.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 31312 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jsoundds.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\keytool.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 16464 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\keytool.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\kcms.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 220752 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\kcms.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00636_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1584 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00636_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00625_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2128 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00625_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\kinit.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 16464 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\kinit.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00681_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 9312 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00681_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\ktab.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 16464 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\ktab.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00685_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4048 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00685_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00687_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 4352 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00687_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\klist.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 16464 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\klist.exe.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00669_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 11504 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00669_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\management.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 36944 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\management.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\lcms.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 233552 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\lcms.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\msvcp120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 660144 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\msvcp120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\mlib_image.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 653904 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\mlib_image.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00693_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7104 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00693_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00688_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 7088 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00688_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\msvcr100.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 829280 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\msvcr100.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01013_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2864 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01013_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1152 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01015_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\msvcr120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 963248 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\msvcr120.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01058_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 2768 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01058_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\nio.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 60496 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\nio.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\net.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 96848 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\net.dll.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01065_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 1280 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01065_.WMF.id[B4197730-0001].[phobosrecovery@cock.li].phobos | size = 242 |
|
1 | |
|
For performance reasons, the remaining 2092 entries are omitted.
The remaining entries can be found in glog.xml. |
|||||
Registry (16)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
6 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
2 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 7278600, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 7278736, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
2 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 115, type = REG_NONE |
|
2 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 7279008, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 |
Process (2)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\WINDOWS\system32\cmd.exe | os_pid = 0xfb4, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE |
|
1 | |
| Create | C:\WINDOWS\system32\cmd.exe | os_pid = 0xfbc, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE |
|
1 |
Module (26)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x75bf0000 |
|
10 | |
| Get Filename | - | process_name = c:\users\fd1hvy\appdata\local\ph_exec.exe1.exe, file_name_orig = C:\Users\FD1HVy\AppData\Local\ph_exec.exe1.exe, size = 260 |
|
6 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x75c04ae0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x75c04b20 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x75c04b40 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x75c04b00 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Wow64DisableWow64FsRedirection, address_out = 0x75c06b30 |
|
6 |
System (44)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Sleep | duration = 1000 milliseconds (1.000 seconds) |
|
42 | |
| Get Time | type = Ticks, time = 82093 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Mutex (27)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\0001B419773001 |
|
1 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
4 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
3 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
11 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\0001B419773000, desired_access = SYNCHRONIZE |
|
1 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #14: cmd.exe
247
0
| Information | Value |
|---|---|
| ID | #14 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | "C:\WINDOWS\system32\cmd.exe" |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:02:36, Reason: Child Process |
| Unmonitor | End Time: 00:03:03, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:26 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xfb4 |
| Parent PID | 0xf9c (c:\users\fd1hvy\appdata\local\ph_exec.exe1.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
FB8
0x
FF8
|
Host Behavior
File (186)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | C:\WINDOWS\system32 | type = file_attributes |
|
1 | |
| Get Info | C:\Windows\System32 | type = file_attributes |
|
1 | |
| Get Info | STD_OUTPUT_HANDLE | type = file_type |
|
11 | |
| Get Info | STD_INPUT_HANDLE | type = file_type |
|
5 | |
| Open | STD_OUTPUT_HANDLE | - |
|
28 | |
| Open | STD_INPUT_HANDLE | - |
|
71 | |
| Read | STD_INPUT_HANDLE | size = 1, size_out = 1 |
|
59 | |
| Write | STD_OUTPUT_HANDLE | size = 38 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 2 |
|
4 | |
| Write | STD_OUTPUT_HANDLE | size = 52 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 20 |
|
2 | |
| Write | STD_OUTPUT_HANDLE | size = 36 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 23 |
|
1 |
Registry (17)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 4, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data = 9, type = REG_NONE |
|
1 |
Process (4)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\WINDOWS\system32\vssadmin.exe | os_pid = 0xc10, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Create | C:\WINDOWS\System32\Wbem\WMIC.exe | os_pid = 0x388, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Get Info | C:\WINDOWS\system32\vssadmin.exe | type = PROCESS_BASIC_INFORMATION |
|
1 | |
| Get Info | C:\WINDOWS\System32\Wbem\WMIC.exe | type = PROCESS_BASIC_INFORMATION |
|
1 |
Memory (2)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Read | C:\WINDOWS\system32\vssadmin.exe | address = 1083204755456, size = 1952 |
|
1 | |
| Read | C:\WINDOWS\System32\Wbem\WMIC.exe | address = 471787446272, size = 1952 |
|
1 |
Module (10)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | NTDLL.DLL | base_address = 0x7ffe8a6d0000 |
|
1 | |
| Get Handle | c:\windows\system32\cmd.exe | base_address = 0x7ff6e12e0000 |
|
1 | |
| Get Handle | c:\windows\system32\kernel32.dll | base_address = 0x7ffe882b0000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address_out = 0x7ffe882ca990 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = CopyFileExW, address_out = 0x7ffe882ce830 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address_out = 0x7ffe882ce300 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address_out = 0x7ffe87520a40 |
|
1 | |
| Get Address | c:\windows\system32\ntdll.dll | function = NtQueryInformationProcess, address_out = 0x7ffe8a7756b0 |
|
1 |
System (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Info | type = Operating System |
|
1 |
Environment (25)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
8 | |
| Get Environment String | name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps |
|
3 | |
| Get Environment String | name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC |
|
3 | |
| Get Environment String | name = PROMPT |
|
1 | |
| Get Environment String | name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe |
|
1 | |
| Get Environment String | name = KEYS |
|
1 | |
| Get Environment String | name = PROMPT, result_out = $P$G |
|
2 | |
| Set Environment String | name = PROMPT, value = $P$G |
|
1 | |
| Set Environment String | name = =C:, value = C:\Windows\System32 |
|
1 | |
| Set Environment String | name = COPYCMD |
|
2 | |
| Set Environment String | name = =ExitCode, value = 00000002 |
|
1 | |
| Set Environment String | name = =ExitCodeAscii |
|
1 |
Process #15: cmd.exe
189
0
| Information | Value |
|---|---|
| ID | #15 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | "C:\WINDOWS\system32\cmd.exe" |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:02:36, Reason: Child Process |
| Unmonitor | End Time: 00:03:03, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:26 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xfbc |
| Parent PID | 0xf9c (c:\users\fd1hvy\appdata\local\ph_exec.exe1.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
FC0
0x
FF4
|
Host Behavior
File (140)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | C:\WINDOWS\system32 | type = file_attributes |
|
1 | |
| Get Info | C:\Windows\System32 | type = file_attributes |
|
1 | |
| Get Info | STD_OUTPUT_HANDLE | type = file_type |
|
8 | |
| Get Info | STD_INPUT_HANDLE | type = file_type |
|
3 | |
| Open | STD_OUTPUT_HANDLE | - |
|
19 | |
| Open | STD_INPUT_HANDLE | - |
|
54 | |
| Read | STD_INPUT_HANDLE | size = 1, size_out = 1 |
|
47 | |
| Write | STD_OUTPUT_HANDLE | size = 38 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 2 |
|
3 | |
| Write | STD_OUTPUT_HANDLE | size = 52 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 20 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 47 |
|
1 |
Registry (17)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 4, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data = 9, type = REG_NONE |
|
1 |
Process (2)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\WINDOWS\system32\netsh.exe | os_pid = 0xffc, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Get Info | C:\WINDOWS\system32\netsh.exe | type = PROCESS_BASIC_INFORMATION |
|
1 |
Memory (1)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Read | C:\WINDOWS\system32\netsh.exe | address = 560664264704, size = 1952 |
|
1 |
Module (10)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | NTDLL.DLL | base_address = 0x7ffe8a6d0000 |
|
1 | |
| Get Handle | c:\windows\system32\cmd.exe | base_address = 0x7ff6e12e0000 |
|
1 | |
| Get Handle | c:\windows\system32\kernel32.dll | base_address = 0x7ffe882b0000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address_out = 0x7ffe882ca990 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = CopyFileExW, address_out = 0x7ffe882ce830 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address_out = 0x7ffe882ce300 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address_out = 0x7ffe87520a40 |
|
1 | |
| Get Address | c:\windows\system32\ntdll.dll | function = NtQueryInformationProcess, address_out = 0x7ffe8a7756b0 |
|
1 |
System (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Info | type = Operating System |
|
1 |
Environment (16)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
5 | |
| Get Environment String | name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps |
|
2 | |
| Get Environment String | name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC |
|
2 | |
| Get Environment String | name = PROMPT |
|
1 | |
| Get Environment String | name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe |
|
1 | |
| Get Environment String | name = KEYS |
|
1 | |
| Get Environment String | name = PROMPT, result_out = $P$G |
|
1 | |
| Set Environment String | name = PROMPT, value = $P$G |
|
1 | |
| Set Environment String | name = =C:, value = C:\Windows\System32 |
|
1 | |
| Set Environment String | name = COPYCMD |
|
1 |
Process #18: netsh.exe
72
0
| Information | Value |
|---|---|
| ID | #18 |
| File Name | c:\windows\system32\netsh.exe |
| Command Line | netsh advfirewall set currentprofile state off |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:02:37, Reason: Child Process |
| Unmonitor | End Time: 00:03:03, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:25 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xffc |
| Parent PID | 0xfbc (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
2A0
0x
C0C
0x
450
|
Host Behavior
Registry (21)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Get Key Info | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 |
Module (43)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | api-ms-win-appmodel-runtime-l1-1-0.dll | base_address = 0x7ffe86bd0000 |
|
1 | |
| Load | IFMON.DLL | base_address = 0x7ffe7f710000 |
|
1 | |
| Load | RASMONTR.DLL | base_address = 0x7ffe7f600000 |
|
1 | |
| Load | MSVCRT.DLL | base_address = 0x7ffe88cd0000 |
|
1 | |
| Load | C:\WINDOWS\system32\MFC42LOC.DLL | base_address = 0x0 |
|
1 | |
| Load | AUTHFWCFG.DLL | base_address = 0x7ffe7d550000 |
|
1 | |
| Load | DHCPCMONITOR.DLL | base_address = 0x7ffe7f5f0000 |
|
1 | |
| Load | DOT3CFG.DLL | base_address = 0x7ffe7e070000 |
|
1 | |
| Load | FWCFG.DLL | base_address = 0x7ffe7dda0000 |
|
1 | |
| Load | HNETMON.DLL | base_address = 0x7ffe7e020000 |
|
1 | |
| Load | NETIOHLP.DLL | base_address = 0x7ffe7d480000 |
|
1 | |
| Load | NETTRACE.DLL | base_address = 0x7ffe7d350000 |
|
1 | |
| Load | NSHHTTP.DLL | base_address = 0x7ffe7db40000 |
|
1 | |
| Load | NSHIPSEC.DLL | base_address = 0x7ffe74000000 |
|
1 | |
| Load | NSHWFP.DLL | base_address = 0x7ffe70c30000 |
|
1 | |
| Load | P2PNETSH.DLL | base_address = 0x7ffe73f60000 |
|
1 | |
| Load | RPCNSH.DLL | base_address = 0x7ffe7d2f0000 |
|
1 | |
| Load | WCNNETSH.DLL | base_address = 0x7ffe7cd00000 |
|
1 | |
| Load | WHHELPER.DLL | base_address = 0x7ffe7d2e0000 |
|
1 | |
| Load | WLANCFG.DLL | base_address = 0x7ffe6c4a0000 |
|
1 | |
| Load | WSHELPER.DLL | base_address = 0x7ffe7a1d0000 |
|
1 | |
| Load | WWANCFG.DLL | - |
|
1 | |
| Get Handle | c:\windows\system32\netsh.exe | base_address = 0x7ff72c200000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\netsh.exe, file_name_orig = C:\WINDOWS\system32\MFC42u.dll, size = 260 |
|
1 | |
| Get Address | c:\windows\system32\ifmon.dll | function = InitHelperDll, address_out = 0x7ffe7f711310 |
|
1 | |
| Get Address | c:\windows\system32\rasmontr.dll | function = InitHelperDll, address_out = 0x7ffe7f615850 |
|
1 | |
| Get Address | c:\windows\system32\authfwcfg.dll | function = InitHelperDll, address_out = 0x7ffe7d551430 |
|
1 | |
| Get Address | c:\windows\system32\dhcpcmonitor.dll | function = InitHelperDll, address_out = 0x7ffe7f5f1610 |
|
1 | |
| Get Address | c:\windows\system32\dot3cfg.dll | function = InitHelperDll, address_out = 0x7ffe7e071100 |
|
1 | |
| Get Address | c:\windows\system32\fwcfg.dll | function = InitHelperDll, address_out = 0x7ffe7dda11f0 |
|
1 | |
| Get Address | c:\windows\system32\hnetmon.dll | function = InitHelperDll, address_out = 0x7ffe7e022060 |
|
1 | |
| Get Address | c:\windows\system32\netiohlp.dll | function = InitHelperDll, address_out = 0x7ffe7d495f80 |
|
1 | |
| Get Address | c:\windows\system32\nettrace.dll | function = InitHelperDll, address_out = 0x7ffe7d3515d0 |
|
1 | |
| Get Address | c:\windows\system32\nshhttp.dll | function = InitHelperDll, address_out = 0x7ffe7db410e0 |
|
1 | |
| Get Address | c:\windows\system32\nshipsec.dll | function = InitHelperDll, address_out = 0x7ffe74001250 |
|
1 | |
| Get Address | c:\windows\system32\nshwfp.dll | function = InitHelperDll, address_out = 0x7ffe70c310d0 |
|
1 | |
| Get Address | c:\windows\system32\p2pnetsh.dll | function = InitHelperDll, address_out = 0x7ffe73f611e0 |
|
1 | |
| Get Address | c:\windows\system32\rpcnsh.dll | function = InitHelperDll, address_out = 0x7ffe7d2f1010 |
|
1 | |
| Get Address | c:\windows\system32\wcnnetsh.dll | function = InitHelperDll, address_out = 0x7ffe7cd01680 |
|
1 | |
| Get Address | c:\windows\system32\whhelper.dll | function = InitHelperDll, address_out = 0x7ffe7d2e14d0 |
|
1 | |
| Get Address | c:\windows\system32\wlancfg.dll | function = InitHelperDll, address_out = 0x7ffe6c4a1320 |
|
1 | |
| Get Address | c:\windows\system32\wshelper.dll | function = InitHelperDll, address_out = 0x7ffe7a1d1030 |
|
1 |
System (8)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Cursor | x_out = 340, y_out = 703 |
|
1 | |
| Get Info | type = Operating System |
|
6 | |
| Get Info | type = System Directory, result_out = C:\WINDOWS\system32 |
|
1 |
Process #19: vssadmin.exe
0
0
| Information | Value |
|---|---|
| ID | #19 |
| File Name | c:\windows\system32\vssadmin.exe |
| Command Line | vssadmin delete shadows /all /quiet |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:02:37, Reason: Child Process |
| Unmonitor | End Time: 00:02:39, Reason: Self Terminated |
| Monitor Duration | 00:00:01 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xc10 |
| Parent PID | 0xfb4 (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
37C
0x
C40
0x
B78
0x
590
0x
D44
|
Process #20: wmic.exe
162
0
| Information | Value |
|---|---|
| ID | #20 |
| File Name | c:\windows\system32\wbem\wmic.exe |
| Command Line | wmic shadowcopy delete |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:02:40, Reason: Child Process |
| Unmonitor | End Time: 00:03:03, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:22 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x388 |
| Parent PID | 0xfb4 (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
D4C
0x
478
0x
46C
0x
644
0x
64C
|
Host Behavior
COM (7)
| Operation | Class | Interface | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|---|
| Create | WBEMLocator | IWbemLocator | cls_context = CLSCTX_INPROC_SERVER |
|
1 | |
| Create | F6D90F12-9C73-11D3-B32E-00C04F990BB4 | 2933BF95-7B36-11D2-B20E-00C04F983E60 | cls_context = CLSCTX_INPROC_SERVER |
|
1 | |
| Create | EB87E1BD-3233-11D2-AEC9-00C04FB68820 | EB87E1BC-3233-11D2-AEC9-00C04FB68820 | cls_context = CLSCTX_INPROC_SERVER |
|
1 | |
| Execute | WBEMLocator | IWbemLocator | method_name = ConnectServer, network_resource = root\cli |
|
1 | |
| Execute | WBEMLocator | IWbemLocator | method_name = ConnectServer, network_resource = root\cli\ms_409 |
|
1 | |
| Execute | WBEMLocator | IWbemLocator | method_name = ConnectServer, network_resource = \\NQDPDE\ROOT\CIMV2 |
|
1 | |
| Execute | WBEMLocator | IWbemServices | method_name = ExecQuery, query_language = WQL, query = SELECT * FROM Win32_ShadowCopy |
|
1 |
Registry (5)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM | value_name = Logging, data = 48 |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM | value_name = Logging Directory |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM | value_name = Logging Directory, data = 37 |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM | value_name = Log File Max Size, data = 54 |
|
1 |
Module (1)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\system32\wbem\wmic.exe | base_address = 0x7ff6687f0000 |
|
1 |
System (3)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Computer Name | result_out = NQDPDE |
|
1 | |
| Get Time | type = Local Time, time = 2019-05-16 11:42:02 (Local Time) |
|
1 | |
| Get Info | type = System Directory, result_out = C:\WINDOWS\system32 |
|
1 |
