9665761d...4f02 | Sequential Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 91/100
Dynamic Analysis Report
Classification: Riskware, Ransomware

9665761db091e37f2c9dd38b2e0d314971efa03b7fe48e86edd2661d57774f02 (SHA256)

Microsoft Updater 4.exe

Windows Exe (x86-32)

Created at 2018-07-31 12:44:00

...

Notifications (2/3)

Some extracted files may be missing in the report since the total file extraction size limit was reached during the analysis. You can increase the limit in the configuration settings.

Some extracted files may be missing in the report since the maximum number of extracted files was reached during the analysis. You can increase the limit in the configuration settings.

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x9d8 Analysis Target High (Elevated) microsoft updater 4.exe "C:\Users\EEBsYm5\Desktop\Microsoft Updater 4.exe" -

Behavior Information - Sequential View

Process #1: microsoft updater 4.exe
14740 0
»
Information Value
ID #1
File Name c:\users\eebsym5\desktop\microsoft updater 4.exe
Command Line "C:\Users\EEBsYm5\Desktop\Microsoft Updater 4.exe"
Initial Working Directory C:\Users\EEBsYm5\Desktop\
Monitor Start Time: 00:00:47, Reason: Analysis Target
Unmonitor End Time: 00:04:47, Reason: Terminated by Timeout
Monitor Duration 00:04:00
OS Process Information
»
Information Value
PID 0x9d8
Parent PID 0x5ac (c:\windows\explorer.exe)
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username CRH2YWU7\EEBsYm5
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 9DC
0x 9F8
0x 9FC
0x A00
0x A04
0x A08
0x A0C
0x A74
0x A78
Region
»
Name Start VA End VA Type Permissions Monitored Dumped YARA Actions
private_0x0000000000010000 0x00010000 0x0002ffff Private Memory rw True False False -
pagefile_0x0000000000010000 0x00010000 0x0001ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000020000 0x00020000 0x0002ffff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000030000 0x00030000 0x00033fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000040000 0x00040000 0x00040fff Pagefile Backed Memory r True False False -
private_0x0000000000050000 0x00050000 0x00050fff Private Memory rw True False False -
private_0x0000000000060000 0x00060000 0x00060fff Private Memory rw True False False -
pagefile_0x0000000000070000 0x00070000 0x00070fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000080000 0x00080000 0x0008ffff Pagefile Backed Memory rw True False False -
private_0x0000000000090000 0x00090000 0x0009ffff Private Memory - True False False -
private_0x00000000000a0000 0x000a0000 0x000affff Private Memory rw True False False -
private_0x00000000000b0000 0x000b0000 0x001affff Private Memory rw True False False -
private_0x00000000001b0000 0x001b0000 0x002affff Private Memory rw True False False -
locale.nls 0x002b0000 0x00316fff Memory Mapped File r False False False -
pagefile_0x0000000000320000 0x00320000 0x003e7fff Pagefile Backed Memory r True False False -
private_0x00000000003f0000 0x003f0000 0x003fffff Private Memory - True False False -
private_0x0000000000400000 0x00400000 0x0040ffff Private Memory rw True False False -
private_0x0000000000410000 0x00410000 0x0041ffff Private Memory - True False False -
private_0x0000000000420000 0x00420000 0x0042ffff Private Memory - True False False -
private_0x0000000000430000 0x00430000 0x0043ffff Private Memory - True False False -
private_0x0000000000440000 0x00440000 0x00440fff Private Memory rw True False False -
private_0x0000000000450000 0x00450000 0x00450fff Private Memory rw True False False -
rpcss.dll 0x00460000 0x004bbfff Memory Mapped File r False False False -
private_0x0000000000460000 0x00460000 0x0046ffff Private Memory - True False False -
private_0x0000000000470000 0x00470000 0x0047ffff Private Memory rw True False False -
private_0x0000000000480000 0x00480000 0x0048ffff Private Memory - True False False -
pagefile_0x0000000000490000 0x00490000 0x00490fff Pagefile Backed Memory rw True False False -
private_0x00000000004a0000 0x004a0000 0x004dffff Private Memory rwx True False False -
pagefile_0x00000000004e0000 0x004e0000 0x004e3fff Pagefile Backed Memory rw True False False -
private_0x00000000004f0000 0x004f0000 0x0052ffff Private Memory rwx True False False -
pagefile_0x0000000000530000 0x00530000 0x00630fff Pagefile Backed Memory r True False False -
pagefile_0x0000000000640000 0x00640000 0x00650fff Pagefile Backed Memory rw True False False -
pagefile_0x0000000000660000 0x00660000 0x00660fff Pagefile Backed Memory rw True False False -
private_0x00000000006d0000 0x006d0000 0x0070ffff Private Memory rwx True False False -
private_0x0000000000710000 0x00710000 0x0074ffff Private Memory rw True False False -
private_0x00000000007d0000 0x007d0000 0x008cffff Private Memory rw True False False -
private_0x00000000008d0000 0x008d0000 0x0096ffff Private Memory rw True False False -
private_0x0000000000990000 0x00990000 0x00a8ffff Private Memory rw True False False -
private_0x0000000000a90000 0x00a90000 0x00c5ffff Private Memory rw True False False -
pagefile_0x0000000000a90000 0x00a90000 0x00b6efff Pagefile Backed Memory r True False False -
private_0x0000000000c20000 0x00c20000 0x00c5ffff Private Memory rw True False False -
private_0x0000000000c70000 0x00c70000 0x00d6ffff Private Memory rw True False False -
sortdefault.nls 0x00d70000 0x0103efff Memory Mapped File r False False False -
microsoft updater 4.exe 0x010e0000 0x010f3fff Memory Mapped File rwx True True False
...
pagefile_0x0000000001100000 0x01100000 0x01cfffff Pagefile Backed Memory r True False False -
private_0x0000000001d00000 0x01d00000 0x03cfffff Private Memory rw True False False -
private_0x0000000003dc0000 0x03dc0000 0x03ebffff Private Memory rw True False False -
private_0x0000000003ec0000 0x03ec0000 0x04ebffff Private Memory rw True False False -
private_0x0000000004ec0000 0x04ec0000 0x04feffff Private Memory rw True False False -
private_0x0000000004ec0000 0x04ec0000 0x05ebffff Private Memory rw True False False -
private_0x0000000004ff0000 0x04ff0000 0x05feffff Private Memory rw True False False -
private_0x0000000005ff0000 0x05ff0000 0x0623ffff Private Memory rw True False False -
private_0x0000000006400000 0x06400000 0x064fffff Private Memory rw True False False -
private_0x00000000065d0000 0x065d0000 0x066cffff Private Memory rw True False False -
private_0x00000000066d0000 0x066d0000 0x076cffff Private Memory rw True False False -
private_0x00000000066d0000 0x066d0000 0x086cffff Private Memory rw True False False -
private_0x00000000076d0000 0x076d0000 0x086cffff Private Memory rw True False False -
sortdefault.nlp 0x086d0000 0x089a1fff Memory Mapped File r False False False -
private_0x00000000089b0000 0x089b0000 0x0a9affff Private Memory rw True False False -
private_0x000000000a9b0000 0x0a9b0000 0x0ae3ffff Private Memory rw True False False -
private_0x0000000011e40000 0x11e40000 0x1274ffff Private Memory rw True False False -
mscorlib.ni.dll 0x6b710000 0x6c93afff Memory Mapped File rwx True False False -
clr.dll 0x6c940000 0x6cfe7fff Memory Mapped File rwx True False False -
msvcr120_clr0400.dll 0x6e120000 0x6e214fff Memory Mapped File rwx False False False -
clrjit.dll 0x6f8e0000 0x6f95cfff Memory Mapped File rwx True False False -
mscoreei.dll 0x6f960000 0x6f9d7fff Memory Mapped File rwx True False False -
mscoree.dll 0x71de0000 0x71e29fff Memory Mapped File rwx True False False -
nlssorting.dll 0x71f40000 0x71f52fff Memory Mapped File rwx True False False -
uxtheme.dll 0x741e0000 0x7421ffff Memory Mapped File rwx False False False -
version.dll 0x748d0000 0x748d8fff Memory Mapped File rwx False False False -
rsaenh.dll 0x74bf0000 0x74c2afff Memory Mapped File rwx False False False -
cryptsp.dll 0x74e50000 0x74e65fff Memory Mapped File rwx False False False -
bcrypt.dll 0x74f80000 0x74f96fff Memory Mapped File rwx False False False -
cryptbase.dll 0x752d0000 0x752dbfff Memory Mapped File rwx False False False -
kernelbase.dll 0x75540000 0x75589fff Memory Mapped File rwx False False False -
rpcrt4.dll 0x75680000 0x75720fff Memory Mapped File rwx False False False -
shell32.dll 0x75830000 0x76479fff Memory Mapped File rwx False False False -
lpk.dll 0x76480000 0x76489fff Memory Mapped File rwx False False False -
imm32.dll 0x76490000 0x764aefff Memory Mapped File rwx False False False -
ole32.dll 0x76750000 0x768abfff Memory Mapped File rwx False False False -
kernel32.dll 0x76910000 0x769e3fff Memory Mapped File rwx False False False -
advapi32.dll 0x769f0000 0x76a8ffff Memory Mapped File rwx False False False -
msvcrt.dll 0x76a90000 0x76b3bfff Memory Mapped File rwx False False False -
user32.dll 0x76b40000 0x76c08fff Memory Mapped File rwx False False False -
oleaut32.dll 0x76c10000 0x76c9efff Memory Mapped File rwx False False False -
msctf.dll 0x76ca0000 0x76d6bfff Memory Mapped File rwx False False False -
usp10.dll 0x76d70000 0x76e0cfff Memory Mapped File rwx False False False -
shlwapi.dll 0x76e10000 0x76e66fff Memory Mapped File rwx False False False -
ntdll.dll 0x77230000 0x7736bfff Memory Mapped File rwx False False False -
sechost.dll 0x773c0000 0x773d8fff Memory Mapped File rwx False False False -
gdi32.dll 0x773e0000 0x7742dfff Memory Mapped File rwx False False False -
apisetschema.dll 0x77470000 0x77470fff Memory Mapped File rwx False False False -
pagefile_0x000000007f6f0000 0x7f6f0000 0x7f7effff Pagefile Backed Memory r True False False -
pagefile_0x000000007ffb0000 0x7ffb0000 0x7ffd2fff Pagefile Backed Memory r True False False -
private_0x000000007ffd7000 0x7ffd7000 0x7ffd7fff Private Memory rw True False False -
private_0x000000007ffd9000 0x7ffd9000 0x7ffd9fff Private Memory rw True False False -
private_0x000000007ffda000 0x7ffda000 0x7ffdafff Private Memory rw True False False -
private_0x000000007ffdb000 0x7ffdb000 0x7ffdbfff Private Memory rw True False False -
private_0x000000007ffdc000 0x7ffdc000 0x7ffdcfff Private Memory rw True False False -
private_0x000000007ffdd000 0x7ffdd000 0x7ffddfff Private Memory rw True False False -
private_0x000000007ffde000 0x7ffde000 0x7ffdefff Private Memory rw True False False -
private_0x000000007ffdf000 0x7ffdf000 0x7ffdffff Private Memory rw True False False -
Created Files
»
Filename File Size Hash Values YARA Match Actions
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml 1.55 KB MD5: 316d1d7ae30d611bffd23451d8633d0a
SHA1: be36bdefa3f02d83a396ad8bac8cf885c447f955
SHA256: 43b186a776b1483afd998dc102bb569259d53d4fcede50682be1f9e3e2bc71cd
SSDeep: 48:+7L2J0+IA9xkO7qBfCZS04LIY7VyhOJsGHN:gz2xkBBQP4LT8hSt 		False
...
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml 2.39 KB MD5: 8d0154af9617cc964e184ee527603a80
SHA1: 149af150ada72235ce0e14e0ad4cdd952765612f
SHA256: 8e07038b457ce2a68a71dba9987572b174b3420f900debe036d11eadb08538ab
SSDeep: 48:Fz0UwAEdOwx8c0H6KMv0dhPrmp/mwoZ9UfUdGrkCdt/RiBykWHRw4sPm:qUwSh+v0dhPrim2XACdlBHG44m 		False
...
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab 10.00 MB MD5: 8e2cbc92ef81fb515227f67e857e8bfd
SHA1: cb0a8d9bee25aa13a94e82d794d37cc70ddc9017
SHA256: 0e591ef8505018d274bc6161cd4e0dbbbeebf1e1e6387c4613fe79ec32470cae
SSDeep: 196608:M6F8ONOM8NtX9E2HVJP55X7yD22B0GnX/tPIyLFqCNMLYm4/3PRZ69jNFfj:M60N57VJPyD2k0O/tPjRMLYbn6xrj 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml 1.45 KB MD5: 1284a82ca238a22fb474ab3923215182
SHA1: 6e6541612534356b1b10381931059a357b50b9b9
SHA256: 1b819f6c03e7ab656ce3cdf403ee660a2e7769da7233b1624b69339b7ae7d461
SSDeep: 24:rbK0UkVsZBDRPZuV6GFdSW7X51ympo7/v6wN30kbjCyI8iEZerzGNsCUjMcO2R5q:rOke7BA4w13o7/v6wl0Yjo8VWF0eiFmW 		False
...
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab 10.00 MB MD5: 2236909b4cee80ba9ef379f212e31d89
SHA1: 80d6a9110e62be7f1feade5972e93e086b53b5d5
SHA256: ed59e2d2f37a5d8926a8a36c4872e9cd26c793aaec31ab381cfcc3c594b8527a
SSDeep: 196608:EEqGhihfpaouv0qeeJegtfgJFD+KTA1ZyqOcW4eM95:pshhnqvpegtfgJxhqOcW5m 		False
...
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml 3.14 KB MD5: a409284d1c9864708592d94d45fc5fbf
SHA1: e70b7f05169412639ef4fbd019397e9ad6bba684
SHA256: 9ddbd4f612df748938462347d7c9cf2947a4fca5e3df2c9dec3883dd26105569
SSDeep: 48:k7juZx7i9eN8HdBflmDrNZJ+NVheDgsmBtmS4/qJnTw+UraFYZ1WAWr1dT06vseq:+juT7im4/lqkNBBtmaNTw+oaCbzQ0Zeq 		False
...
C:\BOOTSECT.BAK 8.03 KB MD5: 7a0dbe5b4d2eac78e5b046d07d2a5826
SHA1: 4d94613edf5db7573b77a9ea2deb12bbeb317c2b
SHA256: 83e734d9a9a35b792e94db2e0fc04d3e57b430a201be0c5483f991e7b508c89b
SSDeep: 192:NUvsWUlUABNT0sCEtSuP4UUu2oep2J2LYNuKiQdnui/+zEQ:usWUlHB10XQf2u2dAcOutQJui/+5 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi 641.53 KB MD5: e73d43759030a9bd767d51b7e8e8ff07
SHA1: 8c230ccee672f8df6e9a23c169bfd779fa6ba408
SHA256: 9301b64f15310e57f9bef8ded3ac248c79bb938df8a77befc54ebefffcf59911
SSDeep: 12288:q5pTnbRGA5LGhrYDE9GEYP0HzWIVq7c8vUIf7TUgqNQI0d:q5Nb0A5WYDEbDTWIAcoUjgVI0d 		False
...
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab 10.00 MB MD5: c83eda9a1eb0d548c6e65ede53df4f47
SHA1: 2671aff4f8e7e60970dda04f7721371199876fe4
SHA256: 5cf11c8699aa503c04fe81f642052519b660f96f0c7234cdbca8ec7af2c2b59a
SSDeep: 196608:a7J8LAgtRAJWZXGKUvC1Vf4ETV87U+oz5pUCajoGQq1QAY+8wCvNQeVFzbk:aVeAgLsWpSCjf4ET2ZoNGCq1Y+rkNQeE 		False
...
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml 1.44 KB MD5: 15739a6feec21b081526524aa1a0f0a0
SHA1: 36868fd000444ed0b830ee366e3551a1eaddc9e7
SHA256: 2662b11ea1f33a0d60b575b655185b6952c3201ce578b0e128a64aa82696bb5a
SSDeep: 24:uA45tMjdJHWQ/y6YcYINj98GeHdj6k02a4yaZjWPbY5sXwE1nt/FM8DpibdhTsyd:uA4DYHWCy6YTwZlCEF4VZiPc5lE/i4yd 		False
...
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml 2.27 KB MD5: 4ccf286e018e5fdd7ae37628265c6533
SHA1: 7f0f3a0a99167217723e78a8bbde82d0ef30168f
SHA256: 8091ec9174baccb586f74111eb385ae51e518c7602a511765bd66571133b09c3
SSDeep: 48:5/XL2mCd7pCucXJApOdhmiMKMNCBfFLB/ZKP+Jb7QrVj+nqlA:l72mA7YXJ7dhBMKMNaL/ZeqQrVWmA 		False
...
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml 1.55 KB MD5: 671af4ad7e55e75ef945947aa605abd7
SHA1: ffcc94d43591707467bd560d2f7453298e4ebbd3
SHA256: 07174f8cb0a3d5ded464b85f3d4bd338ac3b9f39c24061b985fe90e7e534c724
SSDeep: 48:lbFqx4bAJ6sfMCWm7/1hu6a4bWwqHjlfK+sn6:hFq6e6sfHW6y4PkpK++6 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml 5.77 KB MD5: d259f7d1ed97411f3b4ade9c8bb6896b
SHA1: 826f60682ca77bccba4be96219c28c14eb49e3b2
SHA256: fadc1108fa3a62841f4da8a14cfc25e0841fecc2998d7b69b3575b28a2422b5a
SSDeep: 96:LjeXyDImK8sjz8skOQtCDsmDxb/V4BRRD7wCGZKafPK7OQYztCtah:LKXxx8nE9rVGwCGZ5n6OQYztCtah 		False
...
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml 4.12 KB MD5: 5f383a1ca7be41aa53a3fdc6d170fcd9
SHA1: 51f68a944359eaa6e623ded397c62b2ff350983f
SHA256: 49c1eae940bda3fc498adf93627b7adca78fd57a1050a5a417c6a815337ffe4c
SSDeep: 96:qMAYPoQjyeM+MZ7+Ul7QOVJyKnEDIO+1x9aB2+ckBlT3K:qMARQbM+e7plsOPyTDI71CU+jK 		False
...
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml 1.59 KB MD5: 457c27a118ad6ad1be9553a8a79d3b38
SHA1: 86c7f6402138b95fe0fe952e7e53d590d29a6d81
SHA256: 9c4b43961cd956a4ddbe27ee196e7b597b165d4666160ef5b45da08e0edc61fb
SSDeep: 24:DPjGPt5gthjF73I3uJjTCLyAXn9x6E7zarIui/VIyscuVqYFfiOas/pm:+UnjNdjFAXn9x1yidIys3qOaWpm 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab 10.00 MB MD5: ec0da826de1be4bcea97a82b2d6109d9
SHA1: 4f91c9fc94f445be66f5b8cc6c82400cfd384d3c
SHA256: da82f90117e9499e7be154ed6b6eaa0975e0434e92f03e9c1f9e7bfa9a03887b
SSDeep: 196608:6f6rwDdgv8Qr9FOzfiyU7KnawUC7rktYj73dwqvDOZkvY:CMUdgvH56iL7vwUcotY73fvDW 		False
...
C:\Boot\BOOTSTAT.DAT 64.03 KB MD5: 2718c1435f27ec45a20c3b32509d483d
SHA1: fdad75a0356223e7b52409a8f432f8d3bfea9425
SHA256: 1dacc7450fcf579ac2245fd0967df499c49c98d1c83b79ba04b2b1f036e44c13
SSDeep: 1536:8kXJBr2c64pLcGotYHJrMmiEhzekmFtCQn09hKnKVR0BCMXA:1ZBr2l4O/tcRVIJCQ09k/S 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml 1.34 KB MD5: acf7b1c1ac0f68221cb2d9860f770179
SHA1: f3165f67d795f441f3d70c33768cd4d661c8a74d
SHA256: eb1296b5f827d1832b6e7d750fa9ad8ed91b8db7de60ead3e3076cc11dced1cd
SSDeep: 24:4xlwICXMcj3gO7XvgN02BjO698L+IRuH3+Nt0MnOzA1aSGal+thITMKW1ibDJ73F:4w9X9jT7XvgW2FOC8LPH6MOzYaSGa8jq 		False
...
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi 1.74 MB MD5: 984d79619fab6585af21badda23dcacd
SHA1: 3a60000d4e11c7f089df1b765ccc2b57c77b1351
SHA256: 445b71851e0ba83bb7fa09363368316a824a4a501f7a7d35464e4038184cca58
SSDeep: 24576:kQzE9LOxbFtSNURpQuWzr9Tfc1kepGbUmxiDM09wl+Ft5AkY6JHIiDBMk3CaU:kQzxtSN8Wtk1k2its4riDtIiDBZyl 		False
...
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi 2.02 MB MD5: d695931349653b571437829abe8e50db
SHA1: d5c89a12e9e616e0b582fc34802d396969fa95a3
SHA256: dce0105688feed9ae8d48432d0778a85b529cd1f61e776f00d80f38f466cefcf
SSDeep: 49152:MS7LtdCE4n9UePxXLy+RqQ0yjqp7Y7gYxTFfx9OC1L8z6ZkO6JN5uN:5OE4uedm+RqXj7WJxT1vOC1L8sMPuN 		False
...
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml 1.86 KB MD5: c25f12809b7b653c9fe52cb950038087
SHA1: 02fd53f5edf590f81e133d4bb5dbc690b197dac1
SHA256: 28445783a35b1afa1c87a75d60a0524553f4641e3283d333c8ee6961e3713540
SSDeep: 48:4k4H1pl4fA0OfPSy9DBJ196CfXQPLsx2LSw:4XHmo0O3NDC+XQ+/w 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi 635.03 KB MD5: 9529bfe0bb2afa111c2ca6192605be84
SHA1: b8cda5e50bc4d6dbad63f6027419d8b2e4123116
SHA256: 91847e340d18ad440e76e8ef1e8b2bc045e3e3ff0aa45ed54e7b088e6cd3e6ac
SSDeep: 12288:wX8uZONoOgxPmtSZoPDwRPgSIRz3qDycf56F4y7KHLZ2:wXAAPmUAuINOy9Fx7a2 		False
...
C:\config.sys 0.03 KB MD5: 6bd1f14c0f3f6209bba2a0d7a7dd20a7
SHA1: 43f1d24139741b3027788b37b1a5edb5089e6924
SHA256: 8ae8e1f64cfc92e3aaf2a93fbaae0cbe2bd5de0ddb5ef49a6bad4c2ba2d5971f
SSDeep: 3:8MND2rPK:8MNq+ 		False
...
C:\autoexec.bat 0.05 KB MD5: 95e5e365b2540a61744e408e580afe16
SHA1: d967861d865809087bd624b015c95af91c12cf21
SHA256: 821cd549f386892840fda015261e5c7bac3bf0d0f51a07dc55f5eade00bf3ef4
SSDeep: 3:PKGnkjXyHGdn:yGn82Gd 		False
...
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi 1.72 MB MD5: 96e22a4c16e2f7f0113a1a1553d6337d
SHA1: 924df416a155595eb4c49ec467bee534774a421d
SHA256: 4d4162e064d76812d7651f5423e8ad33340476a90e2822315a2171782f0fbc81
SSDeep: 49152:FEe3Sgz0NX/Zy3REPquV8Bb3d0ZeaiRBl3Lnlys8r:Ce3SgOZ+q3V8BTI+wsG 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi 647.53 KB MD5: 759cf4fdd5afe9ae8c42bcdb252b0596
SHA1: 509f8815c11bfa7b3dce94567ef66185ca2532a7
SHA256: 2e98a382a6ef2483b8eaf02ce5c30cc4642e43d9ef6cb6d903fabd7f6a55ed95
SSDeep: 12288:BVSy3eDmGjSwrT9axtL/o9R0zM9g00OKPAQv2CE/EH5l/:BVSyuD1SwrTYxZ2SYgKKYOpEu 		False
...
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab 10.00 MB MD5: fa1fa999988c1f69c73f8666b15021cb
SHA1: 6f8804ffc7f905bacde37902837611267b4a533a
SHA256: 3b28b688ebce1e777a78aba69f4d513060a5cb7bdf3c2db9a1c78270ecc9edab
SSDeep: 196608:Smx34ZM92oN+H6KhJvd1wxajrbfXvR6he6a9AAtDsBumic0LsG:Smx34G9TMjV1wK/qq9AoDsBumv0L7 		False
...
C:\Users\EEBsYm5\Desktop\ay51Ul3dhjfU6GvDPUfZKdAzJqGGZVCwkfjiPR0D.txt 0.15 KB MD5: 9d6e86a23bb1d426c3eb4cbe4205f072
SHA1: e261d5e8019339d2b78aa2f56c8d17311eb40c87
SHA256: 71490d5f047337fcc13a7eea7b530ef4bbdd5e1bd64c5ff4dc73631d1ad6b9f9
SSDeep: 3:kfQvA1D18w9ymFpA9CBF7ujIVcOXYG8mMuzxOzNDn5LJXhy:XA38acCz9cOXYG8mxxOzB5VXhy 		False
...
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml 1.78 KB MD5: 5cf7919505dc7553d0d2769190f8e97a
SHA1: 2ab2dae073763855453e14c4032aeffab6854f4a
SHA256: 1f0eee84f52bc4ee283116adee20f273d11d7e6f3952461006c5168bc37bb578
SSDeep: 48:aspn2zxNT2ry6FNceLtjC9P1DJ6fSC3cbwBn37QPNHVvM+:ast2z7T2+6nPkkaScbm32P 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab 10.00 MB MD5: ff2be9d44b9e0c5aca3b129a07d7cfd5
SHA1: 6f0fe3550892eed5baf1ecc964ec0c897c5d6ed8
SHA256: bf42705d7894c2482cab730dd3eda44c1390222fa9030079c06c71f1e27ac7d9
SSDeep: 196608:BkKxnCZ7arXe4Dlyy17IJHJVos/HmMVVurzzgK/ciI6D/HVDGqaz2Ze3:BkKQ7K8E7I1Qs/HpazzZn/c1z2Ze3 		False
...
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi 1.73 MB MD5: f692eda758ca3e3920c0f534f64fbec9
SHA1: 021803d871ba13d01e18744d555f22e56aaf9fd1
SHA256: a4f3c92d8e999189749de939c622df99564a03dfded842b3686baa13e271d277
SSDeep: 49152:7Z0teud/ctIh3Pl2F0NArR0qOcogbu2rsV:7Z0rdUtIh/l60NO0Kq2rW 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab 9.61 MB MD5: dbdd73dd4db0ebbe1948826ed5481261
SHA1: 61af36924aa96a0c83e6d714d6a85511624cb17f
SHA256: d6dd22ce4c37832cee084e0b9823a58e5133904cbb47d478384f6c2791e3152f
SSDeep: 196608:tMwuIPO+xvJVNyoIZ8dh8DaqePIlX918oK9XpA8sE:zuIPrgbqkW1glPnKrAo 		False
...
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi 1.72 MB MD5: a7fbf6a2c96b0a0876e2c7e9af328d0c
SHA1: b01e34c1f65bdbee4bde11b0212c9fab27f70c2a
SHA256: 81ec2d6f926faeb2c7b09ffe582e8db2fd22ca7ed1cfc20636de432bceaef835
SSDeep: 49152:NLAtH83pcG2D4sodG4MzN0uGQn8tA1/Ehwn:NM9832NDMSzxstABE6n 		False
...
C:\Users\EEBsYm5\Desktop\README.txt 1.06 KB MD5: e5de9a0209a7cfc5ee85a74bacfc27fe
SHA1: f5b3f199497b70f78d7c829815604c65b21a661c
SHA256: f9e1e50353e0b591f693f02cdd7539e6bafa78429bbc288e1ea7766803abc23a
SSDeep: 24:W1c4b8sVFbSi/DJvsxYJEDpKmIY5KkzU/SV:Wy4b8sDixY6Dom6kQ/k 		False
...
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab 9.49 MB MD5: fad05d5225f43a3d95e8386d984196d4
SHA1: 96ee8b00116e233d218fc1cc7532bf7445d06cf2
SHA256: cb79c41f89691fefc91c863e408724848afbf0fce1ddb1e38d555e1c8c376e53
SSDeep: 196608:4c4TZuMZ+WFBqHBappU/0WYBVJVyvm9zX92xj/GCOYLF55+mS5EinqOC:LWZHZ+WFBqHBaBWorVyvmxwjeCpzQEiM 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml 0.81 KB MD5: 7c26dabf1e24352f571ad2d2e58985e9
SHA1: 897c00ae219d13424c5e127854b1cbab17e20c74
SHA256: 237fada922a6d1acc3820076a84fa1d301243e71ed0fdd310a9c8720e389649e
SSDeep: 24:0xEQZtc95PQsMtxow6P+kD5CSuemERTU7:KXZu7PctB6GkD53tmERTU7 		False
...
C:\$Recycle.Bin\S-1-5-21-3785418085-2572485238-895829336-1000\desktop.ini 0.16 KB MD5: 62584d21b3e239c493328f470c42fcae
SHA1: 3099f10c7eba34e8d22bbada31929ce380e18cd9
SHA256: 08b48f85698c3414729f5d3b0bf96656dc154369429f2466141fc0af368bf1f2
SSDeep: 3:yPD8FAcbf6rAIktpakvgdYBybxeu0r7vkkSrHNVPjhL6ItShfOox:qD8FAcLHt0Bcydx0r7QlfQhfOox 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml 1.55 KB MD5: 316d1d7ae30d611bffd23451d8633d0a
SHA1: be36bdefa3f02d83a396ad8bac8cf885c447f955
SHA256: 43b186a776b1483afd998dc102bb569259d53d4fcede50682be1f9e3e2bc71cd
SSDeep: 48:+7L2J0+IA9xkO7qBfCZS04LIY7VyhOJsGHN:gz2xkBBQP4LT8hSt 		False
...
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml 2.39 KB MD5: 8d0154af9617cc964e184ee527603a80
SHA1: 149af150ada72235ce0e14e0ad4cdd952765612f
SHA256: 8e07038b457ce2a68a71dba9987572b174b3420f900debe036d11eadb08538ab
SSDeep: 48:Fz0UwAEdOwx8c0H6KMv0dhPrmp/mwoZ9UfUdGrkCdt/RiBykWHRw4sPm:qUwSh+v0dhPrim2XACdlBHG44m 		False
...
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab 10.00 MB MD5: 8e2cbc92ef81fb515227f67e857e8bfd
SHA1: cb0a8d9bee25aa13a94e82d794d37cc70ddc9017
SHA256: 0e591ef8505018d274bc6161cd4e0dbbbeebf1e1e6387c4613fe79ec32470cae
SSDeep: 196608:M6F8ONOM8NtX9E2HVJP55X7yD22B0GnX/tPIyLFqCNMLYm4/3PRZ69jNFfj:M60N57VJPyD2k0O/tPjRMLYbn6xrj 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml 1.45 KB MD5: 1284a82ca238a22fb474ab3923215182
SHA1: 6e6541612534356b1b10381931059a357b50b9b9
SHA256: 1b819f6c03e7ab656ce3cdf403ee660a2e7769da7233b1624b69339b7ae7d461
SSDeep: 24:rbK0UkVsZBDRPZuV6GFdSW7X51ympo7/v6wN30kbjCyI8iEZerzGNsCUjMcO2R5q:rOke7BA4w13o7/v6wl0Yjo8VWF0eiFmW 		False
...
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab 10.00 MB MD5: 2236909b4cee80ba9ef379f212e31d89
SHA1: 80d6a9110e62be7f1feade5972e93e086b53b5d5
SHA256: ed59e2d2f37a5d8926a8a36c4872e9cd26c793aaec31ab381cfcc3c594b8527a
SSDeep: 196608:EEqGhihfpaouv0qeeJegtfgJFD+KTA1ZyqOcW4eM95:pshhnqvpegtfgJxhqOcW5m 		False
...
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml 3.14 KB MD5: a409284d1c9864708592d94d45fc5fbf
SHA1: e70b7f05169412639ef4fbd019397e9ad6bba684
SHA256: 9ddbd4f612df748938462347d7c9cf2947a4fca5e3df2c9dec3883dd26105569
SSDeep: 48:k7juZx7i9eN8HdBflmDrNZJ+NVheDgsmBtmS4/qJnTw+UraFYZ1WAWr1dT06vseq:+juT7im4/lqkNBBtmaNTw+oaCbzQ0Zeq 		False
...
C:\BOOTSECT.BAK 8.03 KB MD5: 7a0dbe5b4d2eac78e5b046d07d2a5826
SHA1: 4d94613edf5db7573b77a9ea2deb12bbeb317c2b
SHA256: 83e734d9a9a35b792e94db2e0fc04d3e57b430a201be0c5483f991e7b508c89b
SSDeep: 192:NUvsWUlUABNT0sCEtSuP4UUu2oep2J2LYNuKiQdnui/+zEQ:usWUlHB10XQf2u2dAcOutQJui/+5 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi 641.53 KB MD5: e73d43759030a9bd767d51b7e8e8ff07
SHA1: 8c230ccee672f8df6e9a23c169bfd779fa6ba408
SHA256: 9301b64f15310e57f9bef8ded3ac248c79bb938df8a77befc54ebefffcf59911
SSDeep: 12288:q5pTnbRGA5LGhrYDE9GEYP0HzWIVq7c8vUIf7TUgqNQI0d:q5Nb0A5WYDEbDTWIAcoUjgVI0d 		False
...
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab 10.00 MB MD5: c83eda9a1eb0d548c6e65ede53df4f47
SHA1: 2671aff4f8e7e60970dda04f7721371199876fe4
SHA256: 5cf11c8699aa503c04fe81f642052519b660f96f0c7234cdbca8ec7af2c2b59a
SSDeep: 196608:a7J8LAgtRAJWZXGKUvC1Vf4ETV87U+oz5pUCajoGQq1QAY+8wCvNQeVFzbk:aVeAgLsWpSCjf4ET2ZoNGCq1Y+rkNQeE 		False
...
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml 1.44 KB MD5: 15739a6feec21b081526524aa1a0f0a0
SHA1: 36868fd000444ed0b830ee366e3551a1eaddc9e7
SHA256: 2662b11ea1f33a0d60b575b655185b6952c3201ce578b0e128a64aa82696bb5a
SSDeep: 24:uA45tMjdJHWQ/y6YcYINj98GeHdj6k02a4yaZjWPbY5sXwE1nt/FM8DpibdhTsyd:uA4DYHWCy6YTwZlCEF4VZiPc5lE/i4yd 		False
...
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml 2.27 KB MD5: 4ccf286e018e5fdd7ae37628265c6533
SHA1: 7f0f3a0a99167217723e78a8bbde82d0ef30168f
SHA256: 8091ec9174baccb586f74111eb385ae51e518c7602a511765bd66571133b09c3
SSDeep: 48:5/XL2mCd7pCucXJApOdhmiMKMNCBfFLB/ZKP+Jb7QrVj+nqlA:l72mA7YXJ7dhBMKMNaL/ZeqQrVWmA 		False
...
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml 1.55 KB MD5: 671af4ad7e55e75ef945947aa605abd7
SHA1: ffcc94d43591707467bd560d2f7453298e4ebbd3
SHA256: 07174f8cb0a3d5ded464b85f3d4bd338ac3b9f39c24061b985fe90e7e534c724
SSDeep: 48:lbFqx4bAJ6sfMCWm7/1hu6a4bWwqHjlfK+sn6:hFq6e6sfHW6y4PkpK++6 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml 5.77 KB MD5: d259f7d1ed97411f3b4ade9c8bb6896b
SHA1: 826f60682ca77bccba4be96219c28c14eb49e3b2
SHA256: fadc1108fa3a62841f4da8a14cfc25e0841fecc2998d7b69b3575b28a2422b5a
SSDeep: 96:LjeXyDImK8sjz8skOQtCDsmDxb/V4BRRD7wCGZKafPK7OQYztCtah:LKXxx8nE9rVGwCGZ5n6OQYztCtah 		False
...
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml 4.12 KB MD5: 5f383a1ca7be41aa53a3fdc6d170fcd9
SHA1: 51f68a944359eaa6e623ded397c62b2ff350983f
SHA256: 49c1eae940bda3fc498adf93627b7adca78fd57a1050a5a417c6a815337ffe4c
SSDeep: 96:qMAYPoQjyeM+MZ7+Ul7QOVJyKnEDIO+1x9aB2+ckBlT3K:qMARQbM+e7plsOPyTDI71CU+jK 		False
...
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml 1.59 KB MD5: 457c27a118ad6ad1be9553a8a79d3b38
SHA1: 86c7f6402138b95fe0fe952e7e53d590d29a6d81
SHA256: 9c4b43961cd956a4ddbe27ee196e7b597b165d4666160ef5b45da08e0edc61fb
SSDeep: 24:DPjGPt5gthjF73I3uJjTCLyAXn9x6E7zarIui/VIyscuVqYFfiOas/pm:+UnjNdjFAXn9x1yidIys3qOaWpm 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab 10.00 MB MD5: ec0da826de1be4bcea97a82b2d6109d9
SHA1: 4f91c9fc94f445be66f5b8cc6c82400cfd384d3c
SHA256: da82f90117e9499e7be154ed6b6eaa0975e0434e92f03e9c1f9e7bfa9a03887b
SSDeep: 196608:6f6rwDdgv8Qr9FOzfiyU7KnawUC7rktYj73dwqvDOZkvY:CMUdgvH56iL7vwUcotY73fvDW 		False
...
C:\Boot\BOOTSTAT.DAT 64.03 KB MD5: 2718c1435f27ec45a20c3b32509d483d
SHA1: fdad75a0356223e7b52409a8f432f8d3bfea9425
SHA256: 1dacc7450fcf579ac2245fd0967df499c49c98d1c83b79ba04b2b1f036e44c13
SSDeep: 1536:8kXJBr2c64pLcGotYHJrMmiEhzekmFtCQn09hKnKVR0BCMXA:1ZBr2l4O/tcRVIJCQ09k/S 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml 1.34 KB MD5: acf7b1c1ac0f68221cb2d9860f770179
SHA1: f3165f67d795f441f3d70c33768cd4d661c8a74d
SHA256: eb1296b5f827d1832b6e7d750fa9ad8ed91b8db7de60ead3e3076cc11dced1cd
SSDeep: 24:4xlwICXMcj3gO7XvgN02BjO698L+IRuH3+Nt0MnOzA1aSGal+thITMKW1ibDJ73F:4w9X9jT7XvgW2FOC8LPH6MOzYaSGa8jq 		False
...
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi 1.74 MB MD5: 984d79619fab6585af21badda23dcacd
SHA1: 3a60000d4e11c7f089df1b765ccc2b57c77b1351
SHA256: 445b71851e0ba83bb7fa09363368316a824a4a501f7a7d35464e4038184cca58
SSDeep: 24576:kQzE9LOxbFtSNURpQuWzr9Tfc1kepGbUmxiDM09wl+Ft5AkY6JHIiDBMk3CaU:kQzxtSN8Wtk1k2its4riDtIiDBZyl 		False
...
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi 2.02 MB MD5: d695931349653b571437829abe8e50db
SHA1: d5c89a12e9e616e0b582fc34802d396969fa95a3
SHA256: dce0105688feed9ae8d48432d0778a85b529cd1f61e776f00d80f38f466cefcf
SSDeep: 49152:MS7LtdCE4n9UePxXLy+RqQ0yjqp7Y7gYxTFfx9OC1L8z6ZkO6JN5uN:5OE4uedm+RqXj7WJxT1vOC1L8sMPuN 		False
...
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml 1.86 KB MD5: c25f12809b7b653c9fe52cb950038087
SHA1: 02fd53f5edf590f81e133d4bb5dbc690b197dac1
SHA256: 28445783a35b1afa1c87a75d60a0524553f4641e3283d333c8ee6961e3713540
SSDeep: 48:4k4H1pl4fA0OfPSy9DBJ196CfXQPLsx2LSw:4XHmo0O3NDC+XQ+/w 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi 635.03 KB MD5: 9529bfe0bb2afa111c2ca6192605be84
SHA1: b8cda5e50bc4d6dbad63f6027419d8b2e4123116
SHA256: 91847e340d18ad440e76e8ef1e8b2bc045e3e3ff0aa45ed54e7b088e6cd3e6ac
SSDeep: 12288:wX8uZONoOgxPmtSZoPDwRPgSIRz3qDycf56F4y7KHLZ2:wXAAPmUAuINOy9Fx7a2 		False
...
C:\config.sys 0.03 KB MD5: 6bd1f14c0f3f6209bba2a0d7a7dd20a7
SHA1: 43f1d24139741b3027788b37b1a5edb5089e6924
SHA256: 8ae8e1f64cfc92e3aaf2a93fbaae0cbe2bd5de0ddb5ef49a6bad4c2ba2d5971f
SSDeep: 3:8MND2rPK:8MNq+ 		False
...
C:\autoexec.bat 0.05 KB MD5: 95e5e365b2540a61744e408e580afe16
SHA1: d967861d865809087bd624b015c95af91c12cf21
SHA256: 821cd549f386892840fda015261e5c7bac3bf0d0f51a07dc55f5eade00bf3ef4
SSDeep: 3:PKGnkjXyHGdn:yGn82Gd 		False
...
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi 1.72 MB MD5: 96e22a4c16e2f7f0113a1a1553d6337d
SHA1: 924df416a155595eb4c49ec467bee534774a421d
SHA256: 4d4162e064d76812d7651f5423e8ad33340476a90e2822315a2171782f0fbc81
SSDeep: 49152:FEe3Sgz0NX/Zy3REPquV8Bb3d0ZeaiRBl3Lnlys8r:Ce3SgOZ+q3V8BTI+wsG 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi 647.53 KB MD5: 759cf4fdd5afe9ae8c42bcdb252b0596
SHA1: 509f8815c11bfa7b3dce94567ef66185ca2532a7
SHA256: 2e98a382a6ef2483b8eaf02ce5c30cc4642e43d9ef6cb6d903fabd7f6a55ed95
SSDeep: 12288:BVSy3eDmGjSwrT9axtL/o9R0zM9g00OKPAQv2CE/EH5l/:BVSyuD1SwrTYxZ2SYgKKYOpEu 		False
...
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab 10.00 MB MD5: fa1fa999988c1f69c73f8666b15021cb
SHA1: 6f8804ffc7f905bacde37902837611267b4a533a
SHA256: 3b28b688ebce1e777a78aba69f4d513060a5cb7bdf3c2db9a1c78270ecc9edab
SSDeep: 196608:Smx34ZM92oN+H6KhJvd1wxajrbfXvR6he6a9AAtDsBumic0LsG:Smx34G9TMjV1wK/qq9AoDsBumv0L7 		False
...
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml 1.78 KB MD5: 5cf7919505dc7553d0d2769190f8e97a
SHA1: 2ab2dae073763855453e14c4032aeffab6854f4a
SHA256: 1f0eee84f52bc4ee283116adee20f273d11d7e6f3952461006c5168bc37bb578
SSDeep: 48:aspn2zxNT2ry6FNceLtjC9P1DJ6fSC3cbwBn37QPNHVvM+:ast2z7T2+6nPkkaScbm32P 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab 10.00 MB MD5: ff2be9d44b9e0c5aca3b129a07d7cfd5
SHA1: 6f0fe3550892eed5baf1ecc964ec0c897c5d6ed8
SHA256: bf42705d7894c2482cab730dd3eda44c1390222fa9030079c06c71f1e27ac7d9
SSDeep: 196608:BkKxnCZ7arXe4Dlyy17IJHJVos/HmMVVurzzgK/ciI6D/HVDGqaz2Ze3:BkKQ7K8E7I1Qs/HpazzZn/c1z2Ze3 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab 10.00 MB MD5: 4b02c5cd7501413321570812bcfd9e00
SHA1: d5eaf778c521f4523af74cdb725524e22a29da53
SHA256: d3c15b063f8ca7ac110d6aecd21077202f136e8d09939f5b6418a3397ec7e838
SSDeep: 196608:tMwuIPO+xvJVNyoIZ8dh8DaqePIlX918oK9XpA8sx7NP:zuIPrgbqkW1glPnKrAX 		False
...
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi 1.73 MB MD5: f692eda758ca3e3920c0f534f64fbec9
SHA1: 021803d871ba13d01e18744d555f22e56aaf9fd1
SHA256: a4f3c92d8e999189749de939c622df99564a03dfded842b3686baa13e271d277
SSDeep: 49152:7Z0teud/ctIh3Pl2F0NArR0qOcogbu2rsV:7Z0rdUtIh/l60NO0Kq2rW 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab 9.61 MB MD5: dbdd73dd4db0ebbe1948826ed5481261
SHA1: 61af36924aa96a0c83e6d714d6a85511624cb17f
SHA256: d6dd22ce4c37832cee084e0b9823a58e5133904cbb47d478384f6c2791e3152f
SSDeep: 196608:tMwuIPO+xvJVNyoIZ8dh8DaqePIlX918oK9XpA8sE:zuIPrgbqkW1glPnKrAo 		False
...
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi 1.72 MB MD5: a7fbf6a2c96b0a0876e2c7e9af328d0c
SHA1: b01e34c1f65bdbee4bde11b0212c9fab27f70c2a
SHA256: 81ec2d6f926faeb2c7b09ffe582e8db2fd22ca7ed1cfc20636de432bceaef835
SSDeep: 49152:NLAtH83pcG2D4sodG4MzN0uGQn8tA1/Ehwn:NM9832NDMSzxstABE6n 		False
...
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab 9.49 MB MD5: fad05d5225f43a3d95e8386d984196d4
SHA1: 96ee8b00116e233d218fc1cc7532bf7445d06cf2
SHA256: cb79c41f89691fefc91c863e408724848afbf0fce1ddb1e38d555e1c8c376e53
SSDeep: 196608:4c4TZuMZ+WFBqHBappU/0WYBVJVyvm9zX92xj/GCOYLF55+mS5EinqOC:LWZHZ+WFBqHBaBWorVyvmxwjeCpzQEiM 		False
...
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml 0.81 KB MD5: 7c26dabf1e24352f571ad2d2e58985e9
SHA1: 897c00ae219d13424c5e127854b1cbab17e20c74
SHA256: 237fada922a6d1acc3820076a84fa1d301243e71ed0fdd310a9c8720e389649e
SSDeep: 24:0xEQZtc95PQsMtxow6P+kD5CSuemERTU7:KXZu7PctB6GkD53tmERTU7 		False
...
C:\$Recycle.Bin\S-1-5-21-3785418085-2572485238-895829336-1000\desktop.ini 0.16 KB MD5: 62584d21b3e239c493328f470c42fcae
SHA1: 3099f10c7eba34e8d22bbada31929ce380e18cd9
SHA256: 08b48f85698c3414729f5d3b0bf96656dc154369429f2466141fc0af368bf1f2
SSDeep: 3:yPD8FAcbf6rAIktpakvgdYBybxeu0r7vkkSrHNVPjhL6ItShfOox:qD8FAcLHt0Bcydx0r7QlfQhfOox 		False
...
Threads
Thread 0x9dc
14279 0
»
Category Operation Information Success Count Logfile
Environment Get Environment String name = COR_ENABLE_PROFILING False 1
Fn
File Get Info filename = C:\Users\EEBsYm5\Desktop\README.txt, type = file_attributes False 1
Fn
File Create filename = C:\Users\EEBsYm5\Desktop\README.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\EEBsYm5\Desktop\README.txt, type = file_type True 2
Fn
File Create filename = C:\Users\EEBsYm5\Desktop\README.txt, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\EEBsYm5\Desktop\README.txt, type = file_type True 2
Fn
File Write filename = C:\Users\EEBsYm5\Desktop\README.txt, size = 1090 True 1
Fn
Data
File Get Info filename = C:\, type = file_attributes True 1
Fn
File Get Info filename = C:\autoexec.bat, type = file_attributes True 1
Fn
File Create filename = C:\autoexec.bat, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\autoexec.bat, type = file_type True 2
Fn
File Get Info filename = C:\autoexec.bat, type = size, size_out = 0 True 1
Fn
File Read filename = C:\autoexec.bat, size = 4096, size_out = 24 True 1
Fn
Data
File Create filename = C:\autoexec.bat, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\autoexec.bat, type = file_type True 2
Fn
File Write filename = C:\autoexec.bat, size = 48 True 1
Fn
Data
File Get Info filename = C:\autoexec.bat, type = file_attributes True 1
Fn
File Move source_filename = C:\autoexec.bat, destination_filename = C:\6175746F657865632E626174 True 1
Fn
File Create filename = C:\Users\EEBsYm5\Desktop\ay51Ul3dhjfU6GvDPUfZKdAzJqGGZVCwkfjiPR0D.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Users\EEBsYm5\Desktop\ay51Ul3dhjfU6GvDPUfZKdAzJqGGZVCwkfjiPR0D.txt, type = file_type True 2
Fn
File Create filename = C:\Users\EEBsYm5\Desktop\ay51Ul3dhjfU6GvDPUfZKdAzJqGGZVCwkfjiPR0D.txt, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Users\EEBsYm5\Desktop\ay51Ul3dhjfU6GvDPUfZKdAzJqGGZVCwkfjiPR0D.txt, type = file_type True 2
Fn
File Write filename = C:\Users\EEBsYm5\Desktop\ay51Ul3dhjfU6GvDPUfZKdAzJqGGZVCwkfjiPR0D.txt, size = 152 True 1
Fn
Data
File Get Info filename = C:\BOOTSECT.BAK, type = file_attributes True 1
Fn
File Create filename = C:\BOOTSECT.BAK, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\BOOTSECT.BAK, type = file_type True 2
Fn
File Get Info filename = C:\BOOTSECT.BAK, type = size, size_out = 0 True 1
Fn
File Read filename = C:\BOOTSECT.BAK, size = 8192, size_out = 8192 True 1
Fn
Data
File Create filename = C:\BOOTSECT.BAK, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\BOOTSECT.BAK, type = file_type True 2
Fn
File Write filename = C:\BOOTSECT.BAK, size = 8224 True 1
Fn
Data
File Get Info filename = C:\BOOTSECT.BAK, type = file_attributes True 1
Fn
File Move source_filename = C:\BOOTSECT.BAK, destination_filename = C:\424F4F54534543542E42414B True 1
Fn
File Get Info filename = C:\config.sys, type = file_attributes True 1
Fn
File Create filename = C:\config.sys, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\config.sys, type = file_type True 2
Fn
File Get Info filename = C:\config.sys, type = size, size_out = 0 True 1
Fn
File Read filename = C:\config.sys, size = 4096, size_out = 10 True 1
Fn
Data
File Create filename = C:\config.sys, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\config.sys, type = file_type True 2
Fn
File Write filename = C:\config.sys, size = 32 True 1
Fn
Data
File Get Info filename = C:\config.sys, type = file_attributes True 1
Fn
File Move source_filename = C:\config.sys, destination_filename = C:\636F6E6669672E737973 True 1
Fn
File Get Info filename = C:\README.txt, type = file_attributes False 2
Fn
File Create filename = C:\README.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\README.txt, type = file_type True 2
Fn
File Create filename = C:\README.txt, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\README.txt, type = file_type True 2
Fn
File Write filename = C:\README.txt, size = 1090 True 1
Fn
Data
File Get Info filename = C:\$Recycle.Bin\README.txt, type = file_attributes False 2
Fn
File Create filename = C:\$Recycle.Bin\README.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\$Recycle.Bin\README.txt, type = file_type True 2
Fn
File Create filename = C:\$Recycle.Bin\README.txt, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\$Recycle.Bin\README.txt, type = file_type True 2
Fn
File Write filename = C:\$Recycle.Bin\README.txt, size = 1090 True 1
Fn
Data
File Get Info filename = C:\$Recycle.Bin\S-1-5-21-3785418085-2572485238-895829336-1000\desktop.ini, type = file_attributes True 1
Fn
File Create filename = C:\$Recycle.Bin\S-1-5-21-3785418085-2572485238-895829336-1000\desktop.ini, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\$Recycle.Bin\S-1-5-21-3785418085-2572485238-895829336-1000\desktop.ini, type = file_type True 2
Fn
File Get Info filename = C:\$Recycle.Bin\S-1-5-21-3785418085-2572485238-895829336-1000\desktop.ini, type = size, size_out = 0 True 1
Fn
File Read filename = C:\$Recycle.Bin\S-1-5-21-3785418085-2572485238-895829336-1000\desktop.ini, size = 4096, size_out = 129 True 1
Fn
Data
File Create filename = C:\$Recycle.Bin\S-1-5-21-3785418085-2572485238-895829336-1000\desktop.ini, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\$Recycle.Bin\S-1-5-21-3785418085-2572485238-895829336-1000\desktop.ini, type = file_type True 2
Fn
File Write filename = C:\$Recycle.Bin\S-1-5-21-3785418085-2572485238-895829336-1000\desktop.ini, size = 160 True 1
Fn
Data
File Get Info filename = C:\$Recycle.Bin\S-1-5-21-3785418085-2572485238-895829336-1000\desktop.ini, type = file_attributes True 1
Fn
File Move source_filename = C:\$Recycle.Bin\S-1-5-21-3785418085-2572485238-895829336-1000\desktop.ini, destination_filename = C:\$Recycle.Bin\S-1-5-21-3785418085-2572485238-895829336-1000\6465736B746F702E696E69 True 1
Fn
File Get Info filename = C:\README.txt, type = file_attributes True 1
Fn
File Get Info filename = C:\Boot\BCD, type = file_attributes True 1
Fn
File Create filename = C:\Boot\BCD, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 1
Fn
File Get Info filename = C:\Boot\BCD.LOG, type = file_attributes True 1
Fn
File Create filename = C:\Boot\BCD.LOG, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ False 1
Fn
File Get Info filename = C:\Boot\BCD.LOG1, type = file_attributes True 2
Fn
File Move source_filename = C:\Boot\BCD.LOG1, destination_filename = C:\Boot\4243442E4C4F4731 True 1
Fn
File Get Info filename = C:\Boot\BCD.LOG2, type = file_attributes True 2
Fn
File Move source_filename = C:\Boot\BCD.LOG2, destination_filename = C:\Boot\4243442E4C4F4732 True 1
Fn
File Get Info filename = C:\Boot\BOOTSTAT.DAT, type = file_attributes True 1
Fn
File Create filename = C:\Boot\BOOTSTAT.DAT, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Boot\BOOTSTAT.DAT, type = file_type True 2
Fn
File Get Info filename = C:\Boot\BOOTSTAT.DAT, type = size, size_out = 0 True 1
Fn
File Read filename = C:\Boot\BOOTSTAT.DAT, size = 65536, size_out = 65536 True 1
Fn
Data
File Create filename = C:\Boot\BOOTSTAT.DAT, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Boot\BOOTSTAT.DAT, type = file_type True 2
Fn
File Write filename = C:\Boot\BOOTSTAT.DAT, size = 65568 True 1
Fn
Data
File Get Info filename = C:\Boot\BOOTSTAT.DAT, type = file_attributes True 1
Fn
File Move source_filename = C:\Boot\BOOTSTAT.DAT, destination_filename = C:\Boot\424F4F54535441542E444154 True 1
Fn
File Get Info filename = C:\Boot\README.txt, type = file_attributes False 2
Fn
File Create filename = C:\Boot\README.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\Boot\README.txt, type = file_type True 2
Fn
File Create filename = C:\Boot\README.txt, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\Boot\README.txt, type = file_type True 2
Fn
File Write filename = C:\Boot\README.txt, size = 1090 True 1
Fn
Data
File Get Info filename = C:\Boot\README.txt, type = file_attributes True 4
Fn
File Get Info filename = C:\Boot\README.txt, type = file_attributes True 3
Fn
File Get Info filename = C:\Boot\README.txt, type = file_attributes True 16
Fn
File Get Info filename = C:\README.txt, type = file_attributes True 2
Fn
File Get Info filename = C:\MSOCache\README.txt, type = file_attributes False 2
Fn
File Create filename = C:\MSOCache\README.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\README.txt, type = file_type True 2
Fn
File Create filename = C:\MSOCache\README.txt, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\README.txt, type = file_type True 2
Fn
File Write filename = C:\MSOCache\README.txt, size = 1090 True 1
Fn
Data
File Get Info filename = C:\MSOCache\All Users\README.txt, type = file_attributes False 2
Fn
File Create filename = C:\MSOCache\All Users\README.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\README.txt, type = file_type True 2
Fn
File Create filename = C:\MSOCache\All Users\README.txt, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\README.txt, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\README.txt, size = 1090 True 1
Fn
Data
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab, type = file_type True 2
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab, size = 10262163, size_out = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab, size = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab, size = 10262192 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab, destination_filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\457863656C4C522E636162 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi, size = 1802240, size_out = 1802240 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi, size = 1802272 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi, destination_filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\457863656C4D55492E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml, size = 4096, size_out = 1565 True 1
Fn
Data
File Create filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml, size = 1584 True 1
Fn
Data
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml, destination_filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\457863656C4D55492E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml, size = 4096, size_out = 2296 True 1
Fn
Data
File Create filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml, size = 2320 True 1
Fn
Data
File Get Info filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml, destination_filename = C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\53657475702E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\README.txt, type = file_attributes True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi, size = 1800704, size_out = 1800704 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi, size = 1800736 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi, destination_filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\506F776572506F696E744D55492E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml, size = 4096, size_out = 1557 True 1
Fn
Data
File Create filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml, size = 1584 True 1
Fn
Data
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml, destination_filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\506F776572506F696E744D55492E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab, type = file_type True 2
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab, size = 10262163, size_out = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab, size = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab, size = 10262192 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab, destination_filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\5070744C522E636162 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml, size = 4096, size_out = 1886 True 1
Fn
Data
File Create filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml, size = 1904 True 1
Fn
Data
File Get Info filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml, destination_filename = C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\53657475702E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\README.txt, type = file_attributes True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi, size = 1810944, size_out = 1810944 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi, size = 1810976 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi, destination_filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\5075626C69736865724D55492E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml, size = 4096, size_out = 1450 True 1
Fn
Data
File Create filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml, size = 1472 True 1
Fn
Data
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml, destination_filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\5075626C69736865724D55492E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab, size = 9955228, size_out = 9955228 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab, size = 9955248 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab, destination_filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\5075624C522E636162 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml, size = 4096, size_out = 1608 True 1
Fn
Data
File Create filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml, size = 1632 True 1
Fn
Data
File Get Info filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml, destination_filename = C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\53657475702E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\README.txt, type = file_attributes True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab, type = file_type True 2
Fn
File Read filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab, size = 10262163, size_out = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab, size = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab, size = 10262192 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab, destination_filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\4F75746C6B4C522E636162 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi, size = 2115584, size_out = 2115584 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi, size = 2115616 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi, destination_filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\4F75746C6F6F6B4D55492E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml, size = 4096, size_out = 3186 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml, size = 3216 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml, destination_filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\4F75746C6F6F6B4D55492E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml, size = 4207, size_out = 4207 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml, size = 4224 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml, destination_filename = C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\53657475702E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\README.txt, type = file_attributes True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml, size = 4096, size_out = 2424 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml, size = 2448 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml, destination_filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\53657475702E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab, type = file_type True 2
Fn
File Read filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab, size = 10262163, size_out = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab, size = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab, size = 10262192 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab, destination_filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\576F72644C522E636162 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi, size = 1819648, size_out = 1819648 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi, size = 1819680 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi, destination_filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\576F72644D55492E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml, size = 4096, size_out = 1800 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml, size = 1824 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml, destination_filename = C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\576F72644D55492E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\README.txt, type = file_attributes True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi, size = 650240, size_out = 650240 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi, size = 650272 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi, destination_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\50726F6F66696E672E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml, size = 4096, size_out = 811 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml, size = 832 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml, destination_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\50726F6F66696E672E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml, size = 5884, size_out = 5884 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml, size = 5904 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml, destination_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\53657475702E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\README.txt, type = file_attributes False 2
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\README.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\README.txt, type = file_type True 2
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\README.txt, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\README.txt, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\README.txt, size = 1090 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab, type = file_type True 2
Fn
File Read filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab, size = 10262163, size_out = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab, size = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab, size = 10262192 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab, destination_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\50726F6F662E636162 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi, size = 656896, size_out = 656896 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi, size = 656928 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi, destination_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\50726F6F662E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml, size = 4096, size_out = 1347 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml, size = 1376 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml, destination_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\50726F6F662E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\README.txt, type = file_attributes True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab, type = file_type True 2
Fn
File Read filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab, size = 10262163, size_out = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab, size = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab, size = 10262192 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab, destination_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\50726F6F662E636162 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi, size = 663040, size_out = 663040 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi, size = 663072 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi, destination_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\50726F6F662E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml, size = 4096, size_out = 1457 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml, size = 1488 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml, destination_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\50726F6F662E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\README.txt, type = file_attributes True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab, type = file_type True 2
Fn
File Read filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab, size = 10262163, size_out = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab, size = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab, size = 10262192 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab, destination_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\50726F6F662E636162 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi, size = 667648, size_out = 667648 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi, size = 667680 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi, destination_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\50726F6F662E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml, size = 4096, size_out = 1458 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml, size = 1488 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml, destination_filename = C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\50726F6F662E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\README.txt, type = file_attributes True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab, type = file_type True 2
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab, size = 10262163, size_out = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab, size = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab, size = 10262192 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab, destination_filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\496E664C522E636162 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi, size = 2413568, size_out = 2413568 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi, size = 2413600 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi, destination_filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\496E666F506174684D55492E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml, size = 4096, size_out = 1231 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml, size = 1248 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.xml, destination_filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\496E666F506174684D55492E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Setup.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Setup.xml, size = 4096, size_out = 1852 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Setup.xml, size = 1872 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Setup.xml, destination_filename = C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\53657475702E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\README.txt, type = file_attributes True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\Setup.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\Setup.xml, size = 6241, size_out = 6241 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\Setup.xml, size = 6272 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\Setup.xml, destination_filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\53657475702E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioLR.cab, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioLR.cab, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioLR.cab, type = file_type True 2
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioLR.cab, size = 10262163, size_out = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioLR.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioLR.cab, size = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioLR.cab, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioLR.cab, size = 10262192 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioLR.cab, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioLR.cab, destination_filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\566973696F4C522E636162 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.msi, size = 2087424, size_out = 2087424 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.msi, size = 2087456 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.msi, destination_filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\566973696F4D55492E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.xml, size = 9502, size_out = 9502 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.xml, size = 9520 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\VisioMUI.xml, destination_filename = C:\MSOCache\All Users\{90140000-0054-0409-0000-0000000FF1CE}-C\566973696F4D55492E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\README.txt, type = file_attributes True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi, size = 1800704, size_out = 1800704 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi, size = 1800736 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi, destination_filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\4F6E654E6F74654D55492E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml, size = 4096, size_out = 1606 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml, size = 1632 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml, destination_filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\4F6E654E6F74654D55492E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab, type = file_type True 2
Fn
File Read filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab, size = 10262163, size_out = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab, size = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab, size = 10262192 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab, destination_filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\4F6E6F74654C522E636162 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml, size = 4096, size_out = 1988 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml, size = 2016 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml, destination_filename = C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\53657475702E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\README.txt, type = file_attributes True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.msi, size = 1807360, size_out = 1807360 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.msi, size = 1807392 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.msi, destination_filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\50726F6A6563744D55492E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.xml, size = 4096, size_out = 1451 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.xml, size = 1472 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjectMUI.xml, destination_filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\50726F6A6563744D55492E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjLR.cab, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjLR.cab, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjLR.cab, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjLR.cab, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjLR.cab, size = 8264773, size_out = 8264773 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjLR.cab, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjLR.cab, size = 8264800 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjLR.cab, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\ProjLR.cab, destination_filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\50726F6A4C522E636162 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\Setup.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\Setup.xml, size = 4096, size_out = 1872 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\Setup.xml, size = 1904 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\Setup.xml, destination_filename = C:\MSOCache\All Users\{90140000-00B4-0409-0000-0000000FF1CE}-C\53657475702E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\README.txt, type = file_attributes True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab, size = 4095293, size_out = 4095293 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab, size = 4095312 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab, destination_filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\47726F6F76654C522E636162 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi, size = 1804800, size_out = 1804800 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi, size = 1804832 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi, destination_filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\47726F6F76654D55492E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml, size = 4096, size_out = 913 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml, size = 944 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml, destination_filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\47726F6F76654D55492E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml, size = 4096, size_out = 1452 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml, size = 1472 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml, destination_filename = C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\53657475702E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\README.txt, type = file_attributes True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml, size = 596341, size_out = 596341 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml, size = 596368 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\6272616E64696E672E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE, size = 838536, size_out = 838536 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE, size = 838560 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\445732302E455845 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll, size = 526176, size_out = 526176 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll, size = 526208 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\647764637732302E646C6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe, size = 519584, size_out = 519584 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe, size = 519616 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\64777472696732302E657865 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest, size = 4096, size_out = 1857 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest, size = 1888 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\4D6963726F736F66742E564339302E4352542E6D616E6966657374 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll, size = 655872, size_out = 655872 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll, size = 655904 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\6D7376637239302E646C6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab, type = file_type True 2
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab, size = 10262163, size_out = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab, size = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab, size = 10262192 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\4F66666963654C522E636162 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi, size = 2863104, size_out = 2863104 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi, size = 2863136 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\4F66666963654D55492E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml, size = 5662, size_out = 5662 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml, size = 5680 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\4F66666963654D55492E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi, size = 650240, size_out = 650240 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi, size = 650272 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\4F66666963654D55495365742E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml, size = 4096, size_out = 819 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml, size = 848 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\4F66666963654D55495365742E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll, size = 191872, size_out = 191872 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll, size = 191904 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\6F736574757075692E646C6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm, size = 27195, size_out = 27195 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm, size = 27216 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\7073733130722E63686D True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm, size = 67190, size_out = 67190 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm, size = 67216 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\73657475702E63686D True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml, size = 9598, size_out = 9598 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml, size = 9616 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\53657475702E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST, size = 4096, size_out = 3584 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST, size = 3616 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\5368656C6C55492E4D5354 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\README.txt, type = file_attributes False 2
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\README.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\README.txt, type = file_type True 2
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\README.txt, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\README.txt, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\README.txt, size = 1090 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll, size = 107912, size_out = 107912 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll, size = 107936 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll, destination_filename = C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\6477696E746C32302E646C6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\README.txt, type = file_attributes True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.msi, size = 650240, size_out = 650240 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.msi, size = 650272 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.msi, destination_filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\4163636573734D55495365742E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml, size = 4096, size_out = 819 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml, size = 848 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\AccessMUISet.xml, destination_filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\4163636573734D55495365742E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Setup.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Setup.xml, size = 4096, size_out = 2624 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Setup.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Setup.xml, size = 2656 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Setup.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Setup.xml, destination_filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\53657475702E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\README.txt, type = file_attributes False 2
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\README.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\README.txt, type = file_type True 2
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\README.txt, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\README.txt, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\README.txt, size = 1090 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi, size = 1813504, size_out = 1813504 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi, size = 1813536 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi, destination_filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\4163636573734D55492E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml, size = 4096, size_out = 1349 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml, size = 1376 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml, destination_filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\4163636573734D55492E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccLR.cab, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccLR.cab, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccLR.cab, type = file_type True 2
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccLR.cab, size = 10262163, size_out = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccLR.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccLR.cab, size = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccLR.cab, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccLR.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccLR.cab, size = 10262192 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccLR.cab, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccLR.cab, destination_filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\4163634C522E636162 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\branding.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\branding.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\branding.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\branding.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\branding.xml, size = 596341, size_out = 596341 True 1
Fn
File Create filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\branding.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\branding.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\branding.xml, size = 596368 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\branding.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\branding.xml, destination_filename = C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\6272616E64696E672E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\README.txt, type = file_attributes True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi, size = 3025408, size_out = 3025408 True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi, size = 3025440 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi, destination_filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\4F6666696365363457572E6D7369 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml, size = 4685, size_out = 4685 True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml, size = 4704 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml, destination_filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\4F6666696365363457572E786D6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ose.exe, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ose.exe, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ose.exe, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ose.exe, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ose.exe, size = 149352, size_out = 149352 True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ose.exe, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ose.exe, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ose.exe, size = 149376 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ose.exe, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ose.exe, destination_filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\6F73652E657865 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll, size = 5789544, size_out = 5789544 True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll, size = 5789568 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll, destination_filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\6F73657475702E646C6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab, type = file_type True 2
Fn
File Read filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab, size = 10262163, size_out = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab, size = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab, size = 10262192 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab, destination_filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\4F574F57363457572E636162 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll, size = 1248016, size_out = 1248016 True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll, size = 1248048 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll, destination_filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\50696447656E582E646C6C True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms, type = file_type True 2
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms, type = size, size_out = 0 True 1
Fn
File Read filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms, size = 715834, size_out = 715834 True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms, desired_access = GENERIC_WRITE, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms, type = file_type True 2
Fn
File Write filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms, size = 715856 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms, type = file_attributes True 1
Fn
File Move source_filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms, destination_filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\706B6579636F6E6669672D6F66666963652E78726D2D6D73 True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ProPlusrWW.msi, type = file_attributes True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ProPlusrWW.msi, desired_access = GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL, share_mode = FILE_SHARE_READ True 1
Fn
File Get Info filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ProPlusrWW.msi, type = file_type True 2
Fn
File Read filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ProPlusrWW.msi, size = 10262163, size_out = 10262163 True 1
Fn
File Create filename = C:\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ProPlusrWW.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_OPEN_NO_RECALL True 1
Fn
For performance reasons, the remaining 9937 entries are omitted.
The remaining entries can be found in glog.xml.
Thread 0xa04
9 0
»
Category Operation Information Success Count Logfile
System Sleep duration = 1 milliseconds (0.001 seconds) True 9
Fn
Thread 0xa08
31 0
»
Category Operation Information Success Count Logfile
System Sleep duration = 500 milliseconds (0.500 seconds) True 1
Fn
System Sleep duration = 1000 milliseconds (1.000 seconds) True 224
Fn
System Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
Thread 0xa0c
30 0
»
Category Operation Information Success Count Logfile
System Sleep duration = 1000 milliseconds (1.000 seconds) True 225
Fn
System Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image