ab5b8853...1e5f | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Ransomware

R1.exe

Windows Exe (x86-32)

Created at 2019-07-08T14:39:00

...

Remarks (1/1)

(0x200000e): The overall sleep time of all monitored processes was truncated from "8 minutes, 20 seconds" to "1 minute, 40 seconds" to reveal dormant functionality.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0x9c8 Analysis Target High (Elevated) r1.exe "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\R1.exe" -
#2 0x810 Child Process High (Elevated) taskkill.exe "C:\Windows\System32\taskkill.exe" /IM destroyed_words.exe /F #1
#3 0x56c Child Process High (Elevated) net.exe "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y #1
#4 0x80c Child Process High (Elevated) net.exe "C:\Windows\System32\net.exe" stop "samss" /y #1
#5 0x9a4 Child Process High (Elevated) net1.exe C:\Windows\system32\net1 stop "audioendpointbuilder" /y #3
#6 0x918 Child Process High (Elevated) net1.exe C:\Windows\system32\net1 stop "samss" /y #4
#8 0x1b74 Child Process High (Elevated) net.exe "C:\Windows\System32\net.exe" stop "samss" /y #1
#9 0x1c80 Child Process High (Elevated) net1.exe C:\Windows\system32\net1 stop "samss" /y #8
#10 0x3744 Child Process High (Elevated) net.exe "C:\Windows\System32\net.exe" stop "samss" /y #1
#11 0x3914 Child Process High (Elevated) net1.exe C:\Windows\system32\net1 stop "samss" /y #10
#12 0x5150 Child Process High (Elevated) net.exe "C:\Windows\System32\net.exe" stop "samss" /y #1
#13 0x5314 Child Process High (Elevated) net1.exe C:\Windows\system32\net1 stop "samss" /y #12
#14 0x61fc Child Process High (Elevated) net.exe "C:\Windows\System32\net.exe" stop "samss" /y #1
#15 0x6260 Child Process High (Elevated) net1.exe C:\Windows\system32\net1 stop "samss" /y #14
#16 0x75b0 Child Process High (Elevated) net.exe "C:\Windows\System32\net.exe" stop "samss" /y #1
#17 0x7718 Child Process High (Elevated) net1.exe C:\Windows\system32\net1 stop "samss" /y #16
#18 0x8ab4 Child Process High (Elevated) net.exe "C:\Windows\System32\net.exe" stop "samss" /y #1
#19 0x8be0 Child Process High (Elevated) net1.exe C:\Windows\system32\net1 stop "samss" /y #18
#20 0xa1dc Child Process High (Elevated) net.exe "C:\Windows\System32\net.exe" stop "samss" /y #1
#21 0xa4ec Child Process High (Elevated) net1.exe C:\Windows\system32\net1 stop "samss" /y #20
#22 0xb6a4 Child Process High (Elevated) net.exe "C:\Windows\System32\net.exe" stop "samss" /y #1
#23 0xb888 Child Process High (Elevated) net1.exe C:\Windows\system32\net1 stop "samss" /y #22
#24 0xc3a4 Child Process High (Elevated) net.exe "C:\Windows\System32\net.exe" stop "samss" /y #1
#25 0xc47c Child Process High (Elevated) net1.exe C:\Windows\system32\net1 stop "samss" /y #24

Behavior Information - Grouped by Category

Process #1: r1.exe
75597 0
»
Information Value
ID #1
File Name c:\users\5p5nrgjn0js halpmcxz\desktop\r1.exe
Command Line "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\R1.exe"
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:26, Reason: Analysis Target
Unmonitor End Time: 00:02:18, Reason: Terminated by Timeout
Monitor Duration 00:01:52
OS Process Information
»
Information Value
PID 0x9c8
Parent PID 0x45c (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 9CC
0x 9D0
0x 9DC
0x 9E0
0x 9E4
0x 9E8
0x 9EC
0x 9F0
0x 9F4
0x 9F8
0x 9FC
0x A00
0x A04
0x A08
0x A0C
0x A10
0x A14
0x A18
0x A1C
0x A20
0x A24
0x A28
0x A2C
0x A30
0x A34
0x A38
0x A3C
0x A40
0x A44
0x A48
0x A4C
0x A50
0x A54
0x A58
0x A5C
0x A60
0x A64
0x A68
0x A6C
0x A70
0x A74
0x A78
0x A7C
0x A80
0x A84
0x A88
0x A8C
0x A90
0x A94
0x A98
0x A9C
0x AA0
0x AA4
0x AA8
0x AAC
0x AB0
0x AB4
0x AB8
0x ABC
0x AC0
0x AC4
0x AC8
0x ACC
0x AD0
0x AD4
0x AD8
0x ADC
0x AE0
0x AE4
0x AE8
0x AEC
0x AF0
0x AF4
0x AF8
0x AFC
0x B00
0x B04
0x B08
0x B0C
0x B10
0x B14
0x B18
0x B1C
0x B20
0x B24
0x B28
0x B2C
0x B30
0x B34
0x B38
0x B3C
0x B40
0x B44
0x B48
0x B4C
0x B50
0x B54
0x B58
0x B5C
0x B60
0x B64
0x B68
0x B6C
0x B70
0x B74
0x B78
0x B7C
0x B80
0x B84
0x B88
0x B8C
0x B90
0x B94
0x B98
0x B9C
0x BA0
0x BA4
0x BA8
0x BAC
0x BB0
0x BB4
0x BB8
0x BBC
0x BC0
0x BC4
0x BC8
0x BCC
0x BD0
0x BD4
0x BD8
0x BDC
0x BE0
0x BE4
0x BE8
0x BEC
0x BF0
0x BF4
0x BF8
0x BFC
0x 288
0x 2A8
0x 2B0
0x 6EC
0x 664
0x 694
0x 6B4
0x 81C
0x 818
0x 814
0x 6A8
0x 5E4
0x 5C4
0x 358
0x 5D0
0x 86C
0x 534
0x 6F8
0x 788
0x 444
0x 244
0x 598
0x 35C
0x 898
0x 8B0
0x 8AC
0x 8A4
0x 8A0
0x 8D0
0x 8FC
0x 8D8
0x 8DC
0x 8D4
0x 8CC
0x 890
0x 8A8
0x 508
0x 8C8
0x 8C4
0x 8C0
0x 8BC
0x 8B8
0x 4A4
0x 8B4
0x 900
0x 908
0x 85C
0x 84C
0x 854
0x 858
0x 860
0x 868
0x 888
0x 884
0x 880
0x 87C
0x 878
0x 910
0x 7EC
0x 59C
0x 78C
0x 62C
0x 318
0x 92C
0x 93C
0x 948
0x 98C
0x 928
0x 988
0x 984
0x 980
0x 96C
0x 9C4
0x 90C
0x 924
0x 874
0x 33C
0x 9D4
0x 9D8
0x 9E0
0x 870
0x 6A8
0x 440
0x 84C
0x B0
0x 240
0x 99C
0x 9C0
0x 958
0x 998
0x 7E4
0x 95C
0x 9BC
0x 774
0x 9B0
0x 9B4
0x 9B8
0x 9AC
0x 990
0x 994
0x 974
0x 3D0
0x 934
0x 7A0
0x 938
0x C04
0x C08
0x C0C
0x C10
0x C14
0x C18
0x C1C
0x C20
0x C24
0x C28
0x C2C
0x C30
0x C34
0x C38
0x C3C
0x C40
0x C44
0x C48
0x C50
0x C54
0x C58
0x C5C
0x C60
0x C64
0x C68
0x C74
0x C78
0x C7C
0x C80
0x C84
0x C88
0x C8C
0x C90
0x C94
0x C98
0x C9C
0x CA0
0x CA4
0x CA8
0x CAC
0x CB0
0x CB4
0x CB8
0x CBC
0x CC0
0x CC4
0x CC8
0x CCC
0x CD0
0x CD4
0x CD8
0x CDC
0x CE0
0x CE4
0x CE8
0x CEC
0x CF0
0x CF4
0x CF8
0x CFC
0x D00
0x D04
0x D08
0x D0C
0x D14
0x D18
0x D1C
0x D20
0x D24
0x D28
0x D34
0x D38
0x D3C
0x D40
0x D44
0x D48
0x D4C
0x D50
0x D54
0x D58
0x D5C
0x D60
0x D64
0x D68
0x D6C
0x D70
0x D74
0x D78
0x D7C
0x D80
0x D84
0x D88
0x D8C
0x D90
0x D94
0x D98
0x D9C
0x DA4
0x DA8
0x DBC
0x DC0
0x DC4
0x DC8
0x DCC
0x DD0
0x DD4
0x DD8
0x DDC
0x DE0
0x DE4
0x DE8
0x DEC
0x DF0
0x DF4
0x DF8
0x DFC
0x E00
0x E04
0x E08
0x E0C
0x E10
0x E14
0x E18
0x E1C
0x E20
0x E2C
0x E30
0x E34
0x E38
0x E3C
0x E40
0x E44
0x E48
0x E50
0x E54
0x E58
0x E5C
0x E60
0x E64
0x E68
0x E6C
0x E70
0x E7C
0x E80
0x E84
0x E88
0x E8C
0x E90
0x E94
0x E98
0x E9C
0x EA0
0x EA4
0x EA8
0x EAC
0x EB0
0x EB4
0x EC0
0x EC4
0x EC8
0x ECC
0x ED0
0x ED4
0x ED8
0x EDC
0x EE0
0x EE4
0x EEC
0x EF0
0x EF4
0x EF8
0x EFC
0x F00
0x F04
0x F08
0x F0C
0x F10
0x F14
0x F18
0x F1C
0x F20
0x F24
0x F28
0x F2C
0x F30
0x F34
0x F38
0x F3C
0x F40
0x F44
0x F48
0x F4C
0x F50
0x F54
0x F58
0x F5C
0x F60
0x F64
0x F68
0x F6C
0x F70
0x F74
0x F78
0x F7C
0x F80
0x F84
0x F88
0x F8C
0x F90
0x F9C
0x FA0
0x FA4
0x FA8
0x FAC
0x FB0
0x FB4
0x FB8
0x FBC
0x FC0
0x FC4
0x FC8
0x FCC
0x FD0
0x FD4
0x FD8
0x FDC
0x FE0
0x FE4
0x FE8
0x FEC
0x FF8
0x FFC
0x 3A4
0x 9A8
0x 970
0x 918
0x 80C
0x 780
0x D10
0x D2C
0x 920
0x 3C4
0x 3B8
0x 97C
0x 960
0x 63C
0x 3AC
0x 3B4
0x C4C
0x D30
0x 3A8
0x 5CC
0x 11C
0x C4
0x 37C
0x 380
0x F94
0x 798
0x FF0
0x FF4
0x C6C
0x C70
0x 274
0x C0
0x 94C
0x 978
0x 4F0
0x 810
0x 41C
0x 1004
0x 1008
0x 100C
0x 1010
0x 1014
0x 1018
0x 101C
0x 1020
0x 1024
0x 1028
0x 102C
0x 1030
0x 1034
0x 1038
0x 103C
0x 1040
0x 1044
0x 1048
0x 104C
0x 1050
0x 1054
0x 1058
0x 105C
0x 1060
0x 1064
0x 1068
0x 106C
0x 1070
0x 1074
0x 1078
0x 107C
0x 1080
0x 1084
0x 1088
0x 108C
0x 1090
0x 1094
0x 1098
0x 109C
0x 10A0
0x 10A4
0x 10A8
0x 10AC
0x 10B0
0x 10B4
0x 10B8
0x 10BC
0x 10C0
0x 10C4
0x 10C8
0x 10CC
0x 10D0
0x 10D4
0x 10D8
0x 10DC
0x 10E0
0x 10E4
0x 10E8
0x 10EC
0x 10F0
0x 10F4
0x 10F8
0x 10FC
0x 1100
0x 1104
0x 1108
0x 110C
0x 1110
0x 1114
0x 1118
0x 111C
0x 1120
0x 1124
0x 1128
0x 112C
0x 1130
0x 1134
0x 1138
0x 113C
0x 1140
0x 1144
0x 1148
0x 114C
0x 1150
0x 1154
0x 1158
0x 115C
0x 1160
0x 1164
0x 1168
0x 116C
0x 1170
0x 1174
0x 1178
0x 117C
0x 1180
0x 1184
0x 1188
0x 118C
0x 1190
0x 1194
0x 1198
0x 119C
0x 11A0
0x 11A4
0x 11A8
0x 11AC
0x 11B0
0x 11B4
0x 11B8
0x 11BC
0x 11C0
0x 11C4
0x 11C8
0x 11CC
0x 11D0
0x 11D4
0x 11D8
0x 11DC
0x 11E0
0x 11E4
0x 11E8
0x 11EC
0x 11F0
0x 11F4
0x 11F8
0x 11FC
0x 1200
0x 1204
0x 1208
0x 120C
0x 1210
0x 1214
0x 1218
0x 121C
0x 1220
0x 1224
0x 1228
0x 122C
0x 1230
0x 1234
0x 1238
0x 123C
0x 1240
0x 1244
0x 1248
0x 124C
0x 1250
0x 1254
0x 1258
0x 125C
0x 1260
0x 1264
0x 1268
0x 126C
0x 1270
0x 1274
0x 1278
0x 127C
0x 1280
0x 1284
0x 1288
0x 128C
0x 1290
0x 1294
0x 1298
0x 129C
0x 12A0
0x 12A4
0x 12A8
0x 12AC
0x 12B0
0x 12B4
0x 12B8
0x 12BC
0x 12C0
0x 12C4
0x 12C8
0x 12CC
0x 12D0
0x 12D4
0x 12D8
0x 12DC
0x 12E0
0x 12E4
0x 12E8
0x 12EC
0x 12F0
0x 12F4
0x 12F8
0x 12FC
0x 1300
0x 1304
0x 1308
0x 130C
0x 1310
0x 1314
0x 1318
0x 131C
0x 1320
0x 1324
0x 1328
0x 132C
0x 1330
0x 1334
0x 1338
0x 133C
0x 1340
0x 1344
0x 1348
0x 134C
0x 1350
0x 1354
0x 1358
0x 135C
0x 1360
0x 1364
0x 1368
0x 136C
0x 1370
0x 1374
0x 1378
0x 137C
0x 1380
0x 1384
0x 1388
0x 138C
0x 1390
0x 1394
0x 1398
0x 139C
0x 13A0
0x 13A4
0x 13A8
0x 13AC
0x 13B0
0x 13B4
0x 13B8
0x 13BC
0x 13C0
0x 13C4
0x 13C8
0x 13CC
0x 13D0
0x 13D4
0x 13D8
0x 13DC
0x 13E0
0x 13E4
0x 13E8
0x 13EC
0x 13F0
0x 13F4
0x 13F8
0x 13FC
0x 6D0
0x 1404
0x 1408
0x 140C
0x 1410
0x 1414
0x 1418
0x 141C
0x 1420
0x 1424
0x 1428
0x 142C
0x 1430
0x 1434
0x 1438
0x 143C
0x 1440
0x 1444
0x 1448
0x 144C
0x 1450
0x 1454
0x 1458
0x 145C
0x 1460
0x 1464
0x 1468
0x 146C
0x 1470
0x 1474
0x 1478
0x 147C
0x 1480
0x 1484
0x 1488
0x 148C
0x 1490
0x 1494
0x 1498
0x 149C
0x 14A0
0x 14A4
0x 14A8
0x 14AC
0x 14B0
0x 14B4
0x 14B8
0x 14BC
0x 14C0
0x 14C4
0x 14C8
0x 14CC
0x 14D0
0x 14D4
0x 14D8
0x 14DC
0x 14E0
0x 14E4
0x 14E8
0x 14EC
0x 14F0
0x 14F4
0x 14F8
0x 14FC
0x 1500
0x 1504
0x 1508
0x 150C
0x 1510
0x 1514
0x 1518
0x 151C
0x 1520
0x 1524
0x 1528
0x 152C
0x 1530
0x 1534
0x 1538
0x 153C
0x 1540
0x 1544
0x 1548
0x 154C
0x 1550
0x 1554
0x 1558
0x 155C
0x 1560
0x 1564
0x 1568
0x 156C
0x 1570
0x 1574
0x 1578
0x 157C
0x 1580
0x 1584
0x 1588
0x 158C
0x 1590
0x 1594
0x 1598
0x 159C
0x 15A0
0x 15A4
0x 15A8
0x 15AC
0x 15B0
0x 15B4
0x 15B8
0x 15BC
0x 15C0
0x 15C4
0x 15C8
0x 15CC
0x 15D0
0x 15D4
0x 15D8
0x 15DC
0x 15E0
0x 15E4
0x 15E8
0x 15EC
0x 15F0
0x 15F4
0x 15F8
0x 15FC
0x 1600
0x 1604
0x 1608
0x 160C
0x 1610
0x 1614
0x 1618
0x 161C
0x 1620
0x 1624
0x 1628
0x 162C
0x 1630
0x 1634
0x 1638
0x 163C
0x 1640
0x 1644
0x 1648
0x 164C
0x 1650
0x 1654
0x 1658
0x 165C
0x 1660
0x 1664
0x 1668
0x 166C
0x 1670
0x 1674
0x 1678
0x 167C
0x 1680
0x 1684
0x 1688
0x 168C
0x 1690
0x 1694
0x 1698
0x 169C
0x 16A0
0x 16A4
0x 16A8
0x 16AC
0x 16B0
0x 16B4
0x 16B8
0x 16BC
0x 16C0
0x 16C4
0x 16C8
0x 16CC
0x 16D0
0x 16D4
0x 16D8
0x 16DC
0x 16E0
0x 16E4
0x 16E8
0x 16EC
0x 16F0
0x 16F4
0x 16F8
0x 16FC
0x 1700
0x 1704
0x 1708
0x 170C
0x 1710
0x 1714
0x 1718
0x 171C
0x 1720
0x 1724
0x 1728
0x 172C
0x 1730
0x 1734
0x 1738
0x 173C
0x 1740
0x 1744
0x 1748
0x 174C
0x 1750
0x 1754
0x 1758
0x 175C
0x 1760
0x 1764
0x 1768
0x 176C
0x 1770
0x 1774
0x 1778
0x 177C
0x 1780
0x 1784
0x 1788
0x 178C
0x 1790
0x 1794
0x 1798
0x 179C
0x 17A0
0x 17A4
0x 17A8
0x 17AC
0x 17B0
0x 17B4
0x 17B8
0x 17BC
0x 17C0
0x 17C4
0x 17C8
0x 17CC
0x 17D0
0x 17D4
0x 17D8
0x 17DC
0x 17E0
0x 17E4
0x 17E8
0x 17EC
0x 17F0
0x 17F4
0x 17F8
0x 17FC
0x 944
0x 2AC
0x 5A4
0x 9A4
0x 570
0x 56C
0x 850
0x 88C
0x 1804
0x 1808
0x 180C
0x 1810
0x 1814
0x 1818
0x 181C
0x 1820
0x 1824
0x 1828
0x 182C
0x 1830
0x 1834
0x 1838
0x 183C
0x 1840
0x 1844
0x 1848
0x 184C
0x 1850
0x 1854
0x 1858
0x 185C
0x 1860
0x 1864
0x 1868
0x 186C
0x 1870
0x 1874
0x 1878
0x 187C
0x 1880
0x 1884
0x 1888
0x 188C
0x 1890
0x 1894
0x 1898
0x 189C
0x 18A0
0x 18A4
0x 18A8
0x 18AC
0x 18B0
0x 18B4
0x 18B8
0x 18BC
0x 18C0
0x 18C4
0x 18C8
0x 18CC
0x 18D0
0x 18D4
0x 18D8
0x 18DC
0x 18E0
0x 18E4
0x 18E8
0x 18EC
0x 18F0
0x 18F4
0x 18F8
0x 18FC
0x 1900
0x 1904
0x 1908
0x 190C
0x 1910
0x 1914
0x 1918
0x 191C
0x 1920
0x 1924
0x 1928
0x 192C
0x 1930
0x 1934
0x 1938
0x 193C
0x 1940
0x 1944
0x 1948
0x 194C
0x 1950
0x 1954
0x 1958
0x 195C
0x 1960
0x 1964
0x 1968
0x 196C
0x 1970
0x 1974
0x 1978
0x 197C
0x 1980
0x 1984
0x 1988
0x 198C
0x 1990
0x 1994
0x 1998
0x 199C
0x 19A0
0x 19A4
0x 19A8
0x 19AC
0x 19B0
0x 19B4
0x 19B8
0x 19BC
0x 19C0
0x 19C4
0x 19C8
0x 19CC
0x 19D0
0x 19D4
0x 19D8
0x 19DC
0x 19E0
0x 19E4
0x 19E8
0x 19EC
0x 19F0
0x 19F4
0x 19F8
0x 19FC
0x 1A00
0x 1A04
0x 1A08
0x 1A0C
0x 1A10
0x 1A14
0x 1A18
0x 1A1C
0x 1A20
0x 1A24
0x 1A28
0x 1A2C
0x 1A30
0x 1A34
0x 1A38
0x 1A3C
0x 1A40
0x 1A44
0x 1A48
0x 1A4C
0x 1A50
0x 1A54
0x 1A58
0x 1A5C
0x 1A60
0x 1A64
0x 1A68
0x 1A6C
0x 1A70
0x 1A74
0x 1A78
0x 1A7C
0x 1A80
0x 1A84
0x 1A88
0x 1A8C
0x 1A90
0x 1A94
0x 1A98
0x 1A9C
0x 1AA0
0x 1AA4
0x 1AA8
0x 1AAC
0x 1AB0
0x 1AB4
0x 1AB8
0x 1ABC
0x 1AC0
0x 1AC4
0x 1AC8
0x 1ACC
0x 1AD0
0x 1AD4
0x 1AD8
0x 1ADC
0x 1AE0
0x 1AE4
0x 1AE8
0x 1AEC
0x 1AF0
0x 1AF4
0x 1AF8
0x 1AFC
0x 1B00
0x 1B04
0x 1B08
0x 1B0C
0x 1B10
0x 1B14
0x 1B18
0x 1B1C
0x 1B20
0x 1B24
0x 1B28
0x 1B2C
0x 1B30
0x 1B34
0x 1B38
0x 1B3C
0x 1B40
0x 1B44
0x 1B48
0x 1B4C
0x 1B50
0x 1B54
0x 1B58
0x 1B5C
0x 1B60
0x 1B64
0x 1B68
0x 1B6C
0x 1B70
0x 1B7C
0x 1B80
0x 1B84
0x 1B88
0x 1B8C
0x 1B90
0x 1B94
0x 1B98
0x 1B9C
0x 1BA0
0x 1BA4
0x 1BA8
0x 1BAC
0x 1BB0
0x 1BB4
0x 1BB8
0x 1BBC
0x 1BC8
0x 1BCC
0x 1BD0
0x 1BD4
0x 1BD8
0x 1BDC
0x 1BE0
0x 1BE4
0x 1BE8
0x 1BEC
0x 1BF0
0x 1BF4
0x 1BF8
0x 1BFC
0x 1B70
0x 1C08
0x 1C0C
0x 1C10
0x 1C14
0x 1C18
0x 1C1C
0x 1C20
0x 1C24
0x 1C28
0x 1C2C
0x 1C30
0x 1C34
0x 1C38
0x 1C3C
0x 1C40
0x 1C44
0x 1C48
0x 1C4C
0x 1C50
0x 1C54
0x 1C58
0x 1C5C
0x 1C60
0x 1C64
0x 1C68
0x 1C6C
0x 1C70
0x 1C74
0x 1C78
0x 1C88
0x 1C8C
0x 1C90
0x 1C94
0x 1C98
0x 1C9C
0x 1CA0
0x 1CA4
0x 1CA8
0x 1CAC
0x 1CB0
0x 1CB4
0x 1CB8
0x 1CBC
0x 1CC0
0x 1CC4
0x 1CC8
0x 1CCC
0x 1CD0
0x 1CD4
0x 1CD8
0x 1CDC
0x 1CE0
0x 1CE4
0x 1CE8
0x 1CEC
0x 1CF0
0x 1CF4
0x 1CF8
0x 1CFC
0x 1D00
0x 1D04
0x 1D08
0x 1D0C
0x 1D10
0x 1D14
0x 1D18
0x 1D1C
0x 1D20
0x 1D24
0x 1D28
0x 1D2C
0x 1D30
0x 1D34
0x 1D38
0x 1D3C
0x 1D40
0x 1D44
0x 1D48
0x 1D4C
0x 1D50
0x 1D54
0x 1D58
0x 1D5C
0x 1D60
0x 1D64
0x 1D68
0x 1D6C
0x 1D70
0x 1D74
0x 1D78
0x 1D7C
0x 1D80
0x 1D84
0x 1D88
0x 1D8C
0x 1D90
0x 1D94
0x 1D98
0x 1D9C
0x 1DA0
0x 1DA4
0x 1DA8
0x 1DAC
0x 1DB0
0x 1DB4
0x 1DB8
0x 1DBC
0x 1DC0
0x 1DC4
0x 1DC8
0x 1DCC
0x 1DD0
0x 1DD4
0x 1DD8
0x 1DDC
0x 1DE0
0x 1DE4
0x 1DE8
0x 1DEC
0x 1DF0
0x 1DF4
0x 1DF8
0x 1DFC
0x 1E00
0x 1E04
0x 1E08
0x 1E0C
0x 1E10
0x 1E14
0x 1E18
0x 1E1C
0x 1E20
0x 1E24
0x 1E28
0x 1E2C
0x 1E30
0x 1E34
0x 1E38
0x 1E3C
0x 1E40
0x 1E44
0x 1E48
0x 1E4C
0x 1E50
0x 1E54
0x 1E58
0x 1E5C
0x 1E60
0x 1E64
0x 1E68
0x 1E6C
0x 1E70
0x 1E74
0x 1E78
0x 1E7C
0x 1E80
0x 1E84
0x 1E88
0x 1E8C
0x 1E90
0x 1E94
0x 1E98
0x 1E9C
0x 1EA0
0x 1EA4
0x 1EA8
0x 1EAC
0x 1EB0
0x 1EB4
0x 1EB8
0x 1EBC
0x 1EC0
0x 1EC4
0x 1EC8
0x 1ECC
0x 1ED0
0x 1ED4
0x 1ED8
0x 1EDC
0x 1EE0
0x 1EE4
0x 1EE8
0x 1EEC
0x 1EF0
0x 1EF4
0x 1EF8
0x 1EFC
0x 1F00
0x 1F04
0x 1F08
0x 1F0C
0x 1F10
0x 1F14
0x 1F18
0x 1F1C
0x 1F20
0x 1F24
0x 1F28
0x 1F2C
0x 1F30
0x 1F34
0x 1F38
0x 1F3C
0x 1F40
0x 1F44
0x 1F48
0x 1F4C
0x 1F50
0x 1F54
0x 1F58
0x 1F5C
0x 1F60
0x 1F64
0x 1F68
0x 1F6C
0x 1F70
0x 1F74
0x 1F78
0x 1F7C
0x 1F80
0x 1F84
0x 1F88
0x 1F8C
0x 1F90
0x 1F94
0x 1F98
0x 1F9C
0x 1FA0
0x 1FA4
0x 1FA8
0x 1FAC
0x 1FB0
0x 1FB4
0x 1FB8
0x 1FBC
0x 1FC0
0x 1FC4
0x 1FC8
0x 1FCC
0x 1FD0
0x 1FD4
0x 1FD8
0x 1FDC
0x 1FE0
0x 1FE4
0x 1FE8
0x 1FEC
0x 1FF0
0x 1FF4
0x 1FF8
0x 1FFC
0x 1BC4
0x 1C84
0x 1C80
0x 1C7C
0x 1B78
0x 1B74
0x 1C04
0x 1BC0
0x 2004
0x 2008
0x 200C
0x 2010
0x 2014
0x 2018
0x 201C
0x 2020
0x 2024
0x 2028
0x 202C
0x 2030
0x 2034
0x 2038
0x 203C
0x 2040
0x 2044
0x 2048
0x 204C
0x 2050
0x 2054
0x 2058
0x 205C
0x 2060
0x 2064
0x 2068
0x 206C
0x 2070
0x 2074
0x 2078
0x 207C
0x 2080
0x 2084
0x 2088
0x 208C
0x 2090
0x 2094
0x 2098
0x 209C
0x 20A0
0x 20A4
0x 20A8
0x 20AC
0x 20B0
0x 20B4
0x 20B8
0x 20BC
0x 20C0
0x 20C4
0x 20C8
0x 20CC
0x 20D0
0x 20D4
0x 20D8
0x 20DC
0x 20E0
0x 20E4
0x 20E8
0x 20EC
0x 20F0
0x 20F4
0x 20F8
0x 20FC
0x 2100
0x 2104
0x 2108
0x 210C
0x 2110
0x 2114
0x 2118
0x 211C
0x 2120
0x 2124
0x 2128
0x 212C
0x 2130
0x 2134
0x 2138
0x 213C
0x 2140
0x 2144
0x 2148
0x 214C
0x 2150
0x 2154
0x 2158
0x 215C
0x 2160
0x 2164
0x 2168
0x 216C
0x 2170
0x 2174
0x 2178
0x 217C
0x 2180
0x 2184
0x 2188
0x 218C
0x 2190
0x 2194
0x 2198
0x 219C
0x 21A0
0x 21A4
0x 21A8
0x 21AC
0x 21B0
0x 21B4
0x 21B8
0x 21BC
0x 21C0
0x 21C4
0x 21C8
0x 21CC
0x 21D0
0x 21D4
0x 21D8
0x 21DC
0x 21E0
0x 21E4
0x 21E8
0x 21EC
0x 21F0
0x 21F4
0x 21F8
0x 21FC
0x 2200
0x 2204
0x 2208
0x 220C
0x 2210
0x 2214
0x 2218
0x 221C
0x 2220
0x 2224
0x 2228
0x 222C
0x 2230
0x 2234
0x 2238
0x 223C
0x 2240
0x 2244
0x 2248
0x 224C
0x 2250
0x 2254
0x 2258
0x 225C
0x 2260
0x 2264
0x 2268
0x 226C
0x 2270
0x 2274
0x 2278
0x 227C
0x 2280
0x 2284
0x 2288
0x 228C
0x 2290
0x 2294
0x 2298
0x 229C
0x 22A0
0x 22A4
0x 22A8
0x 22AC
0x 22B0
0x 22B4
0x 22B8
0x 22BC
0x 22C0
0x 22C4
0x 22C8
0x 22CC
0x 22D0
0x 22D4
0x 22D8
0x 22DC
0x 22E0
0x 22E4
0x 22E8
0x 22EC
0x 22F0
0x 22F4
0x 22F8
0x 22FC
0x 2300
0x 2304
0x 2308
0x 230C
0x 2310
0x 2314
0x 2318
0x 231C
0x 2320
0x 2324
0x 2328
0x 232C
0x 2330
0x 2334
0x 2338
0x 233C
0x 2340
0x 2344
0x 2348
0x 234C
0x 2350
0x 2354
0x 2358
0x 235C
0x 2360
0x 2364
0x 2368
0x 236C
0x 2370
0x 2374
0x 2378
0x 237C
0x 2380
0x 2384
0x 2388
0x 238C
0x 2390
0x 2394
0x 2398
0x 239C
0x 23A0
0x 23A4
0x 23A8
0x 23AC
0x 23B0
0x 23B4
0x 23B8
0x 23BC
0x 23C0
0x 23C4
0x 23C8
0x 23CC
0x 23D0
0x 23D4
0x 23D8
0x 23DC
0x 23E0
0x 23E4
0x 23E8
0x 23EC
0x 23F0
0x 23F4
0x 23F8
0x 23FC
0x 2404
0x 2408
0x 240C
0x 2410
0x 2414
0x 2418
0x 241C
0x 2420
0x 2424
0x 2428
0x 242C
0x 2430
0x 2434
0x 2438
0x 243C
0x 2440
0x 2444
0x 2448
0x 244C
0x 2450
0x 2454
0x 2458
0x 245C
0x 2460
0x 2464
0x 2468
0x 246C
0x 2470
0x 2474
0x 2478
0x 247C
0x 2480
0x 2484
0x 2488
0x 248C
0x 2490
0x 2494
0x 2498
0x 249C
0x 24A0
0x 24A4
0x 24A8
0x 24AC
0x 24B0
0x 24B4
0x 24B8
0x 24BC
0x 24C0
0x 24C4
0x 24C8
0x 24CC
0x 24D0
0x 24D4
0x 24D8
0x 24DC
0x 24E0
0x 24E4
0x 24E8
0x 24EC
0x 24F0
0x 24F4
0x 24F8
0x 24FC
0x 2500
0x 2504
0x 2508
0x 250C
0x 2510
0x 2514
0x 2518
0x 251C
0x 2520
0x 2524
0x 2528
0x 252C
0x 2530
0x 2534
0x 2538
0x 253C
0x 2540
0x 2544
0x 2548
0x 254C
0x 2550
0x 2554
0x 2558
0x 255C
0x 2560
0x 2564
0x 2568
0x 256C
0x 2570
0x 2574
0x 2578
0x 257C
0x 2580
0x 2584
0x 2588
0x 258C
0x 2590
0x 2594
0x 2598
0x 259C
0x 25A0
0x 25A4
0x 25A8
0x 25AC
0x 25B0
0x 25B4
0x 25B8
0x 25BC
0x 25C0
0x 25C4
0x 25C8
0x 25CC
0x 25D0
0x 25D4
0x 25D8
0x 25DC
0x 25E0
0x 25E4
0x 25E8
0x 25EC
0x 25F0
0x 25F4
0x 25F8
0x 25FC
0x 2600
0x 2604
0x 2608
0x 260C
0x 2610
0x 2614
0x 2618
0x 261C
0x 2620
0x 2624
0x 2628
0x 262C
0x 2630
0x 2634
0x 2638
0x 263C
0x 2640
0x 2644
0x 2648
0x 264C
0x 2650
0x 2654
0x 2658
0x 265C
0x 2660
0x 2664
0x 2668
0x 266C
0x 2670
0x 2674
0x 2678
0x 267C
0x 2680
0x 2684
0x 2688
0x 268C
0x 2690
0x 2694
0x 2698
0x 269C
0x 26A0
0x 26A4
0x 26A8
0x 26AC
0x 26B0
0x 26B4
0x 26B8
0x 26BC
0x 26C0
0x 26C4
0x 26C8
0x 26CC
0x 26D0
0x 26D4
0x 26D8
0x 26DC
0x 26E0
0x 26E4
0x 26E8
0x 26EC
0x 26F0
0x 26F4
0x 26F8
0x 26FC
0x 2700
0x 2704
0x 2708
0x 270C
0x 2710
0x 2714
0x 2718
0x 271C
0x 2720
0x 2724
0x 2728
0x 272C
0x 2730
0x 2734
0x 2738
0x 273C
0x 2740
0x 2744
0x 2748
0x 274C
0x 2750
0x 2754
0x 2758
0x 275C
0x 2760
0x 2764
0x 2768
0x 276C
0x 2770
0x 2774
0x 2778
0x 277C
0x 2780
0x 2784
0x 2788
0x 278C
0x 2790
0x 2794
0x 2798
0x 279C
0x 27A0
0x 27A4
0x 27A8
0x 27AC
0x 27B0
0x 27B4
0x 27B8
0x 27BC
0x 27C0
0x 27C4
0x 27C8
0x 27CC
0x 27D0
0x 27D4
0x 27D8
0x 27DC
0x 27E0
0x 27E4
0x 27E8
0x 27EC
0x 27F0
0x 27F4
0x 27F8
0x 27FC
0x DB8
0x DB4
0x DB0
0x DAC
0x 2804
0x 2808
0x 280C
0x 2810
0x 2814
0x 2818
0x 281C
0x 2820
0x 2824
0x 2828
0x 282C
0x 2830
0x 2834
0x 2838
0x 283C
0x 2840
0x 2844
0x 2848
0x 284C
0x 2850
0x 2854
0x 2858
0x 285C
0x 2860
0x 2864
0x 2868
0x 286C
0x 2870
0x 2874
0x 2878
0x 287C
0x 2880
0x 2884
0x 2888
0x 288C
0x 2890
0x 2894
0x 2898
0x 289C
0x 28A0
0x 28A4
0x 28A8
0x 28AC
0x 28B0
0x 28B4
0x 28B8
0x 28BC
0x 28C0
0x 28C4
0x 28C8
0x 28CC
0x 28D0
0x 28D4
0x 28D8
0x 28DC
0x 28E0
0x 28E4
0x 28E8
0x 28EC
0x 28F0
0x 28F4
0x 28F8
0x 28FC
0x 2900
0x 2904
0x 2908
0x 290C
0x 2910
0x 2914
0x 2918
0x 291C
0x 2920
0x 2924
0x 2928
0x 292C
0x 2930
0x 2934
0x 2938
0x 293C
0x 2940
0x 294C
0x 2950
0x 2954
0x 2958
0x 295C
0x 2960
0x 2964
0x 2968
0x 296C
0x 2970
0x 2974
0x 2978
0x 298C
0x 2990
0x 2994
0x 2998
0x 299C
0x 29A0
0x 29A4
0x 29A8
0x 29AC
0x 29B0
0x 29B4
0x 29B8
0x 29BC
0x 29C0
0x 29C4
0x 29C8
0x 29CC
0x 29D0
0x 29DC
0x 29E0
0x 29E4
0x 29E8
0x 29EC
0x 29F0
0x 29F4
0x 29F8
0x 29FC
0x 2A00
0x 2A04
0x 2A08
0x 2A0C
0x 2A10
0x 2A14
0x 2A18
0x 2A1C
0x 2A20
0x 2A28
0x 2A2C
0x 2A30
0x 2A34
0x 2A38
0x 2A3C
0x 2A40
0x 2A44
0x 2A48
0x 2A4C
0x 2A50
0x 2A54
0x 2A58
0x 2A5C
0x 2A60
0x 2A64
0x 2A68
0x 2A6C
0x 2A70
0x 2A74
0x 2A78
0x 2A7C
0x 2A80
0x 2A84
0x 2A88
0x 2A8C
0x 2A90
0x 2A94
0x 2A98
0x 2A9C
0x 2AA0
0x 2AA4
0x 2AA8
0x 2AAC
0x 2AB0
0x 2AB4
0x 2AB8
0x 2ABC
0x 2AC0
0x 2AC4
0x 2AC8
0x 2ACC
0x 2AD0
0x 2AD4
0x 2AD8
0x 2ADC
0x 2AE0
0x 2AE4
0x 2AE8
0x 2B00
0x 2B04
0x 2B08
0x 2B0C
0x 2B10
0x 2B14
0x 2B18
0x 2B1C
0x 2B20
0x 2B24
0x 2B28
0x 2B2C
0x 2B30
0x 2B34
0x 2B38
0x 2B3C
0x 2B40
0x 2B44
0x 2B48
0x 2B4C
0x 2B50
0x 2B54
0x 2B58
0x 2B5C
0x 2B60
0x 2B64
0x 2B68
0x 2B6C
0x 2B70
0x 2B74
0x 2B78
0x 2B7C
0x 2B80
0x 2B84
0x 2B88
0x 2B8C
0x 2B90
0x 2B94
0x 2B98
0x 2B9C
0x 2BA0
0x 2BA4
0x 2BA8
0x 2BAC
0x 2BB0
0x 2BB4
0x 2BB8
0x 2BBC
0x 2BC0
0x 2BC4
0x 2BC8
0x 2BCC
0x 2BD0
0x 2BD4
0x 2BD8
0x 2BDC
0x 2BE0
0x 2BE4
0x 2BE8
0x 2BEC
0x 2BF0
0x 2BF4
0x 2BF8
0x 2BFC
0x DA0
0x 330
0x 2C04
0x 2C08
0x 2C0C
0x 2C10
0x 2C14
0x 2C18
0x 2C1C
0x 2C20
0x 2C24
0x 2C28
0x 2C2C
0x 2C30
0x 2C34
0x 2C38
0x 2C3C
0x 2C40
0x 2C44
0x 2C48
0x 2C4C
0x 2C50
0x 2C54
0x 2C58
0x 2C5C
0x 2C60
0x 2C64
0x 2C68
0x 2C6C
0x 2C70
0x 2C74
0x 2C78
0x 2C7C
0x 2C80
0x 2C84
0x 2C88
0x 2C8C
0x 2C90
0x 2C94
0x 2C98
0x 2C9C
0x 2CA0
0x 2CA4
0x 2CA8
0x 2CAC
0x 2CB0
0x 2CB4
0x 2CB8
0x 2CBC
0x 2CC0
0x 2CC4
0x 2CC8
0x 2CCC
0x 2CD0
0x 2CD4
0x 2CD8
0x 2CDC
0x 2CE0
0x 2CE4
0x 2CE8
0x 2CEC
0x 2CF0
0x 2CF4
0x 2CF8
0x 2CFC
0x 2D00
0x 2D04
0x 2D08
0x 2D0C
0x 2D10
0x 2D14
0x 2D18
0x 2D1C
0x 2D20
0x 2D24
0x 2D28
0x 2D2C
0x 2D30
0x 2D34
0x 2D38
0x 2D3C
0x 2D40
0x 2D44
0x 2D48
0x 2D4C
0x 2D50
0x 2D54
0x 2D58
0x 2D5C
0x 2D60
0x 2D64
0x 2D68
0x 2D6C
0x 2D70
0x 2D74
0x 2D78
0x 2D7C
0x 2D80
0x 2D84
0x 2D88
0x 2D8C
0x 2D90
0x 2D94
0x 2D98
0x 2D9C
0x 2DA0
0x 2DA4
0x 2DA8
0x 2DAC
0x 2DB0
0x 2DB4
0x 2DB8
0x 2DBC
0x 2DC0
0x 2DC4
0x 2DC8
0x 2DCC
0x 2DD0
0x 2DD4
0x 2DD8
0x 2DDC
0x 2DE0
0x 2DE4
0x 2DE8
0x 2DEC
0x 2DF0
0x 2DF4
0x 2DF8
0x 2DFC
0x 2E00
0x 2E04
0x 2E08
0x 2E0C
0x 2E10
0x 2E14
0x 2E18
0x 2E1C
0x 2E20
0x 2E24
0x 2E28
0x 2E2C
0x 2E30
0x 2E34
0x 2E38
0x 2E3C
0x 2E40
0x 2E44
0x 2E48
0x 2E4C
0x 2E50
0x 2E54
0x 2E58
0x 2E5C
0x 2E60
0x 2E64
0x 2E68
0x 2E6C
0x 2E70
0x 2E74
0x 2E78
0x 2E7C
0x 2E80
0x 2E84
0x 2E88
0x 2E8C
0x 2E90
0x 2E94
0x 2E98
0x 2E9C
0x 2EA0
0x 2EA4
0x 2EA8
0x 2EAC
0x 2EB0
0x 2EB4
0x 2EB8
0x 2EBC
0x 2EC0
0x 2EC4
0x 2EC8
0x 2ECC
0x 2ED0
0x 2ED4
0x 2ED8
0x 2EDC
0x 2EE0
0x 2EE4
0x 2EE8
0x 2EEC
0x 2EF0
0x 2EF4
0x 2EF8
0x 2EFC
0x 2F00
0x 2F04
0x 2F08
0x 2F0C
0x 2F10
0x 2F14
0x 2F18
0x 2F1C
0x 2F20
0x 2F24
0x 2F28
0x 2F2C
0x 2F30
0x 2F34
0x 2F38
0x 2F3C
0x 2F40
0x 2F44
0x 2F48
0x 2F4C
0x 2F50
0x 2F54
0x 2F58
0x 2F5C
0x 2F60
0x 2F64
0x 2F68
0x 2F6C
0x 2F70
0x 2F74
0x 2F78
0x 2F7C
0x 2F80
0x 2F84
0x 2F88
0x 2F8C
0x 2F90
0x 2F94
0x 2F98
0x 2F9C
0x 2FA0
0x 2FA4
0x 2FA8
0x 2FAC
0x 2FB0
0x 2FB4
0x 2FB8
0x 2FBC
0x 2FC0
0x 2FC4
0x 2FC8
0x 2FCC
0x 2FD0
0x 2FD4
0x 2FD8
0x 2FDC
0x 2FE0
0x 2FE4
0x 2FE8
0x 2FEC
0x 2FF0
0x 2FF4
0x 2FF8
0x 2FFC
0x 3004
0x 3008
0x 300C
0x 3010
0x 3014
0x 3018
0x 301C
0x 3020
0x 3024
0x 3028
0x 302C
0x 3030
0x 3034
0x 3038
0x 303C
0x 3040
0x 3044
0x 3048
0x 304C
0x 3050
0x 3054
0x 3058
0x 305C
0x 3060
0x 3064
0x 3068
0x 306C
0x 3070
0x 3074
0x 3078
0x 307C
0x 3080
0x 3084
0x 3088
0x 308C
0x 3090
0x 3094
0x 3098
0x 309C
0x 30A0
0x 30A4
0x 30A8
0x 30AC
0x 30B0
0x 30B4
0x 30B8
0x 30BC
0x 30C0
0x 30C4
0x 30C8
0x 30CC
0x 30D0
0x 30D4
0x 30D8
0x 30DC
0x 30E0
0x 30E4
0x 30E8
0x 30EC
0x 30F0
0x 30F4
0x 30F8
0x 30FC
0x 3100
0x 3104
0x 3108
0x 310C
0x 3110
0x 3114
0x 3118
0x 311C
0x 3120
0x 3124
0x 3128
0x 312C
0x 3130
0x 3134
0x 3138
0x 313C
0x 3140
0x 3144
0x 3148
0x 314C
0x 3150
0x 3154
0x 3158
0x 315C
0x 3160
0x 3164
0x 3168
0x 316C
0x 3170
0x 3174
0x 3178
0x 317C
0x 3180
0x 3184
0x 3188
0x 318C
0x 3190
0x 3194
0x 3198
0x 319C
0x 31A0
0x 31A4
0x 31A8
0x 31AC
0x 31B0
0x 31B4
0x 31B8
0x 31BC
0x 31C0
0x 31C4
0x 31C8
0x 31CC
0x 31D0
0x 31D4
0x 31D8
0x 31DC
0x 31E0
0x 31E4
0x 31E8
0x 31EC
0x 31F0
0x 31F4
0x 31F8
0x 31FC
0x 3200
0x 3204
0x 3208
0x 320C
0x 3210
0x 3214
0x 3218
0x 321C
0x 3220
0x 3224
0x 3228
0x 322C
0x 3230
0x 3234
0x 3238
0x 323C
0x 3240
0x 3244
0x 3248
0x 324C
0x 3250
0x 3254
0x 3258
0x 325C
0x 3260
0x 3264
0x 3268
0x 326C
0x 3270
0x 3274
0x 3278
0x 327C
0x 3280
0x 3284
0x 3288
0x 328C
0x 3290
0x 3294
0x 3298
0x 329C
0x 32A0
0x 32A4
0x 32A8
0x 32AC
0x 32B0
0x 32B4
0x 32B8
0x 32BC
0x 32C0
0x 32C4
0x 32C8
0x 32CC
0x 32D0
0x 32D4
0x 32D8
0x 32DC
0x 32E0
0x 32E4
0x 32E8
0x 32EC
0x 32F0
0x 32F4
0x 32F8
0x 32FC
0x 3300
0x 3304
0x 3308
0x 330C
0x 3310
0x 3314
0x 3318
0x 331C
0x 3320
0x 3324
0x 3328
0x 332C
0x 3330
0x 3334
0x 3338
0x 333C
0x 3340
0x 3344
0x 3348
0x 334C
0x 3350
0x 3354
0x 3358
0x 335C
0x 3360
0x 3364
0x 3368
0x 336C
0x 3370
0x 3374
0x 3378
0x 337C
0x 3380
0x 3384
0x 3388
0x 338C
0x 3390
0x 3394
0x 3398
0x 339C
0x 33A0
0x 33A4
0x 33A8
0x 33AC
0x 33B0
0x 33B4
0x 33B8
0x 33BC
0x 33C0
0x 33C4
0x 33C8
0x 33CC
0x 33D0
0x 33D4
0x 33D8
0x 33DC
0x 33E0
0x 33E4
0x 33E8
0x 33EC
0x 33F0
0x 33F4
0x 33F8
0x 33FC
0x 3404
0x 3408
0x 340C
0x 3410
0x 3414
0x 3418
0x 341C
0x 3420
0x 3424
0x 3428
0x 342C
0x 3430
0x 3434
0x 3438
0x 343C
0x 3440
0x 3444
0x 3448
0x 344C
0x 3450
0x 3454
0x 3458
0x 345C
0x 3460
0x 3464
0x 3468
0x 346C
0x 3470
0x 3474
0x 3478
0x 347C
0x 3480
0x 3484
0x 3488
0x 348C
0x 3490
0x 3494
0x 3498
0x 349C
0x 34A0
0x 34A4
0x 34A8
0x 34AC
0x 34B0
0x 34B4
0x 34B8
0x 34BC
0x 34C0
0x 34C4
0x 34C8
0x 34CC
0x 34D0
0x 34D4
0x 34D8
0x 34DC
0x 34E0
0x 34E4
0x 34E8
0x 34EC
0x 34F0
0x 34F4
0x 34F8
0x 34FC
0x 3500
0x 3504
0x 3508
0x 350C
0x 3510
0x 3514
0x 3518
0x 351C
0x 3520
0x 3524
0x 3528
0x 352C
0x 3530
0x 3534
0x 3538
0x 353C
0x 3540
0x 3544
0x 3548
0x 354C
0x 3550
0x 3554
0x 3558
0x 355C
0x 3560
0x 3564
0x 3568
0x 356C
0x 3570
0x 3574
0x 3578
0x 357C
0x 3580
0x 3584
0x 3588
0x 358C
0x 3590
0x 3594
0x 3598
0x 359C
0x 35A0
0x 35A4
0x 35A8
0x 35AC
0x 35B0
0x 35B4
0x 35B8
0x 35BC
0x 35C0
0x 35C4
0x 35C8
0x 35CC
0x 35D0
0x 35D4
0x 35D8
0x 35DC
0x 35E0
0x 35E4
0x 35E8
0x 35EC
0x 35F0
0x 35F4
0x 35F8
0x 35FC
0x 3600
0x 3604
0x 3608
0x 360C
0x 3610
0x 3614
0x 3618
0x 361C
0x 3620
0x 3624
0x 3628
0x 362C
0x 3630
0x 3634
0x 3638
0x 363C
0x 3640
0x 3644
0x 3648
0x 364C
0x 3650
0x 3654
0x 3658
0x 365C
0x 3660
0x 3664
0x 3668
0x 366C
0x 3670
0x 3674
0x 3678
0x 367C
0x 3680
0x 3684
0x 3688
0x 368C
0x 3690
0x 3694
0x 3698
0x 369C
0x 36A0
0x 36A4
0x 36A8
0x 36AC
0x 36B0
0x 36B4
0x 36B8
0x 36BC
0x 36C0
0x 36C4
0x 36C8
0x 36CC
0x 36D0
0x 36D4
0x 36D8
0x 36DC
0x 36E0
0x 36E4
0x 36E8
0x 36EC
0x 36F0
0x 36F4
0x 36F8
0x 36FC
0x 3700
0x 3704
0x 3708
0x 370C
0x 3710
0x 3714
0x 3718
0x 371C
0x 3720
0x 3724
0x 3728
0x 372C
0x 3730
0x 3734
0x 3738
0x 373C
0x 3740
0x 374C
0x 3750
0x 3754
0x 3758
0x 375C
0x 3760
0x 3764
0x 3768
0x 376C
0x 3770
0x 3774
0x 3778
0x 377C
0x 3780
0x 3784
0x 3788
0x 378C
0x 3798
0x 379C
0x 37A0
0x 37A4
0x 37A8
0x 37AC
0x 37B0
0x 37B4
0x 37B8
0x 37BC
0x 37C0
0x 37C4
0x 37C8
0x 37CC
0x 37D0
0x 37D4
0x 37D8
0x 37DC
0x 37E0
0x 37E4
0x 37E8
0x 37EC
0x 37F0
0x 37F4
0x 37F8
0x 37FC
0x 36C8
0x 3804
0x 3808
0x 380C
0x 3810
0x 3814
0x 3818
0x 381C
0x 3820
0x 3824
0x 3828
0x 382C
0x 3830
0x 3834
0x 3838
0x 383C
0x 3840
0x 3844
0x 3848
0x 384C
0x 3850
0x 3854
0x 3858
0x 385C
0x 3860
0x 3864
0x 3868
0x 3870
0x 3874
0x 3878
0x 387C
0x 3880
0x 3884
0x 3888
0x 388C
0x 3890
0x 3894
0x 3898
0x 389C
0x 38A0
0x 38A4
0x 38A8
0x 38AC
0x 38B0
0x 38B4
0x 38B8
0x 38BC
0x 38C0
0x 38C4
0x 38C8
0x 38CC
0x 38D0
0x 38D4
0x 38D8
0x 38DC
0x 38E0
0x 38E4
0x 38E8
0x 38F0
0x 38F4
0x 38F8
0x 38FC
0x 3900
0x 3904
0x 3908
0x 390C
0x 3910
0x 391C
0x 3920
0x 3924
0x 3928
0x 392C
0x 3930
0x 3934
0x 3938
0x 393C
0x 3940
0x 3944
0x 3948
0x 394C
0x 3950
0x 3954
0x 3958
0x 395C
0x 3960
0x 3964
0x 3968
0x 396C
0x 3970
0x 3974
0x 3978
0x 397C
0x 3980
0x 3984
0x 3988
0x 398C
0x 3990
0x 3994
0x 3998
0x 399C
0x 39A0
0x 39A4
0x 39A8
0x 39AC
0x 39B0
0x 39B4
0x 39B8
0x 39BC
0x 39C0
0x 39C4
0x 39C8
0x 39CC
0x 39D0
0x 39D4
0x 39D8
0x 39DC
0x 39E0
0x 39E4
0x 39E8
0x 39EC
0x 39F0
0x 39F4
0x 39F8
0x 39FC
0x 3A00
0x 3A04
0x 3A08
0x 3A0C
0x 3A10
0x 3A14
0x 3A18
0x 3A1C
0x 3A20
0x 3A24
0x 3A28
0x 3A2C
0x 3A30
0x 3A34
0x 3A38
0x 3A3C
0x 3A40
0x 3A44
0x 3A48
0x 3A4C
0x 3A50
0x 3A54
0x 3A58
0x 3A5C
0x 3A60
0x 3A64
0x 3A68
0x 3A6C
0x 3A70
0x 3A74
0x 3A78
0x 3A7C
0x 3A80
0x 3A84
0x 3A88
0x 3A8C
0x 3A90
0x 3A94
0x 3A98
0x 3A9C
0x 3AA0
0x 3AA4
0x 3AA8
0x 3AAC
0x 3AB0
0x 3AB4
0x 3AB8
0x 3ABC
0x 3AC0
0x 3AC4
0x 3AC8
0x 3ACC
0x 3AD0
0x 3AD4
0x 3AD8
0x 3ADC
0x 3AE0
0x 3AE4
0x 3AE8
0x 3AEC
0x 3AF0
0x 3AF4
0x 3AF8
0x 3AFC
0x 3B00
0x 3B04
0x 3B08
0x 3B0C
0x 3B10
0x 3B14
0x 3B18
0x 3B1C
0x 3B20
0x 3B24
0x 3B28
0x 3B2C
0x 3B30
0x 3B34
0x 3B38
0x 3B3C
0x 3B40
0x 3B44
0x 3B48
0x 3B4C
0x 3B50
0x 3B54
0x 3B58
0x 3B5C
0x 3B60
0x 3B64
0x 3B68
0x 3B6C
0x 3B70
0x 3B74
0x 3B78
0x 3B7C
0x 3B80
0x 3B84
0x 3B88
0x 3B8C
0x 3B90
0x 3B94
0x 3B98
0x 3B9C
0x 3BA0
0x 3BA4
0x 3BA8
0x 3BAC
0x 3BB0
0x 3BB4
0x 3BB8
0x 3BBC
0x 3BC0
0x 3BC4
0x 3BC8
0x 3BCC
0x 3BD0
0x 3BD4
0x 3BD8
0x 3BDC
0x 3BE0
0x 3BE4
0x 3BE8
0x 3BEC
0x 3BF0
0x 3BF4
0x 3BF8
0x 3BFC
0x 3794
0x 3918
0x 38EC
0x 3914
0x 3748
0x 3744
0x 386C
0x 3790
0x 3C04
0x 3C08
0x 3C0C
0x 3C10
0x 3C14
0x 3C18
0x 3C1C
0x 3C20
0x 3C24
0x 3C28
0x 3C2C
0x 3C30
0x 3C34
0x 3C38
0x 3C3C
0x 3C40
0x 3C44
0x 3C48
0x 3C4C
0x 3C50
0x 3C54
0x 3C58
0x 3C5C
0x 3C60
0x 3C64
0x 3C68
0x 3C6C
0x 3C70
0x 3C74
0x 3C78
0x 3C7C
0x 3C80
0x 3C84
0x 3C88
0x 3C8C
0x 3C90
0x 3C94
0x 3C98
0x 3C9C
0x 3CA0
0x 3CA4
0x 3CA8
0x 3CAC
0x 3CB0
0x 3CB4
0x 3CB8
0x 3CBC
0x 3CC0
0x 3CC4
0x 3CC8
0x 3CCC
0x 3CD0
0x 3CD4
0x 3CD8
0x 3CDC
0x 3CE0
0x 3CE4
0x 3CE8
0x 3CEC
0x 3CF0
0x 3CF4
0x 3CF8
0x 3CFC
0x 3D00
0x 3D04
0x 3D08
0x 3D0C
0x 3D10
0x 3D14
0x 3D18
0x 3D1C
0x 3D20
0x 3D24
0x 3D28
0x 3D2C
0x 3D30
0x 3D34
0x 3D38
0x 3D3C
0x 3D40
0x 3D44
0x 3D48
0x 3D4C
0x 3D50
0x 3D54
0x 3D58
0x 3D5C
0x 3D60
0x 3D64
0x 3D68
0x 3D6C
0x 3D70
0x 3D74
0x 3D78
0x 3D7C
0x 3D80
0x 3D84
0x 3D88
0x 3D8C
0x 3D90
0x 3D94
0x 3D98
0x 3D9C
0x 3DA0
0x 3DA4
0x 3DA8
0x 3DAC
0x 3DB0
0x 3DB4
0x 3DB8
0x 3DBC
0x 3DC0
0x 3DC4
0x 3DC8
0x 3DCC
0x 3DD0
0x 3DD4
0x 3DD8
0x 3DDC
0x 3DE0
0x 3DE4
0x 3DE8
0x 3DEC
0x 3DF0
0x 3DF4
0x 3DF8
0x 3DFC
0x 3E00
0x 3E04
0x 3E08
0x 3E0C
0x 3E10
0x 3E14
0x 3E18
0x 3E1C
0x 3E20
0x 3E24
0x 3E28
0x 3E2C
0x 3E30
0x 3E34
0x 3E38
0x 3E3C
0x 3E40
0x 3E44
0x 3E48
0x 3E4C
0x 3E50
0x 3E54
0x 3E58
0x 3E5C
0x 3E60
0x 3E64
0x 3E68
0x 3E6C
0x 3E70
0x 3E74
0x 3E78
0x 3E7C
0x 3E80
0x 3E84
0x 3E88
0x 3E8C
0x 3E90
0x 3E94
0x 3E98
0x 3E9C
0x 3EA0
0x 3EA4
0x 3EA8
0x 3EAC
0x 3EB0
0x 3EB4
0x 3EB8
0x 3EBC
0x 3EC0
0x 3EC4
0x 3EC8
0x 3ECC
0x 3ED0
0x 3ED4
0x 3ED8
0x 3EDC
0x 3EE0
0x 3EE4
0x 3EE8
0x 3EEC
0x 3EF0
0x 3EF4
0x 3EF8
0x 3EFC
0x 3F00
0x 3F04
0x 3F08
0x 3F0C
0x 3F10
0x 3F14
0x 3F18
0x 3F1C
0x 3F20
0x 3F24
0x 3F28
0x 3F2C
0x 3F30
0x 3F34
0x 3F38
0x 3F3C
0x 3F40
0x 3F44
0x 3F48
0x 3F4C
0x 3F50
0x 3F54
0x 3F58
0x 3F5C
0x 3F60
0x 3F64
0x 3F68
0x 3F6C
0x 3F70
0x 3F74
0x 3F78
0x 3F7C
0x 3F80
0x 3F84
0x 3F88
0x 3F8C
0x 3F90
0x 3F94
0x 3F98
0x 3F9C
0x 3FA0
0x 3FA4
0x 3FA8
0x 3FAC
0x 3FB0
0x 3FB4
0x 3FB8
0x 3FBC
0x 3FC0
0x 3FC4
0x 3FC8
0x 3FCC
0x 3FD0
0x 3FD4
0x 3FD8
0x 3FDC
0x 3FE0
0x 3FE4
0x 3FE8
0x 3FEC
0x 3FF0
0x 3FF4
0x 3FF8
0x 3FFC
0x 4004
0x 4008
0x 400C
0x 4010
0x 4014
0x 4018
0x 401C
0x 4020
0x 4024
0x 4028
0x 402C
0x 4030
0x 4034
0x 4038
0x 403C
0x 4040
0x 4044
0x 4048
0x 404C
0x 4050
0x 4054
0x 4058
0x 405C
0x 4060
0x 4064
0x 4068
0x 406C
0x 4070
0x 4074
0x 4078
0x 407C
0x 4080
0x 4084
0x 4088
0x 408C
0x 4090
0x 4094
0x 4098
0x 409C
0x 40A0
0x 40A4
0x 40A8
0x 40AC
0x 40B0
0x 40B4
0x 40B8
0x 40BC
0x 40C0
0x 40C4
0x 40C8
0x 40CC
0x 40D0
0x 40D4
0x 40D8
0x 40DC
0x 40E0
0x 40E4
0x 40E8
0x 40EC
0x 40F0
0x 40F4
0x 40F8
0x 40FC
0x 4100
0x 4104
0x 4108
0x 410C
0x 4110
0x 4114
0x 4118
0x 411C
0x 4120
0x 4124
0x 4128
0x 412C
0x 4130
0x 4134
0x 4138
0x 413C
0x 4140
0x 4144
0x 4148
0x 414C
0x 4150
0x 4154
0x 4158
0x 415C
0x 4160
0x 4164
0x 4168
0x 416C
0x 4170
0x 4174
0x 4178
0x 417C
0x 4180
0x 4184
0x 4188
0x 418C
0x 4190
0x 4194
0x 4198
0x 419C
0x 41A0
0x 41A4
0x 41A8
0x 41AC
0x 41B0
0x 41B4
0x 41B8
0x 41BC
0x 41C0
0x 41C4
0x 41C8
0x 41CC
0x 41D0
0x 41D4
0x 41D8
0x 41DC
0x 41E0
0x 41E4
0x 41E8
0x 41EC
0x 41F0
0x 41F4
0x 41F8
0x 41FC
0x 4200
0x 4204
0x 4208
0x 420C
0x 4210
0x 4214
0x 4218
0x 421C
0x 4220
0x 4224
0x 4228
0x 422C
0x 4230
0x 4234
0x 4238
0x 423C
0x 4240
0x 4244
0x 4248
0x 424C
0x 4250
0x 4254
0x 4258
0x 425C
0x 4260
0x 4264
0x 4268
0x 426C
0x 4270
0x 4274
0x 4278
0x 427C
0x 4280
0x 4284
0x 4288
0x 428C
0x 4290
0x 4294
0x 4298
0x 429C
0x 42A0
0x 42A4
0x 42A8
0x 42AC
0x 42B0
0x 42B4
0x 42B8
0x 42BC
0x 42C0
0x 42C4
0x 42C8
0x 42CC
0x 42D0
0x 42D4
0x 42D8
0x 42DC
0x 42E0
0x 42E4
0x 42E8
0x 42EC
0x 42F0
0x 42F4
0x 42F8
0x 42FC
0x 4300
0x 4304
0x 4308
0x 430C
0x 4310
0x 4314
0x 4318
0x 431C
0x 4320
0x 4324
0x 4328
0x 432C
0x 4330
0x 4334
0x 4338
0x 433C
0x 4340
0x 4344
0x 4348
0x 434C
0x 4350
0x 4354
0x 4358
0x 435C
0x 4360
0x 4364
0x 4368
0x 436C
0x 4370
0x 4374
0x 4378
0x 437C
0x 4380
0x 4384
0x 4388
0x 438C
0x 4390
0x 4394
0x 4398
0x 439C
0x 43A0
0x 43A4
0x 43A8
0x 43AC
0x 43B0
0x 43B4
0x 43B8
0x 43BC
0x 43C0
0x 43C4
0x 43C8
0x 43CC
0x 43D0
0x 43D4
0x 43D8
0x 43DC
0x 43E0
0x 43E4
0x 43E8
0x 43EC
0x 43F0
0x 43F4
0x 43F8
0x 43FC
0x 4404
0x 4408
0x 440C
0x 4410
0x 4414
0x 4418
0x 441C
0x 4420
0x 4424
0x 4428
0x 442C
0x 4430
0x 4434
0x 4438
0x 443C
0x 4440
0x 4444
0x 4448
0x 444C
0x 4450
0x 4454
0x 4458
0x 445C
0x 4460
0x 4464
0x 4468
0x 446C
0x 4470
0x 4474
0x 4478
0x 447C
0x 4480
0x 4484
0x 4488
0x 448C
0x 4490
0x 4494
0x 4498
0x 449C
0x 44A0
0x 44A4
0x 44A8
0x 44AC
0x 44B0
0x 44B4
0x 44B8
0x 44BC
0x 44C0
0x 44C4
0x 44C8
0x 44CC
0x 44D0
0x 44D4
0x 44D8
0x 44DC
0x 44E0
0x 44E4
0x 44E8
0x 44EC
0x 44F0
0x 44F4
0x 44F8
0x 44FC
0x 4500
0x 4504
0x 4508
0x 450C
0x 4510
0x 4514
0x 4518
0x 451C
0x 4520
0x 4524
0x 4528
0x 452C
0x 4530
0x 4534
0x 4538
0x 453C
0x 4540
0x 4544
0x 4548
0x 454C
0x 4550
0x 4554
0x 4558
0x 455C
0x 4560
0x 4564
0x 4568
0x 456C
0x 4570
0x 4574
0x 4578
0x 457C
0x 4584
0x 4588
0x 458C
0x 4590
0x 4594
0x 4598
0x 459C
0x 45A0
0x 45A4
0x 45A8
0x 45AC
0x 45B0
0x 45B4
0x 45B8
0x 45BC
0x 45C0
0x 45C4
0x 45C8
0x 45CC
0x 45D0
0x 45D4
0x 45D8
0x 45DC
0x 45E0
0x 45E4
0x 45E8
0x 45EC
0x 45F0
0x 45F4
0x 45F8
0x 45FC
0x 4600
0x 4604
0x 4608
0x 460C
0x 4610
0x 4614
0x 4618
0x 461C
0x 4620
0x 4624
0x 4628
0x 462C
0x 4630
0x 4634
0x 4638
0x 463C
0x 4640
0x 4644
0x 4648
0x 464C
0x 4650
0x 4654
0x 4658
0x 465C
0x 4660
0x 4664
0x 4668
0x 466C
0x 4670
0x 4674
0x 4678
0x 467C
0x 4680
0x 4684
0x 4688
0x 468C
0x 4690
0x 4694
0x 4698
0x 469C
0x 46A0
0x 46A4
0x 46A8
0x 46AC
0x 46B0
0x 46B4
0x 46B8
0x 46BC
0x 46C0
0x 46C4
0x 46C8
0x 46CC
0x 46D0
0x 46D4
0x 46D8
0x 46DC
0x 46E0
0x 46E4
0x 46E8
0x 46EC
0x 46F0
0x 46F4
0x 46F8
0x 46FC
0x 4700
0x 4704
0x 4708
0x 470C
0x 4710
0x 4714
0x 4718
0x 471C
0x 4720
0x 4724
0x 4728
0x 472C
0x 4730
0x 4734
0x 4738
0x 473C
0x 4740
0x 4744
0x 4748
0x 474C
0x 4750
0x 4754
0x 4758
0x 475C
0x 4760
0x 4764
0x 4768
0x 476C
0x 4770
0x 4774
0x 4778
0x 477C
0x 4780
0x 4784
0x 4788
0x 478C
0x 4790
0x 4794
0x 4798
0x 479C
0x 47A0
0x 47A4
0x 47A8
0x 47AC
0x 47B0
0x 47B4
0x 47B8
0x 47BC
0x 47C0
0x 47C4
0x 47C8
0x 47CC
0x 47D0
0x 47D4
0x 47D8
0x 47DC
0x 47E0
0x 47E4
0x 47E8
0x 47EC
0x 47F0
0x 47F4
0x 47F8
0x 47FC
0x 4804
0x 4808
0x 480C
0x 4810
0x 4814
0x 4818
0x 481C
0x 4820
0x 4824
0x 4828
0x 482C
0x 4830
0x 4834
0x 4838
0x 483C
0x 4840
0x 4844
0x 4848
0x 484C
0x 4850
0x 4854
0x 4858
0x 485C
0x 4860
0x 4864
0x 4868
0x 486C
0x 4870
0x 4874
0x 4878
0x 487C
0x 4880
0x 4884
0x 4888
0x 488C
0x 4890
0x 4894
0x 4898
0x 489C
0x 48A0
0x 48A4
0x 48A8
0x 48AC
0x 48B0
0x 48B4
0x 48B8
0x 48BC
0x 48C0
0x 48C4
0x 48C8
0x 48CC
0x 48D0
0x 48D4
0x 48D8
0x 48DC
0x 48E0
0x 48E4
0x 48E8
0x 48EC
0x 48F0
0x 48F4
0x 48F8
0x 48FC
0x 4900
0x 4904
0x 4908
0x 490C
0x 4910
0x 4914
0x 4918
0x 491C
0x 4920
0x 4924
0x 4928
0x 492C
0x 4930
0x 4934
0x 4938
0x 493C
0x 4940
0x 4944
0x 4948
0x 494C
0x 4950
0x 4954
0x 4958
0x 495C
0x 4960
0x 4964
0x 4968
0x 496C
0x 4970
0x 4974
0x 4978
0x 497C
0x 4980
0x 4984
0x 4988
0x 498C
0x 4990
0x 4994
0x 4998
0x 499C
0x 49A0
0x 49A4
0x 49A8
0x 49AC
0x 49B0
0x 49B4
0x 49B8
0x 49BC
0x 49C0
0x 49C4
0x 49C8
0x 49CC
0x 49D0
0x 49D4
0x 49D8
0x 49DC
0x 49E0
0x 49E4
0x 49E8
0x 49EC
0x 49F0
0x 49F4
0x 49F8
0x 49FC
0x 4A00
0x 4A04
0x 4A08
0x 4A0C
0x 4A10
0x 4A14
0x 4A18
0x 4A1C
0x 4A20
0x 4A24
0x 4A28
0x 4A2C
0x 4A30
0x 4A34
0x 4A38
0x 4A3C
0x 4A40
0x 4A44
0x 4A48
0x 4A4C
0x 4A50
0x 4A54
0x 4A58
0x 4A5C
0x 4A60
0x 4A64
0x 4A68
0x 4A6C
0x 4A70
0x 4A74
0x 4A78
0x 4A7C
0x 4A80
0x 4A84
0x 4A88
0x 4A8C
0x 4A90
0x 4A94
0x 4A98
0x 4A9C
0x 4AA0
0x 4AA4
0x 4AA8
0x 4AAC
0x 4AB0
0x 4AB4
0x 4AB8
0x 4ABC
0x 4AC0
0x 4AC4
0x 4AC8
0x 4ACC
0x 4AD0
0x 4AD4
0x 4AD8
0x 4AE4
0x 4AE8
0x 4AEC
0x 4AF0
0x 4AF4
0x 4AF8
0x 4AFC
0x 4B00
0x 4B04
0x 4B08
0x 4B0C
0x 4B10
0x 4B14
0x 4B18
0x 4B1C
0x 4B20
0x 4B24
0x 4B2C
0x 4B30
0x 4B34
0x 4B38
0x 4B3C
0x 4B40
0x 4B44
0x 4B48
0x 4B4C
0x 4B50
0x 4B54
0x 4B58
0x 4B5C
0x 4B60
0x 4B64
0x 4B68
0x 4B6C
0x 4B70
0x 4B74
0x 4B78
0x 4B7C
0x 4B80
0x 4B84
0x 4B88
0x 4B8C
0x 4B90
0x 4B94
0x 4B98
0x 4B9C
0x 4BAC
0x 4BB0
0x 4BB4
0x 4BB8
0x 4BBC
0x 4BC0
0x 4BC4
0x 4BC8
0x 4BCC
0x 4BD0
0x 4BD4
0x 4BD8
0x 4BDC
0x 4BE0
0x 4BE4
0x 4BE8
0x 4BEC
0x 4BF0
0x 4BF4
0x 4BF8
0x 4BFC
0x 2980
0x 29D8
0x 2944
0x 297C
0x 29D4
0x 2988
0x 2984
0x 2948
0x 4C04
0x 4C08
0x 4C0C
0x 4C10
0x 4C14
0x 4C18
0x 4C1C
0x 4C20
0x 4C24
0x 4C28
0x 4C2C
0x 4C30
0x 4C34
0x 4C38
0x 4C3C
0x 4C40
0x 4C44
0x 4C48
0x 4C4C
0x 4C50
0x 4C54
0x 4C58
0x 4C5C
0x 4C60
0x 4C64
0x 4C68
0x 4C6C
0x 4C70
0x 4C74
0x 4C78
0x 4C7C
0x 4C80
0x 4C84
0x 4C88
0x 4C8C
0x 4C90
0x 4C94
0x 4C98
0x 4C9C
0x 4CA0
0x 4CA4
0x 4CA8
0x 4CAC
0x 4CB0
0x 4CB4
0x 4CB8
0x 4CBC
0x 4CC0
0x 4CC4
0x 4CC8
0x 4CCC
0x 4CD0
0x 4CD4
0x 4CD8
0x 4CDC
0x 4CE0
0x 4CE4
0x 4CE8
0x 4CEC
0x 4CF0
0x 4CF4
0x 4CF8
0x 4CFC
0x 4D00
0x 4D04
0x 4D08
0x 4D0C
0x 4D10
0x 4D14
0x 4D18
0x 4D1C
0x 4D20
0x 4D24
0x 4D28
0x 4D2C
0x 4D30
0x 4D34
0x 4D38
0x 4D3C
0x 4D40
0x 4D44
0x 4D48
0x 4D4C
0x 4D50
0x 4D54
0x 4D58
0x 4D5C
0x 4D60
0x 4D64
0x 4D68
0x 4D6C
0x 4D70
0x 4D74
0x 4D78
0x 4D7C
0x 4D80
0x 4D84
0x 4D88
0x 4D8C
0x 4D90
0x 4D94
0x 4D98
0x 4D9C
0x 4DA0
0x 4DA4
0x 4DA8
0x 4DAC
0x 4DB0
0x 4DB4
0x 4DB8
0x 4DBC
0x 4DC0
0x 4DC4
0x 4DC8
0x 4DCC
0x 4DD0
0x 4DD4
0x 4DD8
0x 4DDC
0x 4DE0
0x 4DE4
0x 4DE8
0x 4DEC
0x 4DF0
0x 4DF4
0x 4DF8
0x 4DFC
0x 4E00
0x 4E04
0x 4E08
0x 4E0C
0x 4E10
0x 4E14
0x 4E18
0x 4E1C
0x 4E20
0x 4E24
0x 4E28
0x 4E2C
0x 4E30
0x 4E34
0x 4E38
0x 4E3C
0x 4E40
0x 4E44
0x 4E48
0x 4E4C
0x 4E50
0x 4E54
0x 4E58
0x 4E5C
0x 4E60
0x 4E64
0x 4E68
0x 4E6C
0x 4E70
0x 4E74
0x 4E78
0x 4E7C
0x 4E80
0x 4E84
0x 4E88
0x 4E8C
0x 4E90
0x 4E94
0x 4E98
0x 4E9C
0x 4EA0
0x 4EA4
0x 4EA8
0x 4EAC
0x 4EB0
0x 4EB4
0x 4EB8
0x 4EBC
0x 4EC0
0x 4EC4
0x 4EC8
0x 4ECC
0x 4ED0
0x 4ED4
0x 4ED8
0x 4EDC
0x 4EE0
0x 4EE4
0x 4EE8
0x 4EEC
0x 4EF0
0x 4EF4
0x 4EF8
0x 4EFC
0x 4F00
0x 4F04
0x 4F08
0x 4F0C
0x 4F10
0x 4F14
0x 4F18
0x 4F1C
0x 4F20
0x 4F24
0x 4F28
0x 4F2C
0x 4F34
0x 4F38
0x 4F3C
0x 4F40
0x 4F44
0x 4F48
0x 4F4C
0x 4F50
0x 4F54
0x 4F58
0x 4F5C
0x 4F60
0x 4F64
0x 4F68
0x 4F6C
0x 4F70
0x 4F74
0x 4F78
0x 4F7C
0x 4F80
0x 4F84
0x 4F88
0x 4F8C
0x 4F90
0x 4F94
0x 4F98
0x 4F9C
0x 4FA0
0x 4FA4
0x 4FA8
0x 4FAC
0x 4FB0
0x 4FB4
0x 4FB8
0x 4FBC
0x 4FC0
0x 4FC4
0x 4FC8
0x 4FCC
0x 4FD0
0x 4FD4
0x 4FD8
0x 4FDC
0x 4FE0
0x 4FE4
0x 4FE8
0x 4FEC
0x 4FF0
0x 4FF4
0x 4FF8
0x 4FFC
0x 730
0x 750
0x 4F30
0x 5004
0x 5008
0x 500C
0x 5010
0x 5014
0x 5018
0x 501C
0x 5020
0x 5024
0x 5028
0x 502C
0x 5030
0x 5034
0x 5038
0x 503C
0x 5040
0x 5044
0x 5048
0x 504C
0x 5050
0x 5054
0x 5058
0x 505C
0x 5060
0x 5064
0x 5068
0x 506C
0x 5070
0x 5074
0x 5078
0x 507C
0x 5080
0x 5084
0x 5088
0x 508C
0x 5090
0x 5094
0x 5098
0x 509C
0x 50A0
0x 50A4
0x 50A8
0x 50AC
0x 50B0
0x 50B4
0x 50B8
0x 50BC
0x 50C0
0x 50C4
0x 50C8
0x 50CC
0x 50D0
0x 50D4
0x 50D8
0x 50DC
0x 50E0
0x 50E4
0x 50E8
0x 50EC
0x 50F0
0x 50F4
0x 50F8
0x 50FC
0x 5100
0x 5104
0x 5108
0x 510C
0x 5110
0x 5114
0x 5118
0x 511C
0x 5120
0x 5124
0x 5128
0x 512C
0x 5130
0x 5134
0x 5138
0x 513C
0x 5140
0x 5144
0x 5148
0x 514C
0x 5158
0x 515C
0x 5160
0x 5164
0x 5168
0x 516C
0x 5170
0x 5174
0x 5178
0x 517C
0x 5180
0x 5184
0x 5188
0x 518C
0x 5190
0x 519C
0x 51A0
0x 51A4
0x 51A8
0x 51AC
0x 51B0
0x 51B4
0x 51B8
0x 51BC
0x 51C0
0x 51C4
0x 51C8
0x 51CC
0x 51D0
0x 51D4
0x 51D8
0x 51DC
0x 51E0
0x 51E4
0x 51E8
0x 51EC
0x 51F0
0x 51F4
0x 51F8
0x 51FC
0x 5200
0x 5204
0x 5208
0x 520C
0x 5210
0x 5214
0x 5218
0x 521C
0x 5220
0x 5224
0x 5228
0x 522C
0x 5230
0x 5234
0x 5238
0x 523C
0x 5240
0x 5244
0x 5250
0x 5254
0x 5258
0x 525C
0x 5260
0x 5264
0x 5268
0x 526C
0x 5270
0x 5274
0x 5278
0x 527C
0x 5280
0x 5284
0x 5288
0x 528C
0x 5290
0x 5294
0x 5298
0x 529C
0x 52A0
0x 52A4
0x 52A8
0x 52AC
0x 52B0
0x 52B4
0x 52B8
0x 52BC
0x 52C0
0x 52C4
0x 52C8
0x 52CC
0x 52D4
0x 52D8
0x 52DC
0x 52E0
0x 52E4
0x 52E8
0x 52EC
0x 52F0
0x 52F4
0x 52F8
0x 52FC
0x 5300
0x 5304
0x 5308
0x 530C
0x 5310
0x 531C
0x 5320
0x 5324
0x 5328
0x 532C
0x 5330
0x 5334
0x 5338
0x 533C
0x 5340
0x 5344
0x 5348
0x 534C
0x 5350
0x 5354
0x 5358
0x 535C
0x 5360
0x 5364
0x 5368
0x 536C
0x 5370
0x 5374
0x 5378
0x 537C
0x 5380
0x 5384
0x 5388
0x 538C
0x 5390
0x 5394
0x 5398
0x 539C
0x 53A0
0x 53A4
0x 53A8
0x 53AC
0x 53B0
0x 53B4
0x 53B8
0x 53BC
0x 53C0
0x 53C4
0x 53C8
0x 53CC
0x 53D0
0x 53D4
0x 53D8
0x 53DC
0x 53E0
0x 53E4
0x 53E8
0x 53EC
0x 53F0
0x 53F4
0x 53F8
0x 53FC
0x 510C
0x 5198
0x 5248
0x 5318
0x 52D0
0x 5314
0x 5154
0x 5150
0x 524C
0x 5404
0x 5408
0x 540C
0x 5410
0x 5414
0x 5418
0x 541C
0x 5420
0x 5424
0x 5428
0x 542C
0x 5430
0x 5434
0x 5438
0x 543C
0x 5440
0x 5444
0x 5448
0x 544C
0x 5450
0x 5454
0x 5458
0x 545C
0x 5460
0x 5464
0x 5468
0x 546C
0x 5470
0x 5474
0x 5478
0x 547C
0x 5480
0x 5484
0x 5488
0x 548C
0x 5490
0x 5494
0x 5498
0x 549C
0x 54A0
0x 54A4
0x 54A8
0x 54AC
0x 54B0
0x 54B4
0x 54B8
0x 54BC
0x 54C0
0x 54C4
0x 54C8
0x 54CC
0x 54D0
0x 54D4
0x 54D8
0x 54DC
0x 54E0
0x 54E4
0x 54E8
0x 54EC
0x 54F0
0x 54F4
0x 54F8
0x 54FC
0x 5500
0x 5504
0x 5508
0x 550C
0x 5510
0x 5514
0x 5518
0x 551C
0x 5520
0x 5524
0x 5528
0x 552C
0x 5530
0x 5534
0x 5538
0x 553C
0x 5540
0x 5544
0x 5548
0x 554C
0x 5550
0x 5554
0x 5558
0x 555C
0x 5560
0x 5564
0x 5568
0x 556C
0x 5570
0x 5574
0x 5578
0x 557C
0x 5580
0x 5584
0x 5588
0x 558C
0x 5590
0x 5594
0x 5598
0x 559C
0x 55A0
0x 55A4
0x 55A8
0x 55AC
0x 55B0
0x 55B4
0x 55B8
0x 55BC
0x 55C0
0x 55C4
0x 55C8
0x 55CC
0x 55D0
0x 55D4
0x 55D8
0x 55DC
0x 55E0
0x 55E4
0x 55E8
0x 55EC
0x 55F0
0x 55F4
0x 55F8
0x 55FC
0x 5600
0x 5604
0x 5608
0x 560C
0x 5610
0x 5614
0x 5618
0x 561C
0x 5620
0x 5624
0x 5628
0x 562C
0x 5630
0x 5634
0x 5638
0x 563C
0x 5640
0x 5644
0x 5648
0x 564C
0x 5650
0x 5654
0x 5658
0x 565C
0x 5660
0x 5664
0x 5668
0x 566C
0x 5670
0x 5674
0x 5678
0x 567C
0x 5680
0x 5684
0x 5688
0x 568C
0x 5690
0x 5694
0x 5698
0x 569C
0x 56A0
0x 56A4
0x 56A8
0x 56AC
0x 56B0
0x 56B4
0x 56B8
0x 56BC
0x 56C0
0x 56C4
0x 56C8
0x 56CC
0x 56D0
0x 56D4
0x 56D8
0x 56DC
0x 56E0
0x 56E4
0x 56E8
0x 56EC
0x 56F0
0x 56F4
0x 56F8
0x 5700
0x 5704
0x 5708
0x 570C
0x 5710
0x 5714
0x 5718
0x 571C
0x 5720
0x 5724
0x 5728
0x 572C
0x 5730
0x 5734
0x 5738
0x 573C
0x 5740
0x 5744
0x 5748
0x 574C
0x 5750
0x 5754
0x 5758
0x 575C
0x 5760
0x 5764
0x 5768
0x 576C
0x 5770
0x 5774
0x 5778
0x 577C
0x 5780
0x 5784
0x 5788
0x 578C
0x 5790
0x 5794
0x 5798
0x 579C
0x 57A0
0x 57A4
0x 57A8
0x 57AC
0x 57B0
0x 57B4
0x 57B8
0x 57BC
0x 57C0
0x 57C4
0x 57C8
0x 57CC
0x 57D0
0x 57D4
0x 57D8
0x 57DC
0x 57E0
0x 57E4
0x 57E8
0x 57EC
0x 57F0
0x 57F4
0x 57F8
0x 5194
0x 4BA8
0x 5804
0x 5808
0x 580C
0x 5810
0x 5814
0x 5818
0x 581C
0x 5820
0x 5824
0x 5828
0x 582C
0x 5830
0x 5834
0x 5838
0x 583C
0x 5840
0x 5844
0x 5848
0x 584C
0x 5850
0x 5854
0x 5858
0x 585C
0x 5864
0x 5868
0x 586C
0x 5870
0x 5874
0x 5878
0x 587C
0x 5880
0x 5884
0x 5888
0x 588C
0x 5890
0x 5894
0x 5898
0x 589C
0x 58A0
0x 58A4
0x 58A8
0x 58AC
0x 58B0
0x 58B4
0x 58B8
0x 58BC
0x 58C0
0x 58C4
0x 58C8
0x 58CC
0x 58D0
0x 58D4
0x 58D8
0x 58DC
0x 58E0
0x 58E4
0x 58E8
0x 58EC
0x 58F0
0x 58F4
0x 58F8
0x 58FC
0x 5900
0x 5904
0x 5908
0x 590C
0x 5910
0x 5918
0x 591C
0x 5920
0x 5924
0x 5928
0x 592C
0x 5930
0x 5934
0x 5938
0x 593C
0x 5940
0x 5944
0x 5948
0x 594C
0x 5950
0x 5954
0x 5960
0x 5964
0x 5968
0x 596C
0x 5970
0x 5974
0x 5978
0x 597C
0x 5980
0x 5984
0x 5988
0x 598C
0x 5990
0x 5994
0x 5998
0x 599C
0x 59A0
0x 59A4
0x 59A8
0x 59AC
0x 59B0
0x 59B4
0x 59B8
0x 59BC
0x 59C0
0x 59C4
0x 59C8
0x 59CC
0x 59D0
0x 59D4
0x 59D8
0x 59DC
0x 59E0
0x 59E4
0x 59E8
0x 59EC
0x 59F0
0x 59F4
0x 59F8
0x 59FC
0x 5A00
0x 5A04
0x 5A08
0x 5A0C
0x 5A10
0x 5A14
0x 5A18
0x 5A1C
0x 5A20
0x 5A24
0x 5A28
0x 5A2C
0x 5A30
0x 5A34
0x 5A38
0x 5A3C
0x 5A40
0x 5A44
0x 5A48
0x 5A4C
0x 5A50
0x 5A54
0x 5A58
0x 5A5C
0x 5A60
0x 5A64
0x 5A68
0x 5A6C
0x 5A70
0x 5A74
0x 5A78
0x 5A7C
0x 5A80
0x 5A84
0x 5A88
0x 5A8C
0x 5A90
0x 5A94
0x 5A98
0x 5A9C
0x 5AA0
0x 5AA4
0x 5AA8
0x 5AAC
0x 5AB0
0x 5AB4
0x 5AB8
0x 5ABC
0x 5AC0
0x 5AC4
0x 5AC8
0x 5ACC
0x 5AD0
0x 5AD4
0x 5AD8
0x 5ADC
0x 5AE0
0x 5AE4
0x 5AE8
0x 5AEC
0x 5AF0
0x 5AF4
0x 5AF8
0x 5AFC
0x 5B00
0x 5B04
0x 5B08
0x 5B0C
0x 5B10
0x 5B14
0x 5B18
0x 5B1C
0x 5B20
0x 5B24
0x 5B28
0x 5B2C
0x 5B30
0x 5B34
0x 5B38
0x 5B3C
0x 5B40
0x 5B44
0x 5B48
0x 5B4C
0x 5B50
0x 5B54
0x 5B58
0x 5B5C
0x 5B60
0x 5B64
0x 5B68
0x 5B6C
0x 5B70
0x 5B74
0x 5B78
0x 5B7C
0x 5B80
0x 5B84
0x 5B88
0x 5B8C
0x 5B90
0x 5B94
0x 5B98
0x 5B9C
0x 5BA0
0x 5BA4
0x 5BA8
0x 5BAC
0x 5BB0
0x 5BB4
0x 5BB8
0x 5BBC
0x 5BC0
0x 5BC4
0x 5BC8
0x 5BCC
0x 5BD0
0x 5BD4
0x 5BD8
0x 5BDC
0x 5BE0
0x 5BE4
0x 5BE8
0x 5BEC
0x 5BF0
0x 5BF4
0x 5BF8
0x 5BFC
0x 5C04
0x 5C08
0x 5C0C
0x 5C10
0x 5C14
0x 5C18
0x 5C1C
0x 5C20
0x 5C24
0x 5C28
0x 5C2C
0x 5C30
0x 5C34
0x 5C38
0x 5C3C
0x 5C40
0x 5C44
0x 5C48
0x 5C4C
0x 5C50
0x 5C54
0x 5C58
0x 5C5C
0x 5C60
0x 5C64
0x 5C68
0x 5C6C
0x 5C70
0x 5C74
0x 5C78
0x 5C7C
0x 5C80
0x 5C84
0x 5C88
0x 5C8C
0x 5C90
0x 5C94
0x 5C98
0x 5C9C
0x 5CA0
0x 5CA4
0x 5CA8
0x 5CAC
0x 5CB0
0x 5CB4
0x 5CB8
0x 5CBC
0x 5CC0
0x 5CC4
0x 5CC8
0x 5CCC
0x 5CD0
0x 5CD4
0x 5CD8
0x 5CDC
0x 5CE0
0x 5CE4
0x 5CE8
0x 5CEC
0x 5CF0
0x 5CF4
0x 5CF8
0x 5CFC
0x 5D00
0x 5D04
0x 5D08
0x 5D0C
0x 5D10
0x 5D14
0x 5D18
0x 5D1C
0x 5D20
0x 5D24
0x 5D28
0x 5D2C
0x 5D30
0x 5D34
0x 5D38
0x 5D3C
0x 5D40
0x 5D44
0x 5D48
0x 5D4C
0x 5D50
0x 5D54
0x 5D58
0x 5D5C
0x 5D60
0x 5D64
0x 5D68
0x 5D6C
0x 5D70
0x 5D74
0x 5D78
0x 5D7C
0x 5D80
0x 5D84
0x 5D88
0x 5D8C
0x 5D90
0x 5D94
0x 5D98
0x 5D9C
0x 5DA0
0x 5DA4
0x 5DA8
0x 5DAC
0x 5DB0
0x 5DB4
0x 5DB8
0x 5DBC
0x 5DC0
0x 5DC4
0x 5DC8
0x 5DCC
0x 5DD0
0x 5DD4
0x 5DD8
0x 5DDC
0x 5DE0
0x 5DE4
0x 5DE8
0x 5DEC
0x 5DF0
0x 5DF4
0x 5DF8
0x 5DFC
0x 5E00
0x 5E04
0x 5E08
0x 5E0C
0x 5E10
0x 5E14
0x 5E18
0x 5E1C
0x 5E20
0x 5E24
0x 5E28
0x 5E2C
0x 5E30
0x 5E34
0x 5E38
0x 5E3C
0x 5E40
0x 5E44
0x 5E48
0x 5E4C
0x 5E50
0x 5E54
0x 5E58
0x 5E5C
0x 5E60
0x 5E64
0x 5E68
0x 5E6C
0x 5E70
0x 5E74
0x 5E78
0x 5E7C
0x 5E80
0x 5E84
0x 5E88
0x 5E8C
0x 5E90
0x 5E94
0x 5E98
0x 5E9C
0x 5EA0
0x 5EA4
0x 5EA8
0x 5EAC
0x 5EB0
0x 5EB4
0x 5EB8
0x 5EBC
0x 5EC0
0x 5EC4
0x 5EC8
0x 5ECC
0x 5ED0
0x 5ED8
0x 5EDC
0x 5EE0
0x 5EE4
0x 5EE8
0x 5EEC
0x 5EF0
0x 5EF4
0x 5EF8
0x 5EFC
0x 5F00
0x 5F04
0x 5F08
0x 5F0C
0x 5F10
0x 5F14
0x 5F18
0x 5F1C
0x 5F20
0x 5F24
0x 5F28
0x 5F2C
0x 5F30
0x 5F34
0x 5F38
0x 5F3C
0x 5F40
0x 5F44
0x 5F48
0x 5F4C
0x 5F50
0x 5F58
0x 5F5C
0x 5F60
0x 5F64
0x 5F68
0x 5F6C
0x 5F70
0x 5F74
0x 5F78
0x 5F7C
0x 5F80
0x 5F84
0x 5F88
0x 5F98
0x 5F9C
0x 5FA0
0x 5FA4
0x 5FA8
0x 5FB0
0x 5FB4
0x 5FB8
0x 5FBC
0x 5FC0
0x 5FC4
0x 5FC8
0x 5FCC
0x 5FD8
0x 5FDC
0x 5FE0
0x 5FE4
0x 5FE8
0x 5FEC
0x 5FF0
0x 5FF4
0x 5FF8
0x 5FFC
0x 6E0
0x 710
0x 69C
0x 4FC
0x 3A0
0x 5B4
0x 760
0x 58C
0x 790
0x 5F0
0x 5F4
0x 31C
0x 768
0x 6C8
0x 595C
0x 4EC
0x 4C8
0x 4B4
0x 24C
0x 48C
0x 39C
0x 6004
0x 6008
0x 600C
0x 6010
0x 6014
0x 6018
0x 601C
0x 6020
0x 6024
0x 6028
0x 602C
0x 6030
0x 6034
0x 6038
0x 603C
0x 6040
0x 6044
0x 6048
0x 604C
0x 6050
0x 6054
0x 6058
0x 605C
0x 6060
0x 6064
0x 6068
0x 606C
0x 6070
0x 6074
0x 6078
0x 607C
0x 6080
0x 6084
0x 6088
0x 608C
0x 6090
0x 6094
0x 6098
0x 609C
0x 60A0
0x 60A4
0x 60A8
0x 60AC
0x 60B0
0x 60B4
0x 60B8
0x 60BC
0x 60C0
0x 60C4
0x 60C8
0x 60CC
0x 60D0
0x 60D4
0x 60D8
0x 60DC
0x 60E0
0x 60E4
0x 60E8
0x 60EC
0x 60F0
0x 60F4
0x 60F8
0x 60FC
0x 6100
0x 6104
0x 6108
0x 610C
0x 6110
0x 6114
0x 6118
0x 611C
0x 6120
0x 6124
0x 6128
0x 612C
0x 6130
0x 6134
0x 6138
0x 613C
0x 6140
0x 6144
0x 6148
0x 614C
0x 6150
0x 6154
0x 6158
0x 615C
0x 6160
0x 6164
0x 6168
0x 616C
0x 6170
0x 6174
0x 6178
0x 617C
0x 6180
0x 6184
0x 6188
0x 618C
0x 6190
0x 6194
0x 6198
0x 619C
0x 61A0
0x 61A4
0x 61AC
0x 61A8
0x 61B0
0x 61B4
0x 61B8
0x 61BC
0x 61C0
0x 61C4
0x 61C8
0x 61CC
0x 61D0
0x 61D4
0x 61D8
0x 61DC
0x 61E0
0x 61E4
0x 61E8
0x 61EC
0x 61F0
0x 61F4
0x 61F8
0x 620C
0x 6210
0x 6214
0x 6218
0x 621C
0x 6220
0x 6224
0x 6228
0x 622C
0x 6230
0x 6234
0x 623C
0x 6240
0x 6244
0x 624C
0x 6250
0x 6254
0x 6258
0x 6268
0x 626C
0x 6270
0x 6274
0x 6278
0x 627C
0x 6280
0x 6284
0x 6288
0x 628C
0x 6290
0x 6298
0x 629C
0x 62A0
0x 62A4
0x 62A8
0x 62AC
0x 62B0
0x 62B4
0x 62B8
0x 62BC
0x 62C0
0x 62C4
0x 62C8
0x 62CC
0x 62D0
0x 62D4
0x 62D8
0x 62DC
0x 62E0
0x 62E4
0x 62E8
0x 62EC
0x 62F0
0x 62F4
0x 62F8
0x 62FC
0x 6300
0x 6304
0x 6308
0x 630C
0x 6310
0x 6314
0x 6318
0x 631C
0x 6320
0x 6324
0x 6328
0x 632C
0x 6330
0x 6334
0x 6338
0x 633C
0x 6340
0x 6344
0x 6348
0x 634C
0x 6350
0x 6354
0x 6358
0x 635C
0x 6360
0x 6364
0x 6368
0x 636C
0x 6370
0x 6374
0x 6378
0x 637C
0x 6380
0x 6384
0x 6388
0x 638C
0x 6390
0x 6394
0x 6398
0x 639C
0x 63A0
0x 63A4
0x 63A8
0x 63AC
0x 63B0
0x 63B4
0x 63B8
0x 63BC
0x 63C0
0x 63C4
0x 63C8
0x 63CC
0x 63D0
0x 63D4
0x 63D8
0x 63DC
0x 63E0
0x 63E4
0x 63E8
0x 63EC
0x 63F0
0x 63F4
0x 63F8
0x 63FC
0x 128
0x 228
0x 12C
0x 61AC
0x 6208
0x 834
0x 6264
0x 625C
0x 6260
0x 6204
0x 30C
0x 6404
0x 6408
0x 640C
0x 6410
0x 6414
0x 6418
0x 641C
0x 6420
0x 6424
0x 6428
0x 642C
0x 6430
0x 6434
0x 6438
0x 643C
0x 6440
0x 6444
0x 6448
0x 644C
0x 6450
0x 6454
0x 6458
0x 645C
0x 6460
0x 6464
0x 6468
0x 646C
0x 6470
0x 6474
0x 6478
0x 647C
0x 6480
0x 6484
0x 6488
0x 648C
0x 6490
0x 6494
0x 6498
0x 649C
0x 64A0
0x 64A4
0x 64A8
0x 64AC
0x 64B0
0x 64B4
0x 64B8
0x 64BC
0x 64C0
0x 64C4
0x 64C8
0x 64CC
0x 64D0
0x 64D4
0x 64D8
0x 64DC
0x 64E0
0x 64E4
0x 64E8
0x 64EC
0x 64F0
0x 64F4
0x 64F8
0x 64FC
0x 6500
0x 6504
0x 6508
0x 650C
0x 6510
0x 6514
0x 6518
0x 651C
0x 6520
0x 6524
0x 6528
0x 652C
0x 6530
0x 6534
0x 6538
0x 653C
0x 6540
0x 6544
0x 6548
0x 654C
0x 6550
0x 6554
0x 6558
0x 655C
0x 6560
0x 6564
0x 6568
0x 656C
0x 6570
0x 6574
0x 6578
0x 657C
0x 6580
0x 6584
0x 6588
0x 658C
0x 6590
0x 6594
0x 6598
0x 659C
0x 65A0
0x 65A4
0x 65A8
0x 65AC
0x 65B0
0x 65B4
0x 65B8
0x 65BC
0x 65C0
0x 65C4
0x 65C8
0x 65CC
0x 65D0
0x 65D4
0x 65D8
0x 65DC
0x 65E0
0x 65E4
0x 65E8
0x 65EC
0x 65F0
0x 65F4
0x 65F8
0x 65FC
0x 6600
0x 6604
0x 6608
0x 660C
0x 6610
0x 6614
0x 6618
0x 661C
0x 6620
0x 6624
0x 6628
0x 662C
0x 6630
0x 6634
0x 6638
0x 663C
0x 6640
0x 6644
0x 6648
0x 664C
0x 6650
0x 6654
0x 6658
0x 665C
0x 6660
0x 6664
0x 6668
0x 666C
0x 6670
0x 6674
0x 6678
0x 667C
0x 6680
0x 6684
0x 6688
0x 668C
0x 6690
0x 6694
0x 6698
0x 669C
0x 66A0
0x 66A4
0x 66A8
0x 66AC
0x 66B0
0x 66B4
0x 66B8
0x 66BC
0x 66C0
0x 66C4
0x 66C8
0x 66CC
0x 66D0
0x 66D4
0x 66D8
0x 66DC
0x 66E0
0x 66E4
0x 66E8
0x 66EC
0x 66F0
0x 66F4
0x 66F8
0x 66FC
0x 6700
0x 6704
0x 6708
0x 670C
0x 6710
0x 6714
0x 6718
0x 671C
0x 6720
0x 6724
0x 6728
0x 672C
0x 6730
0x 6734
0x 6738
0x 673C
0x 6740
0x 6744
0x 6748
0x 674C
0x 6750
0x 6754
0x 6758
0x 675C
0x 6760
0x 6764
0x 6768
0x 676C
0x 6770
0x 6774
0x 6778
0x 677C
0x 6780
0x 6784
0x 6788
0x 678C
0x 6790
0x 6794
0x 6798
0x 679C
0x 67A0
0x 67A4
0x 67A8
0x 67AC
0x 67B0
0x 67B4
0x 67B8
0x 67BC
0x 67C0
0x 67C4
0x 67C8
0x 67CC
0x 67D0
0x 67D4
0x 67D8
0x 67DC
0x 67E0
0x 67E4
0x 67E8
0x 67EC
0x 67F0
0x 67F4
0x 67F8
0x 67FC
0x F98
0x 6804
0x 6808
0x 680C
0x 6810
0x 6814
0x 6818
0x 681C
0x 6820
0x 6824
0x 6828
0x 682C
0x 6830
0x 6834
0x 6838
0x 683C
0x 6840
0x 6844
0x 6848
0x 684C
0x 6850
0x 6854
0x 6858
0x 685C
0x 6860
0x 6864
0x 6868
0x 686C
0x 6870
0x 6874
0x 6878
0x 687C
0x 6880
0x 6884
0x 6888
0x 688C
0x 6890
0x 6894
0x 6898
0x 689C
0x 68A0
0x 68A4
0x 68A8
0x 68AC
0x 68B0
0x 68B4
0x 68B8
0x 68BC
0x 68C0
0x 68C4
0x 68C8
0x 68CC
0x 68D0
0x 68D4
0x 68D8
0x 68DC
0x 68E0
0x 68E4
0x 68E8
0x 68EC
0x 68F0
0x 68F4
0x 68F8
0x 68FC
0x 6900
0x 6904
0x 6908
0x 690C
0x 6910
0x 6914
0x 6918
0x 691C
0x 6920
0x 6924
0x 6928
0x 692C
0x 6930
0x 6934
0x 6938
0x 693C
0x 6940
0x 6944
0x 6948
0x 694C
0x 6950
0x 6954
0x 6958
0x 695C
0x 6960
0x 6964
0x 6968
0x 696C
0x 6970
0x 6974
0x 6978
0x 697C
0x 6980
0x 6984
0x 6988
0x 698C
0x 6990
0x 6994
0x 6998
0x 699C
0x 69A0
0x 69A4
0x 69A8
0x 69AC
0x 69B0
0x 69B4
0x 69B8
0x 69BC
0x 69C0
0x 69C4
0x 69C8
0x 69CC
0x 69D0
0x 69D4
0x 69D8
0x 69DC
0x 69E0
0x 69E4
0x 69E8
0x 69EC
0x 69F0
0x 69F4
0x 69F8
0x 69FC
0x 6A00
0x 6A04
0x 6A08
0x 6A0C
0x 6A10
0x 6A14
0x 6A18
0x 6A1C
0x 6A20
0x 6A24
0x 6A28
0x 6A2C
0x 6A30
0x 6A34
0x 6A38
0x 6A3C
0x 6A40
0x 6A44
0x 6A48
0x 6A4C
0x 6A50
0x 6A54
0x 6A58
0x 6A5C
0x 6A60
0x 6A64
0x 6A68
0x 6A6C
0x 6A70
0x 6A74
0x 6A78
0x 6A7C
0x 6A80
0x 6A84
0x 6A88
0x 6A8C
0x 6A90
0x 6A94
0x 6A98
0x 6A9C
0x 6AA0
0x 6AA4
0x 6AA8
0x 6AAC
0x 6AB0
0x 6AB4
0x 6AB8
0x 6ABC
0x 6AC0
0x 6AC4
0x 6AC8
0x 6ACC
0x 6AD0
0x 6AD4
0x 6AD8
0x 6ADC
0x 6AE0
0x 6AE4
0x 6AE8
0x 6AEC
0x 6AF0
0x 6AF4
0x 6AF8
0x 6AFC
0x 6B00
0x 6B04
0x 6B08
0x 6B0C
0x 6B10
0x 6B14
0x 6B18
0x 6B1C
0x 6B20
0x 6B24
0x 6B28
0x 6B2C
0x 6B30
0x 6B34
0x 6B38
0x 6B3C
0x 6B40
0x 6B44
0x 6B48
0x 6B4C
0x 6B50
0x 6B54
0x 6B58
0x 6B5C
0x 6B60
0x 6B64
0x 6B68
0x 6B6C
0x 6B70
0x 6B74
0x 6B78
0x 6B7C
0x 6B80
0x 6B84
0x 6B88
0x 6B8C
0x 6B90
0x 6B94
0x 6B98
0x 6B9C
0x 6BA0
0x 6BA4
0x 6BA8
0x 6BAC
0x 6BB0
0x 6BB4
0x 6BB8
0x 6BBC
0x 6BC0
0x 6BC4
0x 6BC8
0x 6BCC
0x 6BD0
0x 6BD4
0x 6BD8
0x 6BDC
0x 6BE0
0x 6BE4
0x 6BE8
0x 6BEC
0x 6BF0
0x 6BF4
0x 6BF8
0x 6BFC
0x 6C04
0x 6C08
0x 6C0C
0x 6C10
0x 6C14
0x 6C18
0x 6C1C
0x 6C20
0x 6C24
0x 6C28
0x 6C2C
0x 6C30
0x 6C34
0x 6C38
0x 6C3C
0x 6C40
0x 6C44
0x 6C48
0x 6C4C
0x 6C50
0x 6C54
0x 6C58
0x 6C5C
0x 6C60
0x 6C64
0x 6C68
0x 6C6C
0x 6C70
0x 6C74
0x 6C78
0x 6C7C
0x 6C80
0x 6C84
0x 6C88
0x 6C8C
0x 6C90
0x 6C94
0x 6C98
0x 6C9C
0x 6CA0
0x 6CA4
0x 6CA8
0x 6CAC
0x 6CB0
0x 6CB4
0x 6CB8
0x 6CBC
0x 6CC0
0x 6CC4
0x 6CC8
0x 6CCC
0x 6CD0
0x 6CD4
0x 6CD8
0x 6CDC
0x 6CE0
0x 6CE4
0x 6CE8
0x 6CEC
0x 6CF0
0x 6CF4
0x 6CF8
0x 6CFC
0x 6D00
0x 6D04
0x 6D08
0x 6D0C
0x 6D10
0x 6D14
0x 6D18
0x 6D1C
0x 6D20
0x 6D24
0x 6D28
0x 6D2C
0x 6D30
0x 6D34
0x 6D38
0x 6D3C
0x 6D40
0x 6D44
0x 6D48
0x 6D4C
0x 6D50
0x 6D54
0x 6D58
0x 6D5C
0x 6D60
0x 6D64
0x 6D68
0x 6D6C
0x 6D70
0x 6D74
0x 6D78
0x 6D7C
0x 6D80
0x 6D84
0x 6D88
0x 6D8C
0x 6D90
0x 6D94
0x 6D98
0x 6D9C
0x 6DA0
0x 6DA4
0x 6DA8
0x 6DAC
0x 6DB0
0x 6DB4
0x 6DB8
0x 6DBC
0x 6DC0
0x 6DC4
0x 6DC8
0x 6DCC
0x 6DD0
0x 6DD4
0x 6DD8
0x 6DDC
0x 6DE0
0x 6DE4
0x 6DE8
0x 6DEC
0x 6DF0
0x 6DF4
0x 6DF8
0x 6DFC
0x 6E00
0x 6E04
0x 6E08
0x 6E0C
0x 6E10
0x 6E14
0x 6E18
0x 6E1C
0x 6E20
0x 6E24
0x 6E28
0x 6E2C
0x 6E30
0x 6E34
0x 6E38
0x 6E3C
0x 6E40
0x 6E44
0x 6E48
0x 6E4C
0x 6E50
0x 6E54
0x 6E58
0x 6E5C
0x 6E60
0x 6E64
0x 6E68
0x 6E6C
0x 6E70
0x 6E74
0x 6E78
0x 6E7C
0x 6E80
0x 6E84
0x 6E88
0x 6E8C
0x 6E90
0x 6E94
0x 6E98
0x 6E9C
0x 6EA0
0x 6EA4
0x 6EA8
0x 6EAC
0x 6EB0
0x 6EB4
0x 6EB8
0x 6EBC
0x 6EC0
0x 6EC4
0x 6EC8
0x 6ECC
0x 6ED0
0x 6ED4
0x 6ED8
0x 6EDC
0x 6EE0
0x 6EE4
0x 6EE8
0x 6EEC
0x 6EF0
0x 6EF4
0x 6EF8
0x 6EFC
0x 6F00
0x 6F04
0x 6F08
0x 6F0C
0x 6F10
0x 6F14
0x 6F18
0x 6F1C
0x 6F20
0x 6F24
0x 6F28
0x 6F2C
0x 6F30
0x 6F34
0x 6F38
0x 6F3C
0x 6F40
0x 6F44
0x 6F48
0x 6F4C
0x 6F50
0x 6F54
0x 6F58
0x 6F5C
0x 6F60
0x 6F64
0x 6F68
0x 6F6C
0x 6F70
0x 6F74
0x 6F78
0x 6F7C
0x 6F80
0x 6F84
0x 6F88
0x 6F8C
0x 6F90
0x 6F94
0x 6F98
0x 6F9C
0x 6FA0
0x 6FA4
0x 6FA8
0x 6FAC
0x 6FB0
0x 6FB4
0x 6FB8
0x 6FBC
0x 6FC0
0x 6FC4
0x 6FC8
0x 6FCC
0x 6FD0
0x 6FD4
0x 6FD8
0x 6FDC
0x 6FE0
0x 6FE4
0x 6FE8
0x 6FEC
0x 6FF0
0x 6FF4
0x 6FF8
0x 6FFC
0x 390
0x 6E8
0x C8
0x 7004
0x 7008
0x 700C
0x 7010
0x 7014
0x 7018
0x 701C
0x 7020
0x 7024
0x 7028
0x 702C
0x 7030
0x 7034
0x 7038
0x 703C
0x 7040
0x 7044
0x 7048
0x 704C
0x 7050
0x 7054
0x 7058
0x 705C
0x 7060
0x 7064
0x 7068
0x 706C
0x 7070
0x 7074
0x 7078
0x 707C
0x 7080
0x 7084
0x 7088
0x 708C
0x 7090
0x 7094
0x 7098
0x 709C
0x 70A0
0x 70A4
0x 70A8
0x 70AC
0x 70B0
0x 70B4
0x 70B8
0x 70BC
0x 70C0
0x 70C4
0x 70C8
0x 70CC
0x 70D0
0x 70D4
0x 70DC
0x 70E0
0x 70E4
0x 70E8
0x 70EC
0x 70F0
0x 70F4
0x 70F8
0x 70FC
0x 7100
0x 7104
0x 7108
0x 710C
0x 7110
0x 7114
0x 7118
0x 711C
0x 7120
0x 7124
0x 7128
0x 712C
0x 7130
0x 7134
0x 7138
0x 713C
0x 7140
0x 7144
0x 7148
0x 714C
0x 7150
0x 7154
0x 7158
0x 715C
0x 7160
0x 7164
0x 7168
0x 716C
0x 7170
0x 7174
0x 7178
0x 717C
0x 7180
0x 7184
0x 7188
0x 718C
0x 7190
0x 7194
0x 7198
0x 719C
0x 71A0
0x 71A4
0x 71A8
0x 71AC
0x 71B0
0x 71B4
0x 71B8
0x 71BC
0x 71C0
0x 71C4
0x 71C8
0x 71CC
0x 71D0
0x 71D4
0x 71D8
0x 71DC
0x 71E0
0x 71E4
0x 71E8
0x 71EC
0x 71F0
0x 71F4
0x 71F8
0x 71FC
0x 7200
0x 7204
0x 7208
0x 720C
0x 7210
0x 7214
0x 7218
0x 721C
0x 7220
0x 7224
0x 7228
0x 722C
0x 7230
0x 7234
0x 7238
0x 723C
0x 7240
0x 7244
0x 7248
0x 724C
0x 7250
0x 7254
0x 7258
0x 725C
0x 7260
0x 7264
0x 7268
0x 726C
0x 7270
0x 7274
0x 7278
0x 727C
0x 7280
0x 7284
0x 7288
0x 728C
0x 7290
0x 7294
0x 7298
0x 729C
0x 72A0
0x 72A4
0x 72A8
0x 72AC
0x 72B0
0x 72B4
0x 72B8
0x 72BC
0x 72C0
0x 72C4
0x 72C8
0x 72CC
0x 72D0
0x 72D4
0x 72D8
0x 72DC
0x 72E0
0x 72E4
0x 72E8
0x 72EC
0x 72F0
0x 72F4
0x 72F8
0x 72FC
0x 7300
0x 7304
0x 7308
0x 730C
0x 7310
0x 7314
0x 7318
0x 731C
0x 7320
0x 7324
0x 7328
0x 732C
0x 7330
0x 7334
0x 7338
0x 733C
0x 7340
0x 7344
0x 7348
0x 734C
0x 7350
0x 7354
0x 7358
0x 735C
0x 7360
0x 7364
0x 7368
0x 736C
0x 7370
0x 7374
0x 7378
0x 737C
0x 7380
0x 7384
0x 7388
0x 738C
0x 7390
0x 7394
0x 7398
0x 739C
0x 73A0
0x 73A4
0x 73A8
0x 73AC
0x 73B0
0x 73B4
0x 73B8
0x 73BC
0x 73C0
0x 73C4
0x 73C8
0x 73CC
0x 73D0
0x 73D4
0x 73D8
0x 73DC
0x 73E0
0x 73E4
0x 73E8
0x 73EC
0x 73F0
0x 73F4
0x 73F8
0x 73FC
0x 75C
0x 7404
0x 7408
0x 740C
0x 7410
0x 7414
0x 7418
0x 741C
0x 7420
0x 7424
0x 7428
0x 742C
0x 7430
0x 7434
0x 7438
0x 743C
0x 7440
0x 7444
0x 7448
0x 744C
0x 7450
0x 7454
0x 7458
0x 745C
0x 7460
0x 7464
0x 7468
0x 746C
0x 7470
0x 7474
0x 7478
0x 747C
0x 7480
0x 7484
0x 7488
0x 748C
0x 7490
0x 7494
0x 7498
0x 749C
0x 74A0
0x 74A4
0x 74A8
0x 74AC
0x 74B0
0x 74B4
0x 74B8
0x 74BC
0x 74C0
0x 74C4
0x 74C8
0x 74CC
0x 74D0
0x 74D4
0x 74D8
0x 74DC
0x 74E0
0x 74E4
0x 74E8
0x 74EC
0x 74F0
0x 74F4
0x 74F8
0x 74FC
0x 7500
0x 7504
0x 7508
0x 750C
0x 7510
0x 7514
0x 7518
0x 751C
0x 7520
0x 7524
0x 7528
0x 752C
0x 7530
0x 7534
0x 7538
0x 753C
0x 7540
0x 7548
0x 7544
0x 754C
0x 7550
0x 7554
0x 7558
0x 755C
0x 7560
0x 7564
0x 7568
0x 756C
0x 7570
0x 7574
0x 7578
0x 757C
0x 7580
0x 7584
0x 7588
0x 758C
0x 7590
0x 7594
0x 7598
0x 759C
0x 75A0
0x 75A4
0x 75A8
0x 75AC
0x 75B8
0x 75C4
0x 75C8
0x 75CC
0x 75D0
0x 75D4
0x 75D8
0x 75DC
0x 75E0
0x 75E4
0x 75E8
0x 75EC
0x 75F0
0x 75F4
0x 75F8
0x 75FC
0x 7600
0x 7604
0x 7608
0x 760C
0x 7610
0x 7614
0x 7618
0x 761C
0x 7620
0x 7624
0x 7628
0x 762C
0x 7630
0x 7634
0x 7638
0x 763C
0x 7640
0x 7644
0x 7648
0x 764C
0x 7650
0x 7658
0x 765C
0x 7660
0x 7664
0x 7668
0x 766C
0x 7670
0x 7674
0x 7678
0x 767C
0x 7680
0x 7684
0x 7688
0x 768C
0x 7690
0x 7694
0x 7698
0x 769C
0x 76A0
0x 76A4
0x 76A8
0x 76AC
0x 76B0
0x 76B8
0x 76BC
0x 76C0
0x 76C4
0x 76C8
0x 76CC
0x 76D0
0x 76D4
0x 76D8
0x 76DC
0x 76E0
0x 76E4
0x 76E8
0x 76EC
0x 76F0
0x 76F4
0x 76F8
0x 76FC
0x 7700
0x 7704
0x 7708
0x 770C
0x 7710
0x 7714
0x 7720
0x 7724
0x 7728
0x 772C
0x 7730
0x 7734
0x 7738
0x 773C
0x 7740
0x 7744
0x 7748
0x 774C
0x 7750
0x 7754
0x 7758
0x 775C
0x 7760
0x 7764
0x 7768
0x 776C
0x 7770
0x 7774
0x 7778
0x 777C
0x 7780
0x 7784
0x 7788
0x 778C
0x 7790
0x 7794
0x 7798
0x 779C
0x 77A0
0x 77A4
0x 77A8
0x 77AC
0x 77B0
0x 77B4
0x 77B8
0x 77BC
0x 77C0
0x 77C4
0x 77C8
0x 77CC
0x 77D0
0x 77D4
0x 77D8
0x 77DC
0x 77E0
0x 77E4
0x 77E8
0x 77EC
0x 77F0
0x 77F4
0x 77F8
0x 77FC
0x 7548
0x 75C0
0x 150
0x 771C
0x 7718
0x 76B4
0x 75B4
0x 75B0
0x 7654
0x 7804
0x 7808
0x 780C
0x 7810
0x 7814
0x 7818
0x 781C
0x 7820
0x 7824
0x 7828
0x 782C
0x 7830
0x 7834
0x 7838
0x 783C
0x 7840
0x 7844
0x 7848
0x 784C
0x 7850
0x 7854
0x 7858
0x 785C
0x 7860
0x 7864
0x 7868
0x 786C
0x 7870
0x 7874
0x 7878
0x 787C
0x 7880
0x 7884
0x 7888
0x 788C
0x 7890
0x 7894
0x 7898
0x 789C
0x 78A0
0x 78A4
0x 78A8
0x 78AC
0x 78B0
0x 78B4
0x 78B8
0x 78BC
0x 78C0
0x 78C4
0x 78C8
0x 78CC
0x 78D0
0x 78D4
0x 78D8
0x 78DC
0x 78E0
0x 78E4
0x 78E8
0x 78EC
0x 78F0
0x 78F4
0x 78F8
0x 78FC
0x 7900
0x 7904
0x 7908
0x 790C
0x 7910
0x 7914
0x 7918
0x 791C
0x 7920
0x 7924
0x 7928
0x 792C
0x 7930
0x 7934
0x 7938
0x 793C
0x 7940
0x 7944
0x 7948
0x 794C
0x 7950
0x 7954
0x 7958
0x 795C
0x 7960
0x 7964
0x 7968
0x 796C
0x 7970
0x 7974
0x 7978
0x 797C
0x 7980
0x 7984
0x 7988
0x 798C
0x 7990
0x 799C
0x 79A0
0x 79A4
0x 79A8
0x 79AC
0x 79B0
0x 79B4
0x 79B8
0x 79BC
0x 79C0
0x 79C4
0x 79C8
0x 79CC
0x 79D0
0x 79D4
0x 79D8
0x 79DC
0x 79E0
0x 79E4
0x 79E8
0x 79EC
0x 79F4
0x 79F8
0x 79FC
0x 7A00
0x 7A04
0x 7A08
0x 7A0C
0x 7A10
0x 7A14
0x 7A18
0x 7A1C
0x 7A20
0x 7A24
0x 7A28
0x 7A2C
0x 7A30
0x 7A34
0x 7A38
0x 7A3C
0x 7A40
0x 7A44
0x 7A48
0x 7A4C
0x 7A50
0x 7A54
0x 7A58
0x 7A5C
0x 7A60
0x 7A64
0x 7A68
0x 7A6C
0x 7A70
0x 7A74
0x 7A78
0x 7A7C
0x 7A80
0x 7A84
0x 7A88
0x 7A8C
0x 7A90
0x 7A94
0x 7A98
0x 7A9C
0x 7AA0
0x 7AA4
0x 7AA8
0x 7AAC
0x 7AB0
0x 7AB4
0x 7AB8
0x 7ABC
0x 7AC0
0x 7AC4
0x 7AC8
0x 7ACC
0x 7AD0
0x 7AD4
0x 7AD8
0x 7ADC
0x 7AE0
0x 7AE4
0x 7AE8
0x 7AEC
0x 7AF0
0x 7AF4
0x 7AF8
0x 7AFC
0x 7B00
0x 7B04
0x 7B08
0x 7B0C
0x 7B10
0x 7B14
0x 7B18
0x 7B1C
0x 7B20
0x 7B24
0x 7B28
0x 7B2C
0x 7B30
0x 7B34
0x 7B38
0x 7B3C
0x 7B40
0x 7B44
0x 7B48
0x 7B4C
0x 7B50
0x 7B54
0x 7B58
0x 7B5C
0x 7B60
0x 7B64
0x 7B68
0x 7B6C
0x 7B70
0x 7B74
0x 7B78
0x 7B7C
0x 7B80
0x 7B84
0x 7B88
0x 7B8C
0x 7B90
0x 7B94
0x 7B98
0x 7B9C
0x 7BA0
0x 7BA4
0x 7BA8
0x 7BAC
0x 7BB0
0x 7BB4
0x 7BB8
0x 7BBC
0x 7BC0
0x 7BC4
0x 7BC8
0x 7BCC
0x 7BD0
0x 7BD4
0x 7BD8
0x 7BDC
0x 7BE0
0x 7BE4
0x 7BE8
0x 7BEC
0x 7BF0
0x 7BF4
0x 7BF8
0x 7BFC
0x 75BC
0x 5FD4
0x 578
0x 7C04
0x 7C08
0x 7C0C
0x 7C10
0x 7C14
0x 7C18
0x 7C1C
0x 7C20
0x 7C24
0x 7C28
0x 7C2C
0x 7C30
0x 7C34
0x 7C38
0x 7C3C
0x 7C40
0x 7C44
0x 7C48
0x 7C4C
0x 7C50
0x 7C54
0x 7C58
0x 7C5C
0x 7C60
0x 7C64
0x 7C68
0x 7C6C
0x 7C70
0x 7C74
0x 7C78
0x 7C7C
0x 7C80
0x 7C84
0x 7C88
0x 7C8C
0x 7C90
0x 7C94
0x 7C98
0x 7C9C
0x 7CA0
0x 7CA4
0x 7CA8
0x 7CAC
0x 7CB0
0x 7CB4
0x 7CB8
0x 7CBC
0x 7CC0
0x 7CC4
0x 7CC8
0x 7CCC
0x 7CD0
0x 7CD4
0x 7CD8
0x 7CDC
0x 7CE0
0x 7CE4
0x 7CE8
0x 7CEC
0x 7CF0
0x 7CF4
0x 7CF8
0x 7CFC
0x 7D00
0x 7D04
0x 7D08
0x 7D0C
0x 7D10
0x 7D14
0x 7D18
0x 7D1C
0x 7D20
0x 7D24
0x 7D28
0x 7D2C
0x 7D30
0x 7D34
0x 7D38
0x 7D3C
0x 7D40
0x 7D44
0x 7D48
0x 7D4C
0x 7D50
0x 7D54
0x 7D58
0x 7D5C
0x 7D60
0x 7D64
0x 7D68
0x 7D6C
0x 7D70
0x 7D74
0x 7D78
0x 7D7C
0x 7D80
0x 7D84
0x 7D88
0x 7D8C
0x 7D90
0x 7D94
0x 7D98
0x 7D9C
0x 7DA0
0x 7DA4
0x 7DA8
0x 7DAC
0x 7DB0
0x 7DB4
0x 7DB8
0x 7DBC
0x 7DC0
0x 7DC4
0x 7DC8
0x 7DCC
0x 7DD0
0x 7DD4
0x 7DD8
0x 7DDC
0x 7DE0
0x 7DE4
0x 7DE8
0x 7DEC
0x 7DF0
0x 7DF4
0x 7DF8
0x 7DFC
0x 7E00
0x 7E04
0x 7E08
0x 7E0C
0x 7E10
0x 7E14
0x 7E18
0x 7E1C
0x 7E20
0x 7E24
0x 7E28
0x 7E2C
0x 7E30
0x 7E34
0x 7E38
0x 7E3C
0x 7E40
0x 7E44
0x 7E48
0x 7E4C
0x 7E50
0x 7E54
0x 7E58
0x 7E5C
0x 7E60
0x 7E64
0x 7E68
0x 7E6C
0x 7E70
0x 7E74
0x 7E78
0x 7E7C
0x 7E80
0x 7E84
0x 7E88
0x 7E8C
0x 7E90
0x 7E94
0x 7E98
0x 7E9C
0x 7EA0
0x 7EA4
0x 7EA8
0x 7EAC
0x 7EB4
0x 7EB8
0x 7EBC
0x 7EC0
0x 7EC4
0x 7EC8
0x 7ECC
0x 7ED0
0x 7ED4
0x 7ED8
0x 7EDC
0x 7EE0
0x 7EE4
0x 7EE8
0x 7EEC
0x 7EF0
0x 7EF4
0x 7EF8
0x 7EFC
0x 7F00
0x 7F04
0x 7F08
0x 7F0C
0x 7F10
0x 7F14
0x 7F18
0x 7F1C
0x 7F20
0x 7F24
0x 7F28
0x 7F2C
0x 7F30
0x 7F34
0x 7F38
0x 7F3C
0x 7F40
0x 7F44
0x 7F48
0x 7F4C
0x 7F50
0x 7F54
0x 7F58
0x 7F5C
0x 7F60
0x 7F64
0x 7F68
0x 7F6C
0x 7F70
0x 7F74
0x 7F78
0x 7F7C
0x 7F80
0x 7F84
0x 7F88
0x 7F8C
0x 7F90
0x 7F94
0x 7F98
0x 7F9C
0x 7FA0
0x 7FA4
0x 7FA8
0x 7FAC
0x 7FB0
0x 7FB4
0x 7FB8
0x 7FBC
0x 7FC0
0x 7FC4
0x 7FC8
0x 7FCC
0x 7FD0
0x 7FD4
0x 7FD8
0x 7FDC
0x 7FE0
0x 7FE4
0x 7FE8
0x 7FEC
0x 7FF0
0x 7FF4
0x 7FF8
0x 7FFC
0x 630
0x 68C
0x 73C
0x 784
0x 7DC
0x 8004
0x 8008
0x 800C
0x 8010
0x 8014
0x 8018
0x 801C
0x 8020
0x 8024
0x 8028
0x 802C
0x 8030
0x 8034
0x 8038
0x 803C
0x 8040
0x 8044
0x 8048
0x 804C
0x 8050
0x 8054
0x 8058
0x 805C
0x 8060
0x 8064
0x 8068
0x 806C
0x 8070
0x 8074
0x 8078
0x 807C
0x 8080
0x 8084
0x 8088
0x 808C
0x 8090
0x 8094
0x 8098
0x 809C
0x 80A0
0x 80A4
0x 80A8
0x 80AC
0x 80B0
0x 80B4
0x 80B8
0x 80BC
0x 80C0
0x 80C4
0x 80C8
0x 80CC
0x 80D0
0x 80D4
0x 80D8
0x 80DC
0x 80E0
0x 80E4
0x 80E8
0x 80EC
0x 80F0
0x 80F4
0x 80F8
0x 80FC
0x 8100
0x 8104
0x 8108
0x 810C
0x 8110
0x 8114
0x 8118
0x 811C
0x 8120
0x 8124
0x 8128
0x 812C
0x 8130
0x 8134
0x 8138
0x 813C
0x 8140
0x 8144
0x 8148
0x 814C
0x 8150
0x 8154
0x 8158
0x 815C
0x 8160
0x 8164
0x 8168
0x 816C
0x 8170
0x 8174
0x 8178
0x 817C
0x 8180
0x 8184
0x 8188
0x 818C
0x 8190
0x 8194
0x 8198
0x 819C
0x 81A0
0x 81A4
0x 81A8
0x 81AC
0x 81B0
0x 81B4
0x 81B8
0x 81BC
0x 81C0
0x 81C4
0x 81C8
0x 81CC
0x 81D0
0x 81D4
0x 81D8
0x 81DC
0x 81E0
0x 81E4
0x 81E8
0x 81EC
0x 81F0
0x 81F4
0x 81F8
0x 81FC
0x 8200
0x 8204
0x 8208
0x 820C
0x 8210
0x 8214
0x 8218
0x 821C
0x 8220
0x 8224
0x 8228
0x 822C
0x 8230
0x 8234
0x 8238
0x 823C
0x 8240
0x 8244
0x 8248
0x 824C
0x 8250
0x 8254
0x 8258
0x 825C
0x 8260
0x 8264
0x 8268
0x 826C
0x 8270
0x 8274
0x 8278
0x 827C
0x 8280
0x 8284
0x 8288
0x 828C
0x 8290
0x 8294
0x 8298
0x 829C
0x 82A0
0x 82A4
0x 82A8
0x 82AC
0x 82B0
0x 82B4
0x 82B8
0x 82BC
0x 82C0
0x 82C4
0x 82C8
0x 82CC
0x 82D0
0x 82D4
0x 82D8
0x 82DC
0x 82E0
0x 82E4
0x 82E8
0x 82EC
0x 82F0
0x 82F4
0x 82F8
0x 82FC
0x 8300
0x 8304
0x 8308
0x 830C
0x 8310
0x 8314
0x 8318
0x 831C
0x 8320
0x 8324
0x 8328
0x 832C
0x 8330
0x 8334
0x 8338
0x 833C
0x 8340
0x 8344
0x 8348
0x 834C
0x 8364
0x 8368
0x 836C
0x 8370
0x 8374
0x 8378
0x 837C
0x 8380
0x 8384
0x 838C
0x 8390
0x 8394
0x 8398
0x 839C
0x 83A0
0x 83A4
0x 83A8
0x 83AC
0x 83B0
0x 83B4
0x 83B8
0x 83BC
0x 83C0
0x 83C4
0x 83C8
0x 83CC
0x 83D0
0x 83D4
0x 83D8
0x 83DC
0x 83E0
0x 83E4
0x 83E8
0x 83EC
0x 83F0
0x 83F4
0x 83F8
0x 83FC
0x 230
0x 580
0x 91C
0x 1EC
0x 954
0x 8404
0x 8408
0x 840C
0x 8410
0x 8414
0x 8418
0x 841C
0x 8420
0x 8424
0x 8428
0x 842C
0x 8430
0x 8434
0x 8438
0x 843C
0x 8440
0x 8444
0x 8448
0x 844C
0x 8450
0x 8454
0x 8458
0x 845C
0x 8460
0x 8464
0x 8468
0x 846C
0x 8470
0x 8474
0x 8478
0x 847C
0x 8480
0x 8484
0x 8488
0x 848C
0x 8490
0x 8494
0x 8498
0x 849C
0x 84A0
0x 84A4
0x 84A8
0x 84AC
0x 84B0
0x 84B4
0x 84B8
0x 84BC
0x 84C0
0x 84C4
0x 84C8
0x 84CC
0x 84D0
0x 84D4
0x 84D8
0x 84DC
0x 84E0
0x 84E4
0x 84E8
0x 84EC
0x 84F0
0x 84F4
0x 84F8
0x 84FC
0x 8500
0x 8504
0x 8508
0x 850C
0x 8510
0x 8514
0x 8518
0x 851C
0x 8520
0x 8524
0x 8528
0x 852C
0x 8530
0x 8534
0x 8538
0x 853C
0x 8540
0x 8544
0x 8548
0x 854C
0x 8550
0x 8554
0x 8558
0x 855C
0x 8560
0x 8564
0x 8568
0x 856C
0x 8570
0x 8574
0x 8578
0x 857C
0x 8580
0x 8584
0x 8588
0x 858C
0x 8590
0x 8594
0x 8598
0x 859C
0x 85A0
0x 85A4
0x 85A8
0x 85AC
0x 85B0
0x 85B4
0x 85B8
0x 85BC
0x 85C0
0x 85C4
0x 85C8
0x 85CC
0x 85D4
0x 85D8
0x 85DC
0x 85E0
0x 85E4
0x 85E8
0x 85EC
0x 85F0
0x 85F4
0x 85F8
0x 85FC
0x 8600
0x 8604
0x 8608
0x 860C
0x 8610
0x 8614
0x 8618
0x 861C
0x 8620
0x 8624
0x 8628
0x 862C
0x 8630
0x 8634
0x 8638
0x 863C
0x 8640
0x 8644
0x 8648
0x 864C
0x 8650
0x 8654
0x 8658
0x 865C
0x 8660
0x 8664
0x 8668
0x 866C
0x 8670
0x 8674
0x 8678
0x 867C
0x 8680
0x 8684
0x 8688
0x 8690
0x 8694
0x 8698
0x 869C
0x 86A0
0x 86A4
0x 86A8
0x 86AC
0x 86B0
0x 86B4
0x 86B8
0x 86BC
0x 86C0
0x 86C8
0x 86CC
0x 86D0
0x 86D4
0x 86D8
0x 86DC
0x 86E0
0x 86E4
0x 86E8
0x 86EC
0x 86F0
0x 86F4
0x 86F8
0x 8700
0x 8704
0x 8708
0x 870C
0x 8710
0x 8714
0x 8718
0x 871C
0x 8720
0x 8724
0x 8728
0x 872C
0x 8730
0x 8744
0x 8748
0x 874C
0x 8750
0x 8754
0x 8758
0x 875C
0x 8760
0x 8764
0x 8768
0x 876C
0x 8770
0x 8774
0x 8778
0x 877C
0x 8780
0x 8784
0x 8788
0x 878C
0x 8790
0x 8794
0x 8798
0x 879C
0x 87A0
0x 87A4
0x 87A8
0x 87AC
0x 87B0
0x 87B4
0x 87B8
0x 87BC
0x 87C0
0x 87C4
0x 87C8
0x 87CC
0x 87D0
0x 87D4
0x 87D8
0x 87DC
0x 87E0
0x 87E4
0x 87E8
0x 87EC
0x 87F0
0x 87F4
0x 87F8
0x 87FC
0x 3F4
0x 418
0x 764
0x 904
0x 548
0x 684
0x 8804
0x 8808
0x 880C
0x 8810
0x 8814
0x 8818
0x 881C
0x 8820
0x 8824
0x 8828
0x 882C
0x 8830
0x 8834
0x 8838
0x 883C
0x 8840
0x 8844
0x 8848
0x 884C
0x 8850
0x 8854
0x 8858
0x 885C
0x 8860
0x 8864
0x 8868
0x 886C
0x 8870
0x 8874
0x 8878
0x 887C
0x 8880
0x 8884
0x 8888
0x 888C
0x 8890
0x 8894
0x 8898
0x 889C
0x 88A0
0x 88A4
0x 88A8
0x 88AC
0x 88B0
0x 88B4
0x 88B8
0x 88BC
0x 88C0
0x 88C4
0x 88C8
0x 88CC
0x 88D0
0x 88D4
0x 88D8
0x 88DC
0x 88E0
0x 88E4
0x 88E8
0x 88EC
0x 88F0
0x 88F4
0x 88F8
0x 88FC
0x 8900
0x 8904
0x 8908
0x 890C
0x 8910
0x 8914
0x 8918
0x 891C
0x 8920
0x 8924
0x 8928
0x 892C
0x 8930
0x 8934
0x 8938
0x 893C
0x 8940
0x 8944
0x 8948
0x 8950
0x 8954
0x 8958
0x 895C
0x 8960
0x 8964
0x 8968
0x 896C
0x 8970
0x 8974
0x 8978
0x 897C
0x 8980
0x 8984
0x 8988
0x 898C
0x 8990
0x 8994
0x 8998
0x 899C
0x 89A0
0x 89A4
0x 89A8
0x 89AC
0x 89B0
0x 89B4
0x 89B8
0x 89BC
0x 89C0
0x 89C4
0x 89C8
0x 89CC
0x 89D0
0x 89D4
0x 89D8
0x 89DC
0x 89E0
0x 89E4
0x 89E8
0x 89EC
0x 89F0
0x 89F4
0x 89F8
0x 89FC
0x 8A00
0x 8A04
0x 8A08
0x 8A0C
0x 8A10
0x 8A14
0x 8A18
0x 8A1C
0x 8A20
0x 8A24
0x 8A28
0x 8A2C
0x 8A30
0x 8A34
0x 8A38
0x 8A3C
0x 8A40
0x 8A44
0x 8A4C
0x 8A48
0x 8A50
0x 8A54
0x 8A58
0x 8A5C
0x 8A60
0x 8A64
0x 8A68
0x 8A6C
0x 8A70
0x 8A74
0x 8A78
0x 8A7C
0x 8A80
0x 8A84
0x 8A88
0x 8A8C
0x 8A90
0x 8A94
0x 8A98
0x 8A9C
0x 8AA0
0x 8AA4
0x 8AA8
0x 8AAC
0x 8AB0
0x 8ABC
0x 8AC0
0x 8AC4
0x 8AC8
0x 8ACC
0x 8AD0
0x 8AD4
0x 8AD8
0x 8ADC
0x 8AE0
0x 8AE4
0x 8AF4
0x 8AF8
0x 8AFC
0x 8B00
0x 8B04
0x 8B08
0x 8B0C
0x 8B10
0x 8B14
0x 8B18
0x 8B1C
0x 8B20
0x 8B24
0x 8B28
0x 8B2C
0x 8B30
0x 8B34
0x 8B38
0x 8B3C
0x 8B40
0x 8B44
0x 8B48
0x 8B4C
0x 8B50
0x 8B54
0x 8B58
0x 8B60
0x 8B64
0x 8B68
0x 8B6C
0x 8B70
0x 8B74
0x 8B78
0x 8B7C
0x 8B80
0x 8B84
0x 8B88
0x 8B8C
0x 8B90
0x 8B94
0x 8B98
0x 8BA0
0x 8BA4
0x 8BA8
0x 8BAC
0x 8BB0
0x 8BB4
0x 8BB8
0x 8BBC
0x 8BC0
0x 8BC4
0x 8BC8
0x 8BCC
0x 8BD0
0x 8BD4
0x 8BD8
0x 8BDC
0x 8BE8
0x 8BEC
0x 8BF0
0x 8BF4
0x 8BF8
0x 8BFC
0x B78
0x 8A4C
0x 8AEC
0x 8C04
0x 8C08
0x 8C0C
0x 8C10
0x 8C14
0x 8C18
0x 8C1C
0x 8C20
0x 8C24
0x 8C28
0x 8C2C
0x 8C30
0x 8C34
0x 8C38
0x 8C3C
0x 8C40
0x 8C44
0x 8C48
0x 8C4C
0x 8C50
0x 8C54
0x 8C58
0x 8C5C
0x 8C60
0x 8C64
0x 8C68
0x 8C6C
0x 8C70
0x 8C78
0x 8C7C
0x 8C80
0x 8C84
0x 8C88
0x 8C8C
0x 8C90
0x 8C94
0x 8C98
0x 8C9C
0x 8CA0
0x 8CA4
0x 8CA8
0x 8CAC
0x 8CB0
0x 8CB4
0x 8CB8
0x 8CBC
0x 8CC0
0x 8CC4
0x 8CC8
0x 8CCC
0x 8CD0
0x 8CD4
0x 8CD8
0x 8CDC
0x 8CE0
0x 8CE4
0x 8CE8
0x 8CEC
0x 8CF0
0x 8CF4
0x 8CF8
0x 8CFC
0x 8D00
0x 8D04
0x 8D08
0x 8D0C
0x 8D10
0x 8D14
0x 8D18
0x 8D1C
0x 8D20
0x 8D24
0x 8D28
0x 8D2C
0x 8D30
0x 8D34
0x 8D38
0x 8D3C
0x 8D40
0x 8D44
0x 8D48
0x 8D4C
0x 8D50
0x 8D54
0x 8D58
0x 8D5C
0x 8D60
0x 8D64
0x 8D68
0x 8D6C
0x 8D70
0x 8D74
0x 8D78
0x 8D7C
0x 8D80
0x 8D84
0x 8D88
0x 8D8C
0x 8D90
0x 8D94
0x 8D98
0x 8D9C
0x 8DA0
0x 8DA4
0x 8DA8
0x 8DAC
0x 8DB0
0x 8DB4
0x 8DB8
0x 8DBC
0x 8DC0
0x 8DC4
0x 8DC8
0x 8DCC
0x 8DD0
0x 8DD4
0x 8DD8
0x 8DDC
0x 8DE0
0x 8DE4
0x 8DE8
0x 8DEC
0x 8DF0
0x 8DF4
0x 8DF8
0x 8DFC
0x 8E00
0x 8E04
0x 8E08
0x 8E0C
0x 8E10
0x 8E14
0x 8E18
0x 8E1C
0x 8E20
0x 8E24
0x 8E28
0x 8E2C
0x 8E30
0x 8E34
0x 8E38
0x 8E3C
0x 8E40
0x 8E44
0x 8E48
0x 8E4C
0x 8E50
0x 8E54
0x 8E58
0x 8E5C
0x 8E60
0x 8E64
0x 8E68
0x 8E6C
0x 8E70
0x 8E74
0x 8E78
0x 8E7C
0x 8E80
0x 8E84
0x 8E88
0x 8E8C
0x 8E90
0x 8E94
0x 8E98
0x 8E9C
0x 8EA0
0x 8EA4
0x 8EA8
0x 8EAC
0x 8EB0
0x 8EB4
0x 8EB8
0x 8EBC
0x 8EC0
0x 8EC4
0x 8EC8
0x 8ECC
0x 8ED0
0x 8ED4
0x 8ED8
0x 8EDC
0x 8EE0
0x 8EE4
0x 8EE8
0x 8EEC
0x 8EF0
0x 8EF4
0x 8EF8
0x 8EFC
0x 8F00
0x 8F04
0x 8F08
0x 8F0C
0x 8F10
0x 8F14
0x 8F18
0x 8F1C
0x 8F20
0x 8F24
0x 8F28
0x 8F2C
0x 8F30
0x 8F34
0x 8F38
0x 8F3C
0x 8F40
0x 8F44
0x 8F48
0x 8F4C
0x 8F50
0x 8F54
0x 8F58
0x 8F5C
0x 8F60
0x 8F64
0x 8F68
0x 8F6C
0x 8F70
0x 8F74
0x 8F78
0x 8F7C
0x 8F80
0x 8F84
0x 8F88
0x 8F8C
0x 8F90
0x 8F94
0x 8F98
0x 8F9C
0x 8FA0
0x 8FA4
0x 8FA8
0x 8FAC
0x 8FB0
0x 8FB4
0x 8FB8
0x 8FBC
0x 8FC0
0x 8FC4
0x 8FC8
0x 8FCC
0x 8FD0
0x 8FD4
0x 8FD8
0x 8FDC
0x 8FE0
0x 8FE4
0x 8FE8
0x 8FEC
0x 8FF0
0x 8FF4
0x 8FF8
0x 8FFC
0x 8BE4
0x 8B9C
0x 8BE0
0x 8AB8
0x 8AB4
0x 8B5C
0x 8AE8
0x 9004
0x 9008
0x 900C
0x 9010
0x 9014
0x 9018
0x 901C
0x 9020
0x 9024
0x 9028
0x 902C
0x 9030
0x 9034
0x 9038
0x 903C
0x 9040
0x 9044
0x 9048
0x 904C
0x 9050
0x 9054
0x 9058
0x 905C
0x 9060
0x 9064
0x 9068
0x 906C
0x 9070
0x 9074
0x 9078
0x 907C
0x 9080
0x 9084
0x 9088
0x 908C
0x 9090
0x 9094
0x 9098
0x 909C
0x 90A0
0x 90A4
0x 90A8
0x 90AC
0x 90B0
0x 90B4
0x 90B8
0x 90BC
0x 90C0
0x 90C4
0x 90C8
0x 90CC
0x 90D0
0x 90D4
0x 90D8
0x 90DC
0x 90E0
0x 90E4
0x 90E8
0x 90EC
0x 90F0
0x 90F4
0x 90F8
0x 90FC
0x 9100
0x 9104
0x 9108
0x 910C
0x 9110
0x 9114
0x 9118
0x 911C
0x 9120
0x 9124
0x 9128
0x 912C
0x 9130
0x 9134
0x 9138
0x 913C
0x 9140
0x 9144
0x 9148
0x 914C
0x 9150
0x 9154
0x 9158
0x 915C
0x 9160
0x 9164
0x 9168
0x 916C
0x 9170
0x 9174
0x 9178
0x 917C
0x 9180
0x 9184
0x 9188
0x 918C
0x 9190
0x 9194
0x 9198
0x 919C
0x 91A0
0x 91A4
0x 91A8
0x 91AC
0x 91B0
0x 91B4
0x 91B8
0x 91BC
0x 91C0
0x 91C4
0x 91C8
0x 91CC
0x 91D0
0x 91D4
0x 91D8
0x 91DC
0x 91E0
0x 91E4
0x 91E8
0x 91EC
0x 91F0
0x 91F4
0x 91F8
0x 91FC
0x 9200
0x 9204
0x 9208
0x 920C
0x 9210
0x 9214
0x 9218
0x 921C
0x 9220
0x 9224
0x 9228
0x 922C
0x 9230
0x 9234
0x 9238
0x 923C
0x 9240
0x 9244
0x 9248
0x 924C
0x 9250
0x 9254
0x 9258
0x 925C
0x 9260
0x 9264
0x 9268
0x 926C
0x 9270
0x 9274
0x 9278
0x 927C
0x 9280
0x 9284
0x 9288
0x 928C
0x 9290
0x 9294
0x 9298
0x 929C
0x 92A0
0x 92A4
0x 92A8
0x 92AC
0x 92B0
0x 92B4
0x 92B8
0x 92BC
0x 92C0
0x 92C4
0x 92C8
0x 92CC
0x 92D0
0x 92D4
0x 92D8
0x 92DC
0x 92E0
0x 92E4
0x 92E8
0x 92EC
0x 92F0
0x 92F4
0x 92F8
0x 92FC
0x 9300
0x 9304
0x 9308
0x 930C
0x 9310
0x 9314
0x 9318
0x 931C
0x 9320
0x 9324
0x 9328
0x 932C
0x 9330
0x 9334
0x 9338
0x 933C
0x 9340
0x 9344
0x 9348
0x 934C
0x 9350
0x 9354
0x 9358
0x 935C
0x 9360
0x 9364
0x 9368
0x 936C
0x 9370
0x 9374
0x 9378
0x 937C
0x 9380
0x 9384
0x 9388
0x 938C
0x 9390
0x 9394
0x 9398
0x 939C
0x 93A0
0x 93A4
0x 93A8
0x 93AC
0x 93B0
0x 93B4
0x 93B8
0x 93BC
0x 93C0
0x 93C4
0x 93C8
0x 93CC
0x 93D0
0x 93D4
0x 93D8
0x 93DC
0x 93E0
0x 93E4
0x 93E8
0x 93EC
0x 93F0
0x 93F4
0x 93F8
0x 93FC
0x 64
0x 804
0x 260
0x E78
0x 9404
0x 9408
0x 940C
0x 9410
0x 9414
0x 9418
0x 941C
0x 9420
0x 9424
0x 9428
0x 942C
0x 9430
0x 9434
0x 9438
0x 943C
0x 9440
0x 9444
0x 9448
0x 944C
0x 9450
0x 9454
0x 9458
0x 945C
0x 9460
0x 9464
0x 9468
0x 946C
0x 9470
0x 9474
0x 9478
0x 947C
0x 9480
0x 9484
0x 9488
0x 948C
0x 9490
0x 9494
0x 9498
0x 949C
0x 94A0
0x 94A4
0x 94A8
0x 94AC
0x 94B0
0x 94B4
0x 94B8
0x 94BC
0x 94C0
0x 94C4
0x 94C8
0x 94CC
0x 94D0
0x 94D4
0x 94D8
0x 94DC
0x 94E0
0x 94E4
0x 94E8
0x 94EC
0x 94F0
0x 94F4
0x 94F8
0x 94FC
0x 9500
0x 9504
0x 9508
0x 950C
0x 9510
0x 9514
0x 9518
0x 951C
0x 9520
0x 9524
0x 9528
0x 952C
0x 9530
0x 9534
0x 9538
0x 953C
0x 9540
0x 9544
0x 9548
0x 954C
0x 9550
0x 9554
0x 9558
0x 955C
0x 9560
0x 9564
0x 9568
0x 956C
0x 9570
0x 9574
0x 9578
0x 957C
0x 9580
0x 9584
0x 9588
0x 958C
0x 9590
0x 9594
0x 9598
0x 959C
0x 95A0
0x 95A4
0x 95A8
0x 95AC
0x 95B0
0x 95B4
0x 95B8
0x 95BC
0x 95C0
0x 95C4
0x 95C8
0x 95CC
0x 95D0
0x 95D4
0x 95D8
0x 95DC
0x 95E0
0x 95E4
0x 95E8
0x 95EC
0x 95F0
0x 95F4
0x 95F8
0x 95FC
0x 9600
0x 9604
0x 9608
0x 960C
0x 9610
0x 9614
0x 9618
0x 961C
0x 9620
0x 9624
0x 9628
0x 962C
0x 9630
0x 9634
0x 9638
0x 963C
0x 9640
0x 9644
0x 9648
0x 964C
0x 9650
0x 9654
0x 9658
0x 965C
0x 9660
0x 9664
0x 9668
0x 966C
0x 9670
0x 9674
0x 9678
0x 967C
0x 9680
0x 9684
0x 9688
0x 968C
0x 9690
0x 9694
0x 9698
0x 969C
0x 96A0
0x 96A4
0x 96A8
0x 96AC
0x 96B0
0x 96B4
0x 96B8
0x 96BC
0x 96C0
0x 96C4
0x 96C8
0x 96CC
0x 96D0
0x 96D4
0x 96D8
0x 96DC
0x 96E0
0x 96E4
0x 96E8
0x 96EC
0x 96F0
0x 96F4
0x 96F8
0x 96FC
0x 9700
0x 9704
0x 9708
0x 970C
0x 9710
0x 9714
0x 9718
0x 971C
0x 9720
0x 9724
0x 9728
0x 972C
0x 9730
0x 9734
0x 9738
0x 973C
0x 9740
0x 9744
0x 9748
0x 974C
0x 9750
0x 9754
0x 9758
0x 975C
0x 9760
0x 9764
0x 9768
0x 976C
0x 9770
0x 9774
0x 9778
0x 977C
0x 9780
0x 9784
0x 9788
0x 978C
0x 9790
0x 9794
0x 9798
0x 979C
0x 97A0
0x 97A4
0x 97A8
0x 97AC
0x 97B0
0x 97B4
0x 97B8
0x 97BC
0x 97C0
0x 97C4
0x 97C8
0x 97CC
0x 97D0
0x 97D4
0x 97D8
0x 97DC
0x 97E0
0x 97E4
0x 97E8
0x 97EC
0x 97F0
0x 97F4
0x 97F8
0x 97FC
0x 9804
0x 9808
0x 980C
0x 9810
0x 9814
0x 9818
0x 981C
0x 9820
0x 9824
0x 9828
0x 982C
0x 9830
0x 9834
0x 9838
0x 983C
0x 9840
0x 9844
0x 9848
0x 984C
0x 9850
0x 9854
0x 9858
0x 985C
0x 9860
0x 9864
0x 9868
0x 986C
0x 9870
0x 9874
0x 9878
0x 987C
0x 9880
0x 9884
0x 9888
0x 988C
0x 9890
0x 9894
0x 9898
0x 989C
0x 98A0
0x 98A4
0x 98A8
0x 98AC
0x 98B0
0x 98B4
0x 98B8
0x 98BC
0x 98C0
0x 98C4
0x 98C8
0x 98CC
0x 98D0
0x 98D4
0x 98D8
0x 98DC
0x 98E0
0x 98E4
0x 98E8
0x 98EC
0x 98F4
0x 98F8
0x 98FC
0x 9900
0x 9904
0x 9908
0x 990C
0x 9910
0x 9914
0x 9918
0x 991C
0x 9920
0x 9924
0x 9928
0x 992C
0x 9930
0x 9934
0x 9938
0x 993C
0x 9940
0x 9944
0x 9948
0x 994C
0x 9950
0x 9954
0x 9958
0x 995C
0x 9960
0x 9964
0x 9968
0x 996C
0x 9970
0x 9974
0x 9978
0x 997C
0x 9980
0x 9984
0x 9988
0x 998C
0x 9990
0x 9994
0x 9998
0x 999C
0x 99A0
0x 99A4
0x 99A8
0x 99AC
0x 99B0
0x 99B4
0x 99B8
0x 99BC
0x 99C0
0x 99C4
0x 99C8
0x 99CC
0x 99D0
0x 99D4
0x 99D8
0x 99DC
0x 99E0
0x 99E4
0x 99E8
0x 99EC
0x 99F0
0x 99F4
0x 99F8
0x 99FC
0x 9A00
0x 9A04
0x 9A08
0x 9A0C
0x 9A10
0x 9A14
0x 9A18
0x 9A1C
0x 9A20
0x 9A24
0x 9A28
0x 9A2C
0x 9A30
0x 9A34
0x 9A38
0x 9A3C
0x 9A40
0x 9A44
0x 9A48
0x 9A4C
0x 9A50
0x 9A54
0x 9A58
0x 9A5C
0x 9A60
0x 9A64
0x 9A68
0x 9A6C
0x 9A70
0x 9A74
0x 9A78
0x 9A7C
0x 9A80
0x 9A84
0x 9A88
0x 9A8C
0x 9A90
0x 9A94
0x 9A98
0x 9A9C
0x 9AA0
0x 9AA4
0x 9AA8
0x 9AAC
0x 9AB0
0x 9AB4
0x 9AB8
0x 9ABC
0x 9AC0
0x 9AC4
0x 9AC8
0x 9ACC
0x 9AD0
0x 9AD4
0x 9AD8
0x 9ADC
0x 9AE0
0x 9AE4
0x 9AE8
0x 9AEC
0x 9AF0
0x 9AF4
0x 9AF8
0x 9AFC
0x 9B00
0x 9B04
0x 9B08
0x 9B0C
0x 9B10
0x 9B14
0x 9B18
0x 9B1C
0x 9B20
0x 9B24
0x 9B28
0x 9B2C
0x 9B30
0x 9B34
0x 9B38
0x 9B3C
0x 9B40
0x 9B44
0x 9B48
0x 9B4C
0x 9B50
0x 9B54
0x 9B58
0x 9B5C
0x 9B60
0x 9B64
0x 9B68
0x 9B6C
0x 9B70
0x 9B74
0x 9B78
0x 9B7C
0x 9B80
0x 9B84
0x 9B88
0x 9B8C
0x 9B90
0x 9B94
0x 9B98
0x 9B9C
0x 9BA0
0x 9BA4
0x 9BA8
0x 9BAC
0x 9BB0
0x 9BB4
0x 9BB8
0x 9BBC
0x 9BC0
0x 9BC4
0x 9BC8
0x 9BCC
0x 9BD0
0x 9BD4
0x 9BD8
0x 9BDC
0x 9BE0
0x 9BE4
0x 9BE8
0x 9BEC
0x 9BF0
0x 9BF4
0x 9BF8
0x 9BFC
0x 744
0x 9C04
0x 9C08
0x 9C0C
0x 9C10
0x 9C14
0x 9C18
0x 9C1C
0x 9C20
0x 9C24
0x 9C28
0x 9C2C
0x 9C30
0x 9C34
0x 9C38
0x 9C3C
0x 9C40
0x 9C44
0x 9C48
0x 9C4C
0x 9C50
0x 9C54
0x 9C58
0x 9C5C
0x 9C60
0x 9C64
0x 9C68
0x 9C6C
0x 9C70
0x 9C74
0x 9C78
0x 9C7C
0x 9C80
0x 9C84
0x 9C88
0x 9C8C
0x 9C90
0x 9C94
0x 9C98
0x 9C9C
0x 9CA0
0x 9CA4
0x 9CA8
0x 9CAC
0x 9CB0
0x 9CB4
0x 9CB8
0x 9CBC
0x 9CC0
0x 9CC4
0x 9CC8
0x 9CCC
0x 9CD0
0x 9CD4
0x 9CD8
0x 9CDC
0x 9CE0
0x 9CE4
0x 9CE8
0x 9CEC
0x 9CF0
0x 9CF4
0x 9CF8
0x 9CFC
0x 9D00
0x 9D04
0x 9D08
0x 9D0C
0x 9D10
0x 9D14
0x 9D18
0x 9D1C
0x 9D20
0x 9D24
0x 9D28
0x 9D2C
0x 9D30
0x 9D34
0x 9D38
0x 9D3C
0x 9D40
0x 9D44
0x 9D48
0x 9D4C
0x 9D50
0x 9D54
0x 9D58
0x 9D5C
0x 9D60
0x 9D64
0x 9D68
0x 9D6C
0x 9D70
0x 9D74
0x 9D78
0x 9D7C
0x 9D80
0x 9D84
0x 9D88
0x 9D8C
0x 9D90
0x 9D94
0x 9D98
0x 9D9C
0x 9DA0
0x 9DA4
0x 9DA8
0x 9DAC
0x 9DB0
0x 9DB4
0x 9DB8
0x 9DBC
0x 9DC0
0x 9DC4
0x 9DC8
0x 9DCC
0x 9DD0
0x 9DD4
0x 9DD8
0x 9DDC
0x 9DE0
0x 9DE4
0x 9DE8
0x 9DEC
0x 9DF0
0x 9DF4
0x 9DF8
0x 9DFC
0x 9E00
0x 9E04
0x 9E08
0x 9E0C
0x 9E10
0x 9E14
0x 9E18
0x 9E1C
0x 9E20
0x 9E24
0x 9E28
0x 9E2C
0x 9E30
0x 9E34
0x 9E38
0x 9E3C
0x 9E40
0x 9E44
0x 9E48
0x 9E4C
0x 9E50
0x 9E54
0x 9E58
0x 9E5C
0x 9E60
0x 9E64
0x 9E68
0x 9E6C
0x 9E70
0x 9E74
0x 9E78
0x 9E7C
0x 9E80
0x 9E84
0x 9E88
0x 9E8C
0x 9E90
0x 9E94
0x 9E98
0x 9E9C
0x 9EA0
0x 9EA4
0x 9EA8
0x 9EAC
0x 9EB0
0x 9EB4
0x 9EB8
0x 9EBC
0x 9EC0
0x 9EC4
0x 9EC8
0x 9ECC
0x 9ED0
0x 9ED4
0x 9ED8
0x 9EDC
0x 9EE0
0x 9EE4
0x 9EE8
0x 9EEC
0x 9EF0
0x 9EF4
0x 9EF8
0x 9EFC
0x 9F00
0x 9F04
0x 9F08
0x 9F0C
0x 9F10
0x 9F14
0x 9F18
0x 9F1C
0x 9F20
0x 9F24
0x 9F28
0x 9F2C
0x 9F30
0x 9F34
0x 9F38
0x 9F3C
0x 9F40
0x 9F44
0x 9F48
0x 9F4C
0x 9F50
0x 9F54
0x 9F58
0x 9F5C
0x 9F60
0x 9F64
0x 9F68
0x 9F6C
0x 9F70
0x 9F74
0x 9F78
0x 9F7C
0x 9F80
0x 9F84
0x 9F88
0x 9F8C
0x 9F90
0x 9F94
0x 9F98
0x 9F9C
0x 9FA0
0x 9FA4
0x 9FA8
0x 9FAC
0x 9FB0
0x 9FB4
0x 9FB8
0x 9FBC
0x 9FC0
0x 9FC4
0x 9FC8
0x 9FCC
0x 9FD0
0x 9FD4
0x 9FD8
0x 9FDC
0x 9FE0
0x 9FE4
0x 9FE8
0x 9FEC
0x 9FF0
0x 9FF4
0x 9FF8
0x 9FFC
0x A004
0x A008
0x A00C
0x A010
0x A014
0x A018
0x A01C
0x A020
0x A024
0x A028
0x A02C
0x A030
0x A034
0x A038
0x A03C
0x A040
0x A044
0x A048
0x A04C
0x A050
0x A054
0x A058
0x A05C
0x A060
0x A064
0x A068
0x A06C
0x A070
0x A074
0x A078
0x A07C
0x A080
0x A084
0x A088
0x A08C
0x A090
0x A094
0x A098
0x A09C
0x A0A0
0x A0A4
0x A0A8
0x A0AC
0x A0B0
0x A0B4
0x A0B8
0x A0BC
0x A0C0
0x A0C4
0x A0C8
0x A0CC
0x A0D0
0x A0D4
0x A0D8
0x A0DC
0x A0E0
0x A0E4
0x A0E8
0x A0EC
0x A0F0
0x A0F4
0x A0F8
0x A0FC
0x A100
0x A104
0x A108
0x A10C
0x A110
0x A114
0x A118
0x A11C
0x A120
0x A124
0x A128
0x A12C
0x A130
0x A134
0x A138
0x A13C
0x A140
0x A144
0x A148
0x A14C
0x A150
0x A154
0x A158
0x A15C
0x A160
0x A164
0x A168
0x A16C
0x A170
0x A174
0x A178
0x A17C
0x A180
0x A184
0x A188
0x A18C
0x A190
0x A194
0x A198
0x A19C
0x A1A0
0x A1A4
0x A1A8
0x A1AC
0x A1B0
0x A1B4
0x A1B8
0x A1BC
0x A1C0
0x A1C4
0x A1C8
0x A1CC
0x A1D0
0x A1D4
0x A1D8
0x A1E4
0x A1F0
0x A1F4
0x A1F8
0x A1FC
0x A200
0x A204
0x A208
0x A20C
0x A210
0x A214
0x A218
0x A21C
0x A220
0x A224
0x A228
0x A22C
0x A230
0x A234
0x A238
0x A23C
0x A240
0x A244
0x A248
0x A24C
0x A250
0x A254
0x A258
0x A25C
0x A260
0x A264
0x A268
0x A26C
0x A270
0x A274
0x A278
0x A27C
0x A280
0x A284
0x A288
0x A28C
0x A290
0x A294
0x A298
0x A29C
0x A2A0
0x A2A4
0x A2A8
0x A2AC
0x A2B0
0x A2B4
0x A2B8
0x A2BC
0x A2C0
0x A2C4
0x A2C8
0x A2CC
0x A2D0
0x A2D4
0x A2D8
0x A2DC
0x A2E0
0x A2E4
0x A2E8
0x A2EC
0x A2F0
0x A2F4
0x A2F8
0x A2FC
0x A300
0x A304
0x A308
0x A30C
0x A310
0x A314
0x A318
0x A31C
0x A320
0x A324
0x A328
0x A330
0x A334
0x A338
0x A33C
0x A340
0x A344
0x A348
0x A34C
0x A350
0x A354
0x A358
0x A35C
0x A360
0x A364
0x A368
0x A36C
0x A370
0x A374
0x A378
0x A37C
0x A380
0x A384
0x A388
0x A38C
0x A390
0x A394
0x A398
0x A39C
0x A3A0
0x A3A4
0x A3A8
0x A3AC
0x A3B0
0x A3B4
0x A3B8
0x A3BC
0x A3C0
0x A3C4
0x A3C8
0x A3CC
0x A3D0
0x A3D4
0x A3D8
0x A3DC
0x A3E0
0x A3E4
0x A3E8
0x A3EC
0x A3F0
0x A3F4
0x A3F8
0x A3FC
0x A194
0x 488
0x 86C4
0x 86FC
0x 868C
0x 8740
0x 873C
0x 8734
0x A1EC
0x A404
0x A408
0x A40C
0x A410
0x A414
0x A418
0x A41C
0x A420
0x A424
0x A428
0x A42C
0x A430
0x A434
0x A438
0x A43C
0x A440
0x A444
0x A448
0x A44C
0x A450
0x A454
0x A458
0x A45C
0x A460
0x A464
0x A468
0x A470
0x A474
0x A478
0x A47C
0x A480
0x A484
0x A488
0x A48C
0x A490
0x A494
0x A498
0x A49C
0x A4A0
0x A4A4
0x A4A8
0x A4AC
0x A4B0
0x A4B4
0x A4B8
0x A4BC
0x A4C0
0x A4C4
0x A4C8
0x A4CC
0x A4D0
0x A4D4
0x A4D8
0x A4DC
0x A4E0
0x A4E4
0x A4E8
0x A4F4
0x A4F8
0x A4FC
0x A500
0x A504
0x A508
0x A50C
0x A510
0x A514
0x A518
0x A51C
0x A520
0x A524
0x A528
0x A52C
0x A530
0x A534
0x A538
0x A53C
0x A540
0x A544
0x A548
0x A54C
0x A550
0x A554
0x A558
0x A55C
0x A560
0x A564
0x A568
0x A56C
0x A570
0x A574
0x A578
0x A57C
0x A580
0x A584
0x A588
0x A58C
0x A590
0x A594
0x A598
0x A59C
0x A5A0
0x A5A4
0x A5A8
0x A5AC
0x A5B0
0x A5B4
0x A5B8
0x A5BC
0x A5C0
0x A5C4
0x A5C8
0x A5CC
0x A5D0
0x A5D4
0x A5D8
0x A5DC
0x A5E0
0x A5E4
0x A5E8
0x A5EC
0x A5F0
0x A5F4
0x A5F8
0x A5FC
0x A600
0x A604
0x A608
0x A60C
0x A610
0x A614
0x A618
0x A61C
0x A620
0x A624
0x A628
0x A62C
0x A630
0x A634
0x A638
0x A63C
0x A640
0x A644
0x A648
0x A64C
0x A650
0x A654
0x A658
0x A65C
0x A660
0x A664
0x A668
0x A66C
0x A670
0x A674
0x A678
0x A67C
0x A680
0x A684
0x A688
0x A68C
0x A690
0x A694
0x A698
0x A69C
0x A6A0
0x A6A4
0x A6A8
0x A6AC
0x A6B0
0x A6B4
0x A6B8
0x A6BC
0x A6C0
0x A6C4
0x A6C8
0x A6CC
0x A6D0
0x A6D4
0x A6D8
0x A6DC
0x A6E0
0x A6E4
0x A6E8
0x A6EC
0x A6F0
0x A6F4
0x A6F8
0x A6FC
0x A700
0x A704
0x A708
0x A70C
0x A710
0x A714
0x A718
0x A71C
0x A720
0x A724
0x A728
0x A72C
0x A730
0x A734
0x A738
0x A73C
0x A740
0x A744
0x A748
0x A74C
0x A750
0x A754
0x A758
0x A75C
0x A760
0x A764
0x A768
0x A76C
0x A770
0x A774
0x A778
0x A77C
0x A780
0x A784
0x A788
0x A78C
0x A790
0x A794
0x A798
0x A79C
0x A7A0
0x A7A4
0x A7A8
0x A7AC
0x A7B0
0x A7B4
0x A7B8
0x A7BC
0x A7C0
0x A7C4
0x A7C8
0x A7CC
0x A7D0
0x A7D4
0x A7D8
0x A7DC
0x A7E0
0x A7E4
0x A7E8
0x A7EC
0x A7F0
0x A7F4
0x A7F8
0x A7FC
0x A4F0
0x A4EC
0x A46C
0x A1E0
0x A1DC
0x 8738
0x 6B8
0x A804
0x A808
0x A80C
0x A810
0x A814
0x A818
0x A81C
0x A820
0x A824
0x A828
0x A82C
0x A830
0x A834
0x A838
0x A83C
0x A840
0x A844
0x A848
0x A84C
0x A850
0x A854
0x A858
0x A85C
0x A860
0x A864
0x A868
0x A86C
0x A870
0x A874
0x A878
0x A87C
0x A880
0x A884
0x A888
0x A88C
0x A890
0x A894
0x A898
0x A89C
0x A8A0
0x A8A4
0x A8A8
0x A8AC
0x A8B0
0x A8B4
0x A8B8
0x A8BC
0x A8C0
0x A8C4
0x A8C8
0x A8CC
0x A8D0
0x A8D4
0x A8D8
0x A8DC
0x A8E0
0x A8E4
0x A8E8
0x A8EC
0x A8F0
0x A8F4
0x A8F8
0x A8FC
0x A900
0x A904
0x A908
0x A90C
0x A910
0x A914
0x A918
0x A91C
0x A920
0x A924
0x A928
0x A92C
0x A930
0x A934
0x A938
0x A93C
0x A940
0x A944
0x A948
0x A94C
0x A950
0x A954
0x A958
0x A95C
0x A960
0x A964
0x A968
0x A96C
0x A970
0x A974
0x A978
0x A97C
0x A980
0x A984
0x A988
0x A98C
0x A990
0x A994
0x A998
0x A99C
0x A9A0
0x A9A4
0x A9A8
0x A9AC
0x A9B0
0x A9B4
0x A9B8
0x A9BC
0x A9C0
0x A9C4
0x A9C8
0x A9CC
0x A9D0
0x A9D4
0x A9D8
0x A9DC
0x A9E0
0x A9E4
0x A9E8
0x A9EC
0x A9F0
0x A9F4
0x A9F8
0x A9FC
0x AA00
0x AA04
0x AA08
0x AA0C
0x AA10
0x AA14
0x AA18
0x AA1C
0x AA20
0x AA24
0x AA28
0x AA2C
0x AA30
0x AA34
0x AA38
0x AA3C
0x AA40
0x AA44
0x AA48
0x AA4C
0x AA50
0x AA54
0x AA58
0x AA5C
0x AA60
0x AA64
0x AA68
0x AA6C
0x AA70
0x AA74
0x AA78
0x AA7C
0x AA80
0x AA84
0x AA88
0x AA8C
0x AA90
0x AA94
0x AA98
0x AA9C
0x AAA0
0x AAA4
0x AAA8
0x AAAC
0x AAB0
0x AAB4
0x AAB8
0x AABC
0x AAC0
0x AAC4
0x AAC8
0x AACC
0x AAD0
0x AAD4
0x AAD8
0x AADC
0x AAE0
0x AAE4
0x AAE8
0x AAEC
0x AAF0
0x AAF4
0x AAF8
0x AAFC
0x AB00
0x AB04
0x AB08
0x AB0C
0x AB10
0x AB14
0x AB18
0x AB1C
0x AB20
0x AB24
0x AB28
0x AB2C
0x AB30
0x AB34
0x AB38
0x AB3C
0x AB40
0x AB44
0x AB48
0x AB4C
0x AB50
0x AB54
0x AB58
0x AB5C
0x AB60
0x AB64
0x AB68
0x AB6C
0x AB70
0x AB74
0x AB78
0x AB7C
0x AB80
0x AB84
0x AB88
0x AB8C
0x AB90
0x AB94
0x AB98
0x AB9C
0x ABA0
0x ABA4
0x ABA8
0x ABAC
0x ABB0
0x ABB4
0x ABB8
0x ABBC
0x ABC0
0x ABC4
0x ABC8
0x ABCC
0x ABD0
0x ABD4
0x ABD8
0x ABDC
0x ABE0
0x ABE4
0x ABE8
0x ABEC
0x ABF0
0x ABF4
0x ABF8
0x ABFC
0x A1E8
0x AC04
0x AC08
0x AC0C
0x AC10
0x AC14
0x AC18
0x AC1C
0x AC20
0x AC24
0x AC28
0x AC2C
0x AC30
0x AC34
0x AC38
0x AC3C
0x AC40
0x AC44
0x AC48
0x AC4C
0x AC50
0x AC54
0x AC58
0x AC5C
0x AC60
0x AC64
0x AC68
0x AC6C
0x AC70
0x AC74
0x AC78
0x AC7C
0x AC80
0x AC84
0x AC88
0x AC8C
0x AC90
0x AC94
0x AC98
0x AC9C
0x ACA0
0x ACA4
0x ACA8
0x ACAC
0x ACB0
0x ACB4
0x ACB8
0x ACBC
0x ACC0
0x ACC4
0x ACC8
0x ACCC
0x ACD0
0x ACD4
0x ACD8
0x ACDC
0x ACE0
0x ACE4
0x ACE8
0x ACEC
0x ACF0
0x ACF4
0x ACF8
0x ACFC
0x AD00
0x AD04
0x AD08
0x AD0C
0x AD10
0x AD14
0x AD18
0x AD1C
0x AD20
0x AD24
0x AD28
0x AD2C
0x AD30
0x AD34
0x AD38
0x AD3C
0x AD40
0x AD44
0x AD48
0x AD4C
0x AD50
0x AD54
0x AD58
0x AD5C
0x AD60
0x AD64
0x AD68
0x AD6C
0x AD70
0x AD74
0x AD78
0x AD7C
0x AD80
0x AD84
0x AD88
0x AD8C
0x AD90
0x AD94
0x AD98
0x AD9C
0x ADA0
0x ADA4
0x ADA8
0x ADAC
0x ADB0
0x ADB4
0x ADB8
0x ADBC
0x ADC0
0x ADC4
0x ADC8
0x ADCC
0x ADD0
0x ADD4
0x ADD8
0x ADDC
0x ADE0
0x ADE4
0x ADE8
0x ADEC
0x ADF0
0x ADF4
0x ADF8
0x ADFC
0x AE00
0x AE04
0x AE08
0x AE0C
0x AE10
0x AE14
0x AE18
0x AE1C
0x AE20
0x AE24
0x AE28
0x AE2C
0x AE30
0x AE34
0x AE38
0x AE3C
0x AE40
0x AE44
0x AE48
0x AE4C
0x AE50
0x AE54
0x AE58
0x AE5C
0x AE60
0x AE64
0x AE68
0x AE6C
0x AE70
0x AE74
0x AE78
0x AE7C
0x AE80
0x AE84
0x AE88
0x AE8C
0x AE90
0x AE94
0x AE98
0x AE9C
0x AEA0
0x AEA4
0x AEA8
0x AEAC
0x AEB0
0x AEB4
0x AEB8
0x AEBC
0x AEC0
0x AEC4
0x AEC8
0x AECC
0x AED0
0x AED4
0x AED8
0x AEDC
0x AEE0
0x AEE4
0x AEE8
0x AEEC
0x AEF0
0x AEF4
0x AEF8
0x AEFC
0x AF00
0x AF04
0x AF08
0x AF0C
0x AF10
0x AF14
0x AF18
0x AF1C
0x AF20
0x AF24
0x AF28
0x AF2C
0x AF30
0x AF34
0x AF38
0x AF3C
0x AF40
0x AF44
0x AF48
0x AF4C
0x AF50
0x AF54
0x AF58
0x AF5C
0x AF60
0x AF64
0x AF68
0x AF6C
0x AF70
0x AF74
0x AF78
0x AF7C
0x AF80
0x AF84
0x AF88
0x AF8C
0x AF90
0x AF94
0x AF98
0x AF9C
0x AFA0
0x AFA4
0x AFA8
0x AFAC
0x AFB0
0x AFB4
0x AFB8
0x AFBC
0x AFC0
0x AFC4
0x AFC8
0x AFCC
0x AFD0
0x AFD4
0x AFD8
0x AFDC
0x AFE0
0x AFE4
0x AFE8
0x AFEC
0x AFF0
0x AFF4
0x AFF8
0x AFFC
0x B004
0x B008
0x B00C
0x B010
0x B014
0x B018
0x B01C
0x B020
0x B024
0x B028
0x B02C
0x B030
0x B034
0x B038
0x B03C
0x B040
0x B044
0x B048
0x B04C
0x B050
0x B054
0x B058
0x B05C
0x B060
0x B064
0x B068
0x B06C
0x B070
0x B074
0x B078
0x B07C
0x B080
0x B084
0x B088
0x B08C
0x B090
0x B094
0x B098
0x B09C
0x B0A0
0x B0A4
0x B0A8
0x B0AC
0x B0B0
0x B0B4
0x B0B8
0x B0BC
0x B0C0
0x B0C4
0x B0C8
0x B0CC
0x B0D0
0x B0D4
0x B0D8
0x B0DC
0x B0E0
0x B0E4
0x B0E8
0x B0EC
0x B0F0
0x B0F4
0x B0F8
0x B0FC
0x B100
0x B104
0x B108
0x B10C
0x B110
0x B114
0x B118
0x B11C
0x B120
0x B124
0x B128
0x B12C
0x B130
0x B134
0x B138
0x B13C
0x B140
0x B144
0x B148
0x B14C
0x B150
0x B154
0x B158
0x B15C
0x B160
0x B164
0x B168
0x B16C
0x B170
0x B174
0x B178
0x B17C
0x B180
0x B184
0x B188
0x B18C
0x B190
0x B194
0x B198
0x B19C
0x B1A0
0x B1A4
0x B1A8
0x B1AC
0x B1B0
0x B1B4
0x B1B8
0x B1BC
0x B1C0
0x B1C4
0x B1C8
0x B1CC
0x B1D0
0x B1D4
0x B1D8
0x B1DC
0x B1E0
0x B1E4
0x B1E8
0x B1EC
0x B1F0
0x B1F4
0x B1F8
0x B1FC
0x B200
0x B204
0x B208
0x B20C
0x B210
0x B214
0x B218
0x B21C
0x B220
0x B224
0x B228
0x B22C
0x B230
0x B234
0x B238
0x B23C
0x B240
0x B244
0x B248
0x B24C
0x B250
0x B254
0x B258
0x B25C
0x B260
0x B264
0x B268
0x B26C
0x B270
0x B274
0x B278
0x B27C
0x B280
0x B284
0x B288
0x B28C
0x B290
0x B294
0x B298
0x B29C
0x B2A0
0x B2A4
0x B2A8
0x B2AC
0x B2B0
0x B2B8
0x B2BC
0x B2C0
0x B2C4
0x B2C8
0x B2CC
0x B2D0
0x B2D4
0x B2D8
0x B2DC
0x B2E0
0x B2E4
0x B2E8
0x B2EC
0x B2F0
0x B2F4
0x B2F8
0x B2FC
0x B300
0x B304
0x B308
0x B30C
0x B310
0x B314
0x B318
0x B31C
0x B320
0x B324
0x B328
0x B32C
0x B330
0x B334
0x B338
0x B33C
0x B340
0x B344
0x B348
0x B34C
0x B350
0x B354
0x B358
0x B35C
0x B360
0x B364
0x B368
0x B36C
0x B370
0x B374
0x B378
0x B37C
0x B380
0x B384
0x B388
0x B38C
0x B390
0x B394
0x B398
0x B39C
0x B3A0
0x B3A4
0x B3A8
0x B3AC
0x B3B0
0x B3B4
0x B3B8
0x B3BC
0x B3C0
0x B3C4
0x B3C8
0x B3CC
0x B3D0
0x B3D4
0x B3D8
0x B3DC
0x B3E0
0x B3E4
0x B3E8
0x B3EC
0x B3F0
0x B3F4
0x B3F8
0x B3FC
0x B404
0x B408
0x B40C
0x B410
0x B414
0x B418
0x B41C
0x B420
0x B424
0x B428
0x B42C
0x B430
0x B434
0x B438
0x B43C
0x B440
0x B444
0x B448
0x B44C
0x B450
0x B454
0x B458
0x B45C
0x B460
0x B464
0x B468
0x B46C
0x B470
0x B474
0x B478
0x B47C
0x B480
0x B484
0x B488
0x B48C
0x B490
0x B494
0x B498
0x B49C
0x B4A0
0x B4A4
0x B4A8
0x B4AC
0x B4B0
0x B4B4
0x B4C0
0x B4C4
0x B4C8
0x B4CC
0x B4D0
0x B4D4
0x B4D8
0x B4DC
0x B4E0
0x B4E4
0x B4E8
0x B4EC
0x B4F0
0x B4F4
0x B4F8
0x B4FC
0x B500
0x B504
0x B508
0x B50C
0x B510
0x B514
0x B518
0x B51C
0x B520
0x B524
0x B528
0x B52C
0x B530
0x B534
0x B538
0x B53C
0x B540
0x B544
0x B548
0x B54C
0x B550
0x B554
0x B558
0x B55C
0x B560
0x B564
0x B568
0x B56C
0x B570
0x B574
0x B578
0x B57C
0x B580
0x B584
0x B588
0x B58C
0x B590
0x B594
0x B598
0x B59C
0x B5A0
0x B5A4
0x B5A8
0x B5AC
0x B5B0
0x B5B4
0x B5B8
0x B5BC
0x B5C0
0x B5C4
0x B5C8
0x B5CC
0x B5D0
0x B5D4
0x B5D8
0x B5DC
0x B5E0
0x B5E4
0x B5E8
0x B5EC
0x B5F0
0x B5F8
0x B5FC
0x B600
0x B604
0x B608
0x B60C
0x B610
0x B614
0x B618
0x B61C
0x B620
0x B624
0x B628
0x B62C
0x B630
0x B634
0x B638
0x B63C
0x B640
0x B644
0x B648
0x B64C
0x B650
0x B654
0x B658
0x B65C
0x B660
0x B664
0x B668
0x B66C
0x B670
0x B674
0x B678
0x B67C
0x B680
0x B684
0x B688
0x B68C
0x B690
0x B694
0x B698
0x B69C
0x B6A0
0x B6AC
0x B6B0
0x B6B4
0x B6B8
0x B6BC
0x B6C0
0x B6C4
0x B6C8
0x B6CC
0x B6D0
0x B6D4
0x B6D8
0x B6DC
0x B6E0
0x B6E4
0x B6E8
0x B6EC
0x B6F0
0x B6F4
0x B6F8
0x B6FC
0x B700
0x B704
0x B708
0x B70C
0x B710
0x B714
0x B718
0x B71C
0x B720
0x B724
0x B728
0x B72C
0x B730
0x B734
0x B738
0x B73C
0x B740
0x B744
0x B750
0x B754
0x B758
0x B75C
0x B760
0x B764
0x B768
0x B76C
0x B770
0x B774
0x B778
0x B77C
0x B780
0x B784
0x B788
0x B78C
0x B790
0x B794
0x B798
0x B79C
0x B7A0
0x B7A4
0x B7A8
0x B7AC
0x B7B0
0x B7B4
0x B7B8
0x B7BC
0x B7C0
0x B7C4
0x B7C8
0x B7CC
0x B7D0
0x B7D4
0x B7D8
0x B7DC
0x B7E0
0x B7EC
0x B7F0
0x B7F4
0x B7F8
0x B7FC
0x B62C
0x B74C
0x B804
0x B808
0x B80C
0x B810
0x B814
0x B818
0x B81C
0x B820
0x B824
0x B828
0x B82C
0x B830
0x B834
0x B838
0x B83C
0x B840
0x B844
0x B848
0x B84C
0x B854
0x B858
0x B85C
0x B860
0x B864
0x B868
0x B86C
0x B870
0x B874
0x B878
0x B87C
0x B880
0x B884
0x B890
0x B894
0x B898
0x B89C
0x B8A0
0x B8A4
0x B8A8
0x B8AC
0x B8B0
0x B8B4
0x B8B8
0x B8BC
0x B8C0
0x B8C4
0x B8C8
0x B8CC
0x B8D0
0x B8D4
0x B8D8
0x B8DC
0x B8E0
0x B8E4
0x B8E8
0x B8EC
0x B8F0
0x B8F4
0x B8F8
0x B8FC
0x B900
0x B904
0x B908
0x B90C
0x B910
0x B914
0x B918
0x B91C
0x B920
0x B924
0x B928
0x B92C
0x B930
0x B934
0x B938
0x B93C
0x B940
0x B944
0x B948
0x B94C
0x B950
0x B954
0x B958
0x B95C
0x B960
0x B964
0x B968
0x B96C
0x B970
0x B974
0x B978
0x B97C
0x B980
0x B984
0x B988
0x B98C
0x B990
0x B994
0x B998
0x B99C
0x B9A0
0x B9A4
0x B9A8
0x B9AC
0x B9B0
0x B9B4
0x B9B8
0x B9BC
0x B9C0
0x B9C4
0x B9C8
0x B9CC
0x B9D0
0x B9D4
0x B9D8
0x B9DC
0x B9E0
0x B9E4
0x B9E8
0x B9EC
0x B9F0
0x B9F4
0x B9F8
0x B9FC
0x BA00
0x BA04
0x BA08
0x BA0C
0x BA10
0x BA14
0x BA18
0x BA1C
0x BA20
0x BA24
0x BA28
0x BA2C
0x BA30
0x BA34
0x BA38
0x BA3C
0x BA40
0x BA44
0x BA48
0x BA4C
0x BA50
0x BA54
0x BA58
0x BA5C
0x BA60
0x BA64
0x BA68
0x BA6C
0x BA70
0x BA74
0x BA78
0x BA7C
0x BA80
0x BA84
0x BA88
0x BA8C
0x BA90
0x BA94
0x BA98
0x BA9C
0x BAA0
0x BAA4
0x BAA8
0x BAAC
0x BAB0
0x BAB4
0x BAB8
0x BABC
0x BAC0
0x BAC4
0x BAC8
0x BACC
0x BAD0
0x BAD4
0x BAD8
0x BADC
0x BAE0
0x BAE4
0x BAE8
0x BAEC
0x BAF0
0x BAF4
0x BAF8
0x BAFC
0x BB00
0x BB04
0x BB08
0x BB0C
0x BB10
0x BB14
0x BB18
0x BB1C
0x BB20
0x BB24
0x BB28
0x BB2C
0x BB30
0x BB34
0x BB38
0x BB3C
0x BB40
0x BB44
0x BB48
0x BB4C
0x BB50
0x BB54
0x BB58
0x BB5C
0x BB60
0x BB64
0x BB68
0x BB6C
0x BB70
0x BB74
0x BB78
0x BB7C
0x BB80
0x BB84
0x BB88
0x BB8C
0x BB90
0x BB94
0x BB98
0x BB9C
0x BBA0
0x BBA4
0x BBA8
0x BBAC
0x BBB0
0x BBB4
0x BBB8
0x BBBC
0x BBC0
0x BBC4
0x BBC8
0x BBCC
0x BBD0
0x BBD4
0x BBD8
0x BBDC
0x BBE0
0x BBE4
0x BBE8
0x BBEC
0x BBF0
0x BBF4
0x BBF8
0x BBFC
0x B88C
0x B850
0x B888
0x B6A8
0x B6A4
0x B7E4
0x B748
0x BC04
0x BC08
0x BC0C
0x BC10
0x BC14
0x BC18
0x BC1C
0x BC20
0x BC24
0x BC28
0x BC2C
0x BC30
0x BC34
0x BC38
0x BC3C
0x BC40
0x BC44
0x BC48
0x BC4C
0x BC50
0x BC54
0x BC58
0x BC5C
0x BC60
0x BC64
0x BC68
0x BC6C
0x BC70
0x BC74
0x BC78
0x BC7C
0x BC80
0x BC84
0x BC88
0x BC8C
0x BC90
0x BC94
0x BC98
0x BC9C
0x BCA0
0x BCA4
0x BCA8
0x BCAC
0x BCB0
0x BCB4
0x BCB8
0x BCBC
0x BCC0
0x BCC4
0x BCC8
0x BCCC
0x BCD0
0x BCD4
0x BCD8
0x BCDC
0x BCE0
0x BCE4
0x BCE8
0x BCEC
0x BCF0
0x BCF4
0x BCF8
0x BCFC
0x BD00
0x BD04
0x BD08
0x BD0C
0x BD10
0x BD14
0x BD18
0x BD1C
0x BD20
0x BD24
0x BD28
0x BD2C
0x BD30
0x BD34
0x BD38
0x BD3C
0x BD40
0x BD44
0x BD50
0x BD5C
0x BD60
0x BD68
0x BD6C
0x BD70
0x BD74
0x BD78
0x BD7C
0x BD80
0x BD84
0x BD88
0x BD8C
0x BD90
0x BD94
0x BD98
0x BD9C
0x BDA0
0x BDA4
0x BDA8
0x BDAC
0x BDB0
0x BDB4
0x BDBC
0x BDC0
0x BDC4
0x BDCC
0x BDD0
0x BDD4
0x BDD8
0x BDDC
0x BDE0
0x BDE4
0x BDE8
0x BDEC
0x BDF0
0x BDF4
0x BDF8
0x BDFC
0x BE00
0x BE04
0x BE08
0x BE0C
0x BE10
0x BE14
0x BE18
0x BE1C
0x BE20
0x BE24
0x BE28
0x BE2C
0x BE30
0x BE34
0x BE38
0x BE3C
0x BE40
0x BE44
0x BE48
0x BE4C
0x BE50
0x BE58
0x BE5C
0x BE60
0x BE64
0x BE68
0x BE6C
0x BE70
0x BE74
0x BE78
0x BE7C
0x BE80
0x BE84
0x BE88
0x BE8C
0x BE90
0x BE94
0x BE98
0x BEA0
0x BEA4
0x BEA8
0x BEAC
0x BEB4
0x BEB8
0x BEBC
0x BEC0
0x BEC4
0x BEC8
0x BECC
0x BED0
0x BED4
0x BED8
0x BEDC
0x BEE0
0x BEE4
0x BEE8
0x BEEC
0x BEF0
0x BEF4
0x BEF8
0x BEFC
0x BF00
0x BF04
0x BF08
0x BF0C
0x BF10
0x BF14
0x BF18
0x BF1C
0x BF20
0x BF24
0x BF28
0x BF2C
0x BF30
0x BF34
0x BF38
0x BF3C
0x BF40
0x BF44
0x BF48
0x BF4C
0x BF50
0x BF54
0x BF58
0x BF5C
0x BF60
0x BF64
0x BF68
0x BF6C
0x BF70
0x BF74
0x BF78
0x BF7C
0x BF80
0x BF84
0x BF88
0x BF8C
0x BF90
0x BF94
0x BF98
0x BF9C
0x BFA0
0x BFA4
0x BFA8
0x BFAC
0x BFB0
0x BFB4
0x BFB8
0x BFBC
0x BFC0
0x BFC4
0x BFC8
0x BFCC
0x BFD0
0x BFD4
0x BFD8
0x BFDC
0x BFE0
0x BFE4
0x BFE8
0x BFEC
0x BFF0
0x BFF4
0x BFF8
0x BFFC
0x 8360
0x BD4C
0x 498
0x EE8
0x E74
0x 2AF0
0x BE9C
0x E4C
0x BDC8
0x EB8
0x EBC
0x E28
0x E24
0x C004
0x C008
0x C00C
0x C010
0x C014
0x C018
0x C01C
0x C020
0x C024
0x C028
0x C02C
0x C030
0x C034
0x C038
0x C03C
0x C040
0x C044
0x C048
0x C04C
0x C050
0x C054
0x C058
0x C05C
0x C060
0x C064
0x C068
0x C06C
0x C070
0x C074
0x C078
0x C07C
0x C080
0x C084
0x C088
0x C08C
0x C090
0x C094
0x C098
0x C09C
0x C0A0
0x C0A4
0x C0A8
0x C0AC
0x C0B0
0x C0B4
0x C0B8
0x C0BC
0x C0C0
0x C0C4
0x C0C8
0x C0CC
0x C0D0
0x C0D4
0x C0D8
0x C0DC
0x C0E0
0x C0E4
0x C0E8
0x C0EC
0x C0F0
0x C0F4
0x C0F8
0x C0FC
0x C100
0x C104
0x C108
0x C10C
0x C110
0x C114
0x C118
0x C11C
0x C120
0x C124
0x C128
0x C12C
0x C130
0x C134
0x C138
0x C13C
0x C140
0x C144
0x C148
0x C14C
0x C150
0x C154
0x C158
0x C15C
0x C160
0x C164
0x C168
0x C16C
0x C170
0x C174
0x C178
0x C17C
0x C180
0x C184
0x C188
0x C18C
0x C190
0x C194
0x C198
0x C19C
0x C1A0
0x C1A4
0x C1A8
0x C1AC
0x C1B0
0x C1B4
0x C1B8
0x C1BC
0x C1C0
0x C1C4
0x C1C8
0x C1CC
0x C1D0
0x C1D4
0x C1D8
0x C1DC
0x C1E0
0x C1E4
0x C1E8
0x C1EC
0x C1F0
0x C1F4
0x C1F8
0x C1FC
0x C200
0x C204
0x C208
0x C20C
0x C210
0x C214
0x C218
0x C21C
0x C220
0x C224
0x C228
0x C22C
0x C230
0x C234
0x C238
0x C23C
0x C240
0x C244
0x C248
0x C24C
0x C250
0x C254
0x C258
0x C25C
0x C260
0x C264
0x C268
0x C26C
0x C270
0x C274
0x C278
0x C27C
0x C280
0x C284
0x C288
0x C28C
0x C290
0x C294
0x C298
0x C29C
0x C2A0
0x C2A4
0x C2A8
0x C2AC
0x C2B0
0x C2B4
0x C2B8
0x C2BC
0x C2C0
0x C2C4
0x C2C8
0x C2CC
0x C2D0
0x C2D4
0x C2D8
0x C2DC
0x C2E0
0x C2E4
0x C2E8
0x C2EC
0x C2F0
0x C2F4
0x C2F8
0x C2FC
0x C300
0x C304
0x C308
0x C30C
0x C310
0x C314
0x C318
0x C31C
0x C320
0x C324
0x C328
0x C32C
0x C330
0x C334
0x C338
0x C33C
0x C340
0x C344
0x C348
0x C34C
0x C350
0x C354
0x C358
0x C35C
0x C360
0x C364
0x C368
0x C36C
0x C370
0x C374
0x C378
0x C37C
0x C380
0x C384
0x C388
0x C38C
0x C390
0x C394
0x C398
0x C39C
0x C3A0
0x C3AC
0x C3B0
0x C3B4
0x C3B8
0x C3C4
0x C3C8
0x C3CC
0x C3D0
0x C3D4
0x C3D8
0x C3DC
0x C3E0
0x C3E4
0x C3E8
0x C3EC
0x C3F0
0x C3F4
0x C3F8
0x C3FC
0x BD64
0x BD58
0x BD54
0x BD48
0x B4B8
0x C39C
0x C3C0
0x C404
0x C408
0x C40C
0x C410
0x C414
0x C418
0x C41C
0x C420
0x C424
0x C428
0x C430
0x C434
0x C438
0x C43C
0x C440
0x C444
0x C448
0x C44C
0x C450
0x C454
0x C458
0x C45C
0x C460
0x C464
0x C468
0x C46C
0x C470
0x C474
0x C478
0x C484
0x C488
0x C48C
0x C490
0x C494
0x C498
0x C49C
0x C4A0
0x C4A4
0x C4A8
0x C4AC
0x C4B0
0x C4B4
0x C4B8
0x C4BC
0x C4C0
0x C4C4
0x C4C8
0x C4CC
0x C4D0
0x C4D4
0x C4D8
0x C4DC
0x C4E0
0x C4E4
0x C4E8
0x C4EC
0x C4F0
0x C4F4
0x C4F8
0x C4FC
0x C500
0x C504
0x C508
0x C50C
0x C510
0x C514
0x C518
0x C51C
0x C520
0x C524
0x C528
0x C52C
0x C530
0x C534
0x C538
0x C53C
0x C540
0x C544
0x C548
0x C54C
0x C550
0x C554
0x C558
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
r1.exe 0x30000000 0x302D0FFF Relevant Image - 32-bit - True False
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Boot\BOOTSTAT.DAT 64.28 KB MD5: cd49df5938865b27e52e5e64a94265ab
SHA1: 6ac54d11e5a9a9ae147a21770439d8b8fc9c7607
SHA256: 64691d9214b2c5e042f59cac6ab37ae56d5c0cb210112184eb7e329e74427d3c
SSDeep: 1536:atpnox46yLgpPYJF/yWPLECYRdBA8kWcgvEm:ipVQpQz/yWc3BAXuJ 		True
...
C:\BOOTSECT.BAK 8.28 KB MD5: 46f9ee2d85d17dc92d20809f5f5766a6
SHA1: 1608a0217edb9a7532d9e3cba28673b94de85b69
SHA256: f842bad2abd38fc843237c6195f13a81ffbb9cda240be4c3879bcce917ff4e8f
SSDeep: 192:zrKmCJc1wqdyBZKxQUpGP7xyLTDJSzg4MvLRbS104/GAHM51a2B:zocVdyBUYDxyp2g4MDAXGXr 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst.RYK 52.22 KB MD5: 5177c059c5169bc603787ff18d70edcd
SHA1: 8d35be69f9a52da61dc9cf5ae94ec69a4eb0c00a
SHA256: 06970ed432ebadadb8f65bf0346ae76e1429b9d972b1c3456bfa9e4259f20b76
SSDeep: 1536:iex+e7tAo1JGQWOEsqqtE7+iMfus3xBgMOPdyy:iexDtfknetXfuzvN 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.RYK 2.89 KB MD5: c7603188c735c2ad038260aaad36c22c
SHA1: aabae43787e2271762e5c32aebb50ca220e92009
SHA256: 4087e763dca0cd64692ab1a988d8628d8276c63857c239723cb4cdbe4ba6c8e5
SSDeep: 48:katddhhbvBV9uOArwIVP71XyiDtCLUE1aHc/ywKTtzNV+UKoaEk919KYACApn:katddHwHVPJXyBAQ/ywatyUKE419dA7p 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst.RYK 1.42 KB MD5: 647308de310c1c21f01fd1290df321bd
SHA1: a189f8c5252b573989e94b02f7180ad225a53db3
SHA256: cedee87cdb2443c363d4aaa42b5ce5a56c42a01b8bb7cda8b84d5f2d6cd2e09f
SSDeep: 24:AN9tGBSsGlivSbSDP6m/2W/k7RlQTZTGXbKUWu6fCwMZmyD:AN9gBSsGlicS3+W/kH0TGOW9m+ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin.RYK 75.94 KB MD5: 2c513927f9fac4bf951c6bfc6e7c5fcc
SHA1: 73274303e7632c0068452ee5c0af69833396f1fc
SHA256: fca5ad654c2369891fc7dc81d058f8e283f106de079a2f0a0c4de0b9cd07218b
SSDeep: 1536:JuEwTZ1J+Gcvz856HJSXb5irEVVG6TajOC8CHMJaMaKnRJcBGw:oEk1J+Bb80gYotq8CHMwMjRqBX 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst.RYK 135.49 KB MD5: 54aa4ff368379b1c0eedbd2c5764348e
SHA1: 302c82e4329e5ca9178fe6dbb4dfcde3109d1246
SHA256: 189170fb340359ef4ea8b7c7953b411e0b78da28b3af13723ebc718843684457
SSDeep: 3072:o6rvPgJ079RNDHGqManGBXPfBnTeuoJ/+LnQB0K:PztDHnEfJe7JWDQB0K 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst.RYK 34.56 KB MD5: c652be4cf90b409144828e1daf2eb748
SHA1: 25e5cd3ab8fbc08366598857c52f8afe2e2030a2
SHA256: b0a2d106098c97b7c1ac5e3d5be51bc80dc9ec2f77749d8450d5d449b68ddaad
SSDeep: 768:tnDZFhxd80FwXlvJne8jKQpwiOKkCJL4q3TnMxtAiJVcjLQ:tnDZFhxd8EclLLECt4QLQ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK 64.94 KB MD5: 02e6d3227cec11f5b2944866c7d8b9d6
SHA1: 0f7830d45282bd14db4bea2a5f2e5fa4f720c85e
SHA256: e725818c0450deacac4c6e3235f92eca85f4a1b0e7baeabd7936c26a5d8f6b4c
SSDeep: 1536:2ux2nEDL/N6WSx8u59R0+HhvX+MeiIi0Np3+5gi51o:2HELF6WSN5j0g+piIi0Nl+5g/ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Acrobat\10.0\SharedDataEvents.RYK 5.28 KB MD5: 0da8ec41785b87913b6c3f203c94dc12
SHA1: 39d2cbcb19789e622e05029e9fe3ee5036fc38df
SHA256: 8879e308c01fe2c87a41440ec64ce6e26bce3550a3ce76a2da125db62a6d06f4
SSDeep: 96:oVK/Yd14JbuAkvvsHDlENfUuezSKBRmmgQ6eT8euhsTgH7m+2ImHxZf62E0wcMIy:p/VuAkvv0CNcRzSIweGs8H7m+2bC2LM7 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\GDIPFONTCACHEV1.DAT.RYK 106.55 KB MD5: 5f35310ac36a477b0c299708a9366882
SHA1: 5d169f46278bfabad7f8026a9180d5365e8b53e7
SHA256: 033805e63dfa3ee5b9dc7194fd19a6a01c1e4ad0aa883638ad1bd20aa1fae06d
SSDeep: 1536:te88+a7aiuNadaiiFMzTLsNhDm1aawAzjjCRGuN1PEiYJOP9w1Sdn:tsaiuFiEcT6J3gXj0/3EVm9CSdn 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db.RYK 1.15 MB MD5: 4e339e3213f4ba4f2200277e608db0f2
SHA1: 9adc7bdc780881b479772fc81a04cd62b40ec127
SHA256: 1095311d794b360470462a044ab534fbcaa9f660d28ea58fa634fc2db272c14e
SSDeep: 24576:NWSk/piFXxEjYJapsUuQEblpSnwGxFCjjf5r2Szuyk/CqlpEv+W3hOS:cH/piJCgTDQEbl4jrQdX4nl6V3B 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5Kvc aIyBu.odt.RYK 4.55 KB MD5: fd68189bb682d61c24e38a7dc9754d0c
SHA1: 5a1cf81cf1fddc2bced46c92fe39e044fd4081d5
SHA256: b9d5e1e892d0e3577073e05def14f901364dd72a103d4d1c6f8307245ea874de
SSDeep: 96:2ymqbuu5OgR7EWlbYqNCZ3SouV3DsTHzfvp3JITHTG6twcLfT9CskMn3D0yh:2yrmgKWqqNCV2wp5ytwyfTpnz3 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7LC7h3NKBPeoe.m4a.RYK 38.08 KB MD5: 3db68e2fe58355d5575f09104c542152
SHA1: f5c8bf3c741958daba26c59ef3f8acad0d67a1d2
SHA256: cc763ff75d7f2ee3e8347d3b8ff18063cee363e5a2876b35f28a826d4b3006f3
SSDeep: 768:EPx2LvshXuZVJTLO0C0bp+zKJmhfX1mAvQGq1V9DZSLO9XNjfMmcet:E5eEhx0CaEhfX1ZvjIS61xRBt 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\A54yMyJIBKZ4.ots.RYK 80.27 KB MD5: 88e72b26a29de2cc7e979b6c2f412356
SHA1: 6a403bc6d5b99b3a8371a95f3d616b2ea654d847
SHA256: 4e8ecb0d36b6e315ba4ee940fe88a89bd76b558742c9f41db3764aef96953cae
SSDeep: 1536:Pgg38zQITFsniRtXcQOYurxN5rNvVWAO472aoH9hFy8nxi6SJ:PW0IuniRtXcQJurxN3cA575oH/i9J 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Cookies\index.dat.RYK 16.28 KB MD5: 856fa5e535815b99dced1d1918101ac8
SHA1: 418403bb60d2e2b444d1c51322cc4ba07038cac7
SHA256: 725fe6de6638def37cf0874206a8a8acfaea243ec4f08bb77361076a6fa51a95
SSDeep: 384:GlSVBObFMYKYycSwDqJPlpSTE8ayeqTUHtk6xlfyGYT/:5aZrKYyzJdpSoDUKthWz 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\hViKCLPrU.gif.RYK 75.19 KB MD5: 9f9923d36e893889910867c407e360d9
SHA1: c8bdb6155070ecf5b1dfbd7e79db69337ea2ca4e
SHA256: 400d44c3b65d87f0016eda4db3bcd45610e5ed30a62c68667d6b76c9ebf17070
SSDeep: 1536:v+CvITUPbN2fM9197MzlkrYY+ZYhZEf8Q5WG87jrhAEe+nwd6t8PdtYiJcWS:vzwTUP0M397KY+Z4e0G87Pmgw2mdDJ0 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AhKC9lHcLc.m4a.RYK 89.17 KB MD5: c55e86b8222b100524c3e9fbdb965212
SHA1: 7abbf0b883470349efe9efcdb45776c008126060
SHA256: 16d2e0d09df67fea9cd3116bde10eb193c7f8a095dbb8e7bed6b3204e3a58bf8
SSDeep: 1536:rOeSy7M4+z6nKcvru4uh+xo3btc2uehaOe3Hzb3VrubYTC+hHj9uBx6DJ:8eM4ucvihTRvtelubOPhHj9MgJ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ldLFid8fGd2Cz6.bmp.RYK 22.19 KB MD5: 49166e60174564c86b809add5b87e760
SHA1: e315debc974d2d6445b3657b9ae76e2fdb261f76
SHA256: 6bf3c2209603b3c882510fcb118d56442f7844669192034a2256b98066e498e0
SSDeep: 384:PaeBESYIa6DIkSwhr1Yyw7/+XcqYF3in+cYsB0rDWTdeM0JboegstsVb:PaeKSYZk9+rQ0F3I+MB0X+wJbjgsE 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\kmb QJZmXmJi_.m4a.RYK 23.89 KB MD5: b2777feb34fe78d53c2aa96ec662612b
SHA1: b76303d83a7fe1649ebdec66e4daecdb86f0beb1
SHA256: b5408531b24ded2303462f627cdbc90dea904a00a7db2ff6989f4a3f965cc56c
SSDeep: 384:Hnq5GBAndKKOPWH8y+/cbM6HUSxeOWTfWQvi/Liwz5PA02p8XvBuwk2W51:HhAUKi8xMcI6HxeGLgKG3 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\j4n6VZ.png.RYK 63.78 KB MD5: 8c467a59e75283c1aa9d05cb702ef8a6
SHA1: 789f936c7aad881a65538764c9e0c1d78cb58e9c
SHA256: cb65e281c57b0371aebaa0e1660f07bddea67d43161d518fa526a2eec59626dc
SSDeep: 1536:yOsS2GkYR9E6v1DQBVHb9EBiuj8ypJQPYwFuRkJ3EkNwy6GbeMi:dA69F1cVpuAySAeJ0gwKbti 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\w5mAGJ1Y.bmp.RYK 52.49 KB MD5: 2424d58def03e1a949dd09a1935cd727
SHA1: 0ddd658dd2560f09f0afaacd45eaa00595ab7f2d
SHA256: 8688848aba47d452539f052bc21cd1e3d7bede98e68ef518ced44540035360d1
SSDeep: 1536:bUOvLyy45DC8dYimuimAPcA/hpUfDFi6nHWcV:bZvLdzxiPiv//SFnnHWcV 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\U8XmBQFiP7PLq9.wav.RYK 94.85 KB MD5: 88aecbcbece54d3757b0fb1039128c2b
SHA1: 9fa735147795458d34f07903d362a602b24db2e8
SHA256: 00b7395fb6ce1f388159bdc56127810dfd090f46ce484f5f6ab77523a307da1d
SSDeep: 1536:GRvzUHniIFLDWVrXOiO/fHh5aWOjhvHVl0a/IQgydPQ3on+4YH:QvzCniIxkO/fHT4vHnLdPQ3oU 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AdobeARM.log.RYK 1.02 KB MD5: 7ca768b3a81500014da192b322e31c47
SHA1: 03cd2885849793b01e852855905084d01d187460
SHA256: f2a058dbd1a02063fe0ca88348ebbec986ebb799d6eb37edf64a39cdd594058f
SSDeep: 24:92zu27Pf7wIDuu3SlliBwx2iHNsFpwS5ZZeidrsbjs+NZaQai+lR0lxan:IzL7f7wILSllio2iteGqZtsbBaq+T 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WTSuSWDiNChTS.ppt.RYK 79.72 KB MD5: bb2adf6a28e6ba8991e2964c4d08bac1
SHA1: 3afaccb2d2acf7184f38cf8fc2ae00ee27372e90
SHA256: 1a6e3e00dcec3bb9cb0b5d11cceab3f2454c75c1849b7e9d9ec253890958a67a
SSDeep: 1536:bkQVxiHQ7pmMB/62Pou/oM65p1/TMEhhUrvf9Yb3eE2MoA3VnakelUyDlVA4P:AwbByugxniEbUe2NA3sdUYh 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\x850.png.RYK 49.03 KB MD5: 92fc363a9b53772955a74c3c9858ccfb
SHA1: 59e129ecd504cba9821cf67de3ccd933de2db51d
SHA256: 9488df257f76dd0fa166ecc0a26971d90eecf4abb97fd99f029b242220e40f48
SSDeep: 1536:QJAUbxKhE6pJgJQQGucTwSa4ivBCMEm0H:UxElMDJcTja4ivIMcH 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ZpuiP.xls.RYK 79.56 KB MD5: 83ff91519ca581338537ef6042c57c5f
SHA1: 8713a5577d2aa6993311febf6d25a8a60d7d46d7
SHA256: 1777fba6fca54ef6ae4026851064f07e13e4c46228129ea3b94b8fc3be49db9b
SSDeep: 1536:D6F2eXwiNiVbNPBDPfke6aZR+OyMNpVhYsyD/EHoBQczukwaJGYQk8OPqabxWubP:D82egTTBzf/NyF8o2suwIOPt3P 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\index.dat.RYK 32.28 KB MD5: bed430d932388aeeb4a06c7b481f2687
SHA1: 2f37489b38acf7f80fa730af7e197978f2985e6e
SHA256: bf62a04f8478d342901919c09773f34a828dd80cc79cee8f18a8922ddfbc7997
SSDeep: 768:Osp1CENmsbAFrvQCCH7MKmyN/Ve+Uf/4oafsTxFiOf9OKS:l/ksMFrvsbMKmkI+e4oafrOf9OX 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK 6.78 KB MD5: 4edfb455b91e4a4935fd9832a7d1af8e
SHA1: 8347727b46384d6727927bf265544d3492358e38
SHA256: 1f1a75a9f8e29e8d0fdff61fef5ea3269f4452ff425a14553c013442224fed39
SSDeep: 192:zgp5qwASl5dkvvdaXSWBapDYWcipSYgwEi:chA0dkwiW8t1cioYgwEi 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FORMS\FRMCACHE.DAT.RYK 240.49 KB MD5: 17d37ecfbf33f61a60caf568edaf352f
SHA1: 45c656f609f3a408cbc8a8a48b46b79cdfdbb2f0
SHA256: 4dc246fa0a4835a304f5595a29c1b342dac3bab4e0cab450972468b4dcc3993b
SSDeep: 6144:YTM3NwEwX9G6i0VDIWEAaPtrm12cY9+zKylGMRcc:YT25wNG6i0LwBcY9KvlG1c 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\index.dat.RYK 32.28 KB MD5: 1925e48ef9d6d44e248fd1214ed3f94d
SHA1: e159de24e3a380572c2d60d288131aff3eca450d
SHA256: fc69895a5baf69fd1867390b177f98c7430fa32fc58a69a3d18518d6a6f9e445
SSDeep: 768:t8EiFSZWf9XladMhPlPBEcZalH/g+lbanV+uaYcV9uggX1Ot9O:t6FZ91BLPBnglMPXqbO 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.bak.RYK 12.19 KB MD5: 3e624ecd6737da73e5f46fda284768c5
SHA1: 3506a87dc8811744a83a247dd7329d720d6cdbd9
SHA256: df6bc3f1811a6b29de20c6732ef65d913a56ab3cdc5260444898bf5906477166
SSDeep: 384:1q3jrUN5b14yoEznAFCrWf8otPtIEZ6+Lq:I3jr4oyo4AESf7t1z2 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb.RYK 68.38 KB MD5: 7a186ff4b5b4ba9515d43ff41735d7a5
SHA1: c615de7ddff4ae7ef49de3fe767fde333e2eeff1
SHA256: 51b626e79a322496ef7d13a01adcfb4f4c1b050cd2a54eac64993b6c0b8b1db6
SSDeep: 1536:DQyCD1TLvMraChYQmwjIWy4u0eVBkfrCM8VMxRu:DTI1P0ra2YQmwjjtnh85 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.RYK 12.21 KB MD5: 1439051625e2f381c566dca9538e347a
SHA1: 98cd06f7641470688d86a402247beba68f4a0e9b
SHA256: 65123d493af9dde1546f7d9ddbec9163488e984f8ccccff97600728f4e08fe24
SSDeep: 192:5vrCkCVDtb4k+piYpcGuTXs5yRzEUtent7tTfJI4rfVtwTjvcBQguQGzl:5uzVDtb4k+DcDhhtenhhHVtwksl 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT.RYK 16.28 KB MD5: 2b74ab661b6d161a13b7c2f2932c5a3e
SHA1: 020674bbbab7cb64dad88fde1aac942b0d0498cd
SHA256: cb6ddf87a2baee9cf5ea8ad23b95677ebcd294889a50093800d9348fb747d0f1
SSDeep: 384:B8HlnJzFnj4f/Ros912vcuC353oqr15SrKZ8H5ALOPu:8ZJzBj4f9SvBC353oO77Z8OLP 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\mapisvc.inf.RYK 1.38 KB MD5: e69163ea59e8fc1f798c7a112752af42
SHA1: bbb09012602041482617ba7709deb4e3c4b9dbbf
SHA256: b770aa0a7768a97a8b4e63ac6ba6d6fc56409df344d0739ae00383e7f70f4b76
SSDeep: 24:jYO1ZXfZRriQE4YWoF9IEysLv4F+zdYaT+5YQL90U23TZlpe8QQrfj4OrQYqrkWu:jYOP3zE4YZQ6vXzWaL4sTZlQEfj4OrlJ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\Outlook.sharing.xml.obi.RYK 466 bytes MD5: 9f481fec248a82644d278671a2cebfd2
SHA1: 254e65d04595a720c40a5412fefea7c72fe39237
SHA256: 02b1eb1fa07687125b2cb82c4b4bfc7830c6b32e5b56fa4e9b9a72406c49c996
SSDeep: 12:xk85Zq/FEEvX/svMa21lqVmlhAa7lgJ4L/f5:xk8WkUNq84b4N 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\content14.dat.RYK 99.50 KB MD5: ec0fe8f95eb59450d44bf4bd9f5107e0
SHA1: 32437fd575dc9883406bc1c2efed519b3745a09f
SHA256: 1e2c252c0bcb137881d5da445cd9af119f5d85fe42c63306ab41bdf8e2911884
SSDeep: 3072:CI4QeZrauHyyvX8180JsKnT1fosmUIMmMwn:B49rXHdGfvnT1fosiR9n 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\thumbs.dat.RYK 125.28 KB MD5: 0a1937134f6040083c795b610ba42885
SHA1: 3547d03e948a85469308b074ef14781bcca9ef92
SHA256: 4b4c3dd1a75ccbeff51af1686d81e17e68f335438f12206b68294653edd0da6e
SSDeep: 3072:tDbNLMvArKrCbAzjr44WZ1CIZLa9DWMbu/wZ6YbAW:t/+4rtbATHmUWEuYIQAW 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.chk.RYK 8.28 KB MD5: c423e7e1ec1972514f22b510bb54f7ea
SHA1: a39c8cc08a1b3238e643d7bd0f948881eed0e320
SHA256: 905c13b123cc5ee2be0183ca43a33f44d8338fe516651f0f73fb8650a682f136
SSDeep: 192:rGqD78YtId+kVx+faLx3Km6MFqgxdMGiPwEkyEpJjk7u0ZadW8Xb+:iqcL+NfA3+MFqgsrPJ6pJY7Sr+ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\oeold.xml.RYK 546 bytes MD5: 3f0b6081c5fe53df3bb643377d0c819f
SHA1: 7a28448f98332e23cdd4e0f17691a5162cd6b7a5
SHA256: 56fd4245860c01a5ef9d5a28f628c93e262684e469c45457c1231f597557bcb7
SSDeep: 12:iGWsYGRffZ1zGLXkiaI8XLp4FzAPHronujpKqiA3LCgDmzlaQ:iGr3ffZ16D/O7RvVKqhCgDmzlaQ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.log.RYK 2.00 MB MD5: 2d8eba509f2c4d4f8b39512eaa28dfd4
SHA1: ed4ffe19e919dd7d8fbe58ca70d17bf4630e0d4a
SHA256: c9d0997dfe82f78c8ac056cf7639a75a1e1b886e5734636b19e0d266a45bf540
SSDeep: 49152:0ro92eoZAL13LIU+sgxQ13IsVLTcxIaLoMmnLvHouPedgA8qot:voZALJLIU+7xQ137TyI8NmcOedgA8Xt 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00002.jrs.RYK 2.00 MB MD5: 6517eb122dac72c55e562a5d905239d2
SHA1: 49e528c11029345e04cfc50102d99ab9846de602
SHA256: ab260a1b3f63aafb5c52a0cd2ffd88fb20faa464534d512a28794171d0196062
SSDeep: 49152:Kn5NwgXFZmMSmlsfDlX4Z4Uj/Al6NMLoAgPqXC+2CmqdPmk:KEgVZmMVwlAbj/CvCjp6Pmk 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00001.jrs.RYK 2.00 MB MD5: 8ed7c6abbe79e509157af477c3d30e14
SHA1: efe2fe27be20e2c351c08e8f707bd5f748c007dc
SHA256: 4685d7c5b51f223d3f0574b19beaef9f4bcb63f86770f7b3c96de4ac66dbb3e0
SSDeep: 49152:EYOvf+x5MVBDUNS6vtmy2mQIIBNbS0VD9t1uM:EXq5iDCTt12VxBlZVD97uM 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb00001.log.RYK 2.00 MB MD5: c260b7df7147d6caadd1211a6273b88f
SHA1: 0e17b6fab61e34fad54c4b2e310b9ffd212c3bf6
SHA256: ae6f01e57a834504ba036cd604ec855159b3ff79fdbd90e25b018117f046cfe7
SSDeep: 49152:GCLGdxn95oegPUXT6dKphmIylV33PHr2RXZqzO7:ELQUGdV/2KO7 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2iI83Xqu-SUm9ZsQ.docx.RYK 34.41 KB MD5: 66009655584467700287c5fa36c000a2
SHA1: e49423c99d3914b2915f8fb94c16f5106f9d1b71
SHA256: 558070cb1e9b4a035d1c879227d96a798ccf3847b411c5e400a3c22753c5760f
SSDeep: 768:kKTe/gtfCdDGcb8EY530e86+0Hy5gLqd1DyQu7gJ3al76lF:kGe4wgcLY5S6+yy6asQu7O3al7y 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8DDixiNZtZLaWeCmu7e.swf.RYK 98.52 KB MD5: 2492bbed52b09db57cc88a71e36e16bd
SHA1: d50c8acd5e6a96f7fc0d12c35f95927894aa6a4f
SHA256: 663dedca0e4530ec90837198c4299ab2e0db77f87bcb2a2adc121d2100ddd656
SSDeep: 1536:3T/zv3sgoq+RsURZQfCSWqWJSAeSUyanojcxyP+7yKeDW9CBdw9IrDqxSF:D4gX+WURiCSeSA1jIyPXcC/RrWxSF 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\WMSDKNS.DTD.RYK 786 bytes MD5: 93d2cfaae990b8f9db8ddf88106ebbd6
SHA1: 0563fd059a6c96266ce9d69d540319a8652c3af1
SHA256: a9dc9ac57b2bfe9c68d6482f879b46faab2434ef945ed5ece91d43d72643eb4e
SSDeep: 12:knxNArZzdMQdjAS2zLvFoGGgMyoJDA3MoHGzFDs/z+ug0Se+io4T1TjXb5N2Y:gNUl/jIqXyouMoa49v7XL 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\WMSDKNS.XML.RYK 10.22 KB MD5: d6cc99bccec80981845aee8f97b7b151
SHA1: f1663da3a75ea6cf3c0d32e9c10b6917ff9fde08
SHA256: b248921a9f320e3db792e0fcb4ddaf23a56d8f58705fb2441c46fab24952adde
SSDeep: 192:xo667fh2ENfcAWPKNRaiUqbyGpRTxERPWKSZT1/sa4PCyLZKGc7dQmbk:AJ2ENfcAWPZCRTaPWtZBsbPCMZKzhy 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\BtC5B7IXSKDZSJgLAe3.swf.RYK 69.06 KB MD5: 49987034a344de8059bf6e946438db53
SHA1: 31f9952dc1bd481ba8fd81da544ad4791bc6028b
SHA256: db286058be7bc0d29adbd0cc01219f7fbd14a0d9f0eb2e0202499866862e6bb3
SSDeep: 1536:4DTq9qxAsoyIHeWF1F7TkdTcq/fjcAoLhLTq2vLp7hm4EC0so+YzBvhDbW:Uq9yoHeA1F76T1/fFo5Tq8l7yTs2FbW 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\f6eDx z94Dzwz2K8sqE.pptx.RYK 93.13 KB MD5: 3694a101b73a5bdc021c84c6bebc53be
SHA1: 4c28d17557906b46ee47f77af73692eb85e6e68f
SHA256: 48bf6f84967a5ed5710110113ba7f855c291a02510d8a9607fe7dff1b8ff0738
SSDeep: 1536:iQz0NkaDb2yfAmJa5yWbpOCYdsBLegDJSU7JoeujUb7/Kh+nvlqXXgVJ7nxOM:eDb2LmJmXbpOCYdsBLJGob7OwqgVhxOM 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\gQXnrhLgWoJRH32GpKD.avi.RYK 70.97 KB MD5: d2ef10ad3fd9a191d651f9b865ff2832
SHA1: f5928044a32220dd90b1a97366a23eefcc96cb00
SHA256: 1402524c701fd9682db93003b818d181d56c437967fb8a63ea7bccdce62aa223
SSDeep: 1536:k6QWXBgBVj5ts1qe5LCz+xYMLSjkrZf7YLcu3tZ5lmNXCTKvA2h:FQWQtts1q+Lw+3Bf7W3bH7e9 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\History\History.IE5\index.dat.RYK 16.28 KB MD5: 07b9035099ab985fad74209f3be95a7f
SHA1: e40405841bf3f1bb4ed1fb8ed6583d3980fc1c38
SHA256: c589bef11e7df6394975b7972f961e2e807027c150e096d49c81d1307fad69b9
SSDeep: 384:MEl/oA9eV7YeTtyVD8a91iltS+8zFF5zxZRzifh4KdprAWCGOaboc:x/okc0maD8a9AX8zFFxsuQpEfab5 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\HSDnH8dTNYHVzPB_.doc.RYK 58.38 KB MD5: 056ba564ba48db52a89bad2d8c78f054
SHA1: 9ed9cf0eb161c9ed636e7591708d7b13ca420093
SHA256: 4a988140f3e8c3a5622999bca50e5e2bc8fac6c1028ded900fd621d49870dfb3
SSDeep: 1536:hGta2AtnzX4aPMCQgGyOefmvQHu67ufxW0AZxsECHuQMNtHJq:nxEaP0gGyZfmvVKIkCQNtHE 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\u9Pfn7XvaHQ8ByEI_piG.odp.RYK 42.41 KB MD5: a531f5b6c46105ae87b31663557b485c
SHA1: 24e32d07395fb8b738bd881a5ba862207a18c1ed
SHA256: ff1a77af4e67661a13cbaf503ef21ddf9726d54662bff36fd93e82d1fbe5b91e
SSDeep: 768:0VUCuichE78WVI3Lh9UUrhE2pAzOPgjkSUVXXDge/WwUQ2RxCFyygQtbCg:0BuVhS8AI3YUS2fgjDUpH0Q2nChxbH 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\uRfigoP5hgocNJCg6h.flvi.RYK.RYK 67.00 KB MD5: 2aca7ae2392b6bc9ca87be04d11b2837
SHA1: 3ec30e33aba5c37f126f629410755490e19b0cd6
SHA256: a294963f004bdd5c42c86231092a4d71d72a5e691eab53108ef49369254063ef
SSDeep: 1536:cdAOqdsE0q1KBAodDuPiqtJGjO4P5qPGqvRaWkFtsiPwXb:cdNqdadNliGO3eqmFteXb 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\MSIMGSIZ.DAT.RYK 16.28 KB MD5: 43cb36c968f832bbf43f0f1f2bb484fd
SHA1: 67fc256ebd542e19b96016ff0526d1724d0a2f18
SHA256: 0276b5fd8582c02a4eeb66986c6451e8887bf909ecb8fdda7c43a41cdf67154d
SSDeep: 384:rN2SkBqhxfuY0b/SYbwCcui2OwWon7QiRW61OQn:rjkBKfW9wCcuHn7QiA61OQn 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\MSHist012017071220170713\index.dat.RYK 32.28 KB MD5: bd5e17164397a4af58f3029138c27546
SHA1: b8c250d91f3de15531296a6483f9b8d18facf793
SHA256: a3797d9966a05d392df09122cd7973bb41015d726c91c9fb61d63a7bdd04fd35
SSDeep: 768:PGmrjpYBdFrLllpU3g/UvxMVvH2tjliGFeDdaWUkeWzBMxG:PurLlWg85MVvH2VeJrUrWyG 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.RYK 28.28 KB MD5: a699601512014e54c81fd898331ff09b
SHA1: 03229b8ee915e2ffffcf66f11fa16cf293f70961
SHA256: d2f0649487d325f54d7fdc5caba3e74af9c29d8e67b4f2c47dc620a52907a1d2
SSDeep: 384:A5pOgJ/XSZxSVVqYwiiEgV7eTCI4SW432hUxv1nnLuLVAi53IbJoQginLej:A5ggJP8EV8ti4eOYW/UxNnLIAi9OO+ij 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\index.dat.RYK 32.28 KB MD5: 22e4eae98a08587a34a468e7860a1757
SHA1: 16c8a71af834f97ebf8f299117888998c3658305
SHA256: 4b0026ae7c17dd556c3c1041e54ed3f2c9820e0678ffbe5e7aa807fbe9e736d4
SSDeep: 768:WyfwbCwZDkngXdJwDDESRajNZPA+vRYVWWEjqngXqKP4gz0:YfkgHwDDeHPAsGcW5eg 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\frameiconcache.dat.RYK 9.27 KB MD5: 243011db5f08c8add74d9011cc75c2f4
SHA1: b4a769fb4050e2c0cbbec7bc3f491e3d074277a3
SHA256: 203ff68079d4091767dfe0d671054b367e315d62d89ad8e813c2c90588d677cf
SSDeep: 192:2fXsxj9JtDNyhXKIW7Ku3UMOOk7KWM2VGhwHWfDHugpqdjZNeA1Z8e:KwtDNyhNukMJUKWkhOADORd9YA4e 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\CurrentDatabase_372.wmdb.RYK 1.02 MB MD5: e9f48686c99201660bfa3d7e447459d3
SHA1: 725517e32eea48e31ebff60340b81ba97493b96c
SHA256: efa601633aee17b7390e0e042dcf9031b9035f5aa8c46d2ad7d8f669eeab8477
SSDeep: 24576:iuMcV6oz8U7p/3NeF4gEFHGjIXesubPr0lWNhh9Uwb5999j:QCnFp/3NeugEFNebaWNhhKwFZj 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF.RYK 402 bytes MD5: 2f76041d552dd337c397bade73d56ac7
SHA1: 5da52e1c802383286f78fd2d1a75f3a35a59fa3b
SHA256: ff5f22b232e89385ce368f33bff7ecedbe7aabec9f017b1c45d4bbdb76ec1c40
SSDeep: 6:/k6ormLv12N1Y+BKKu2/otGnm5i/2L/ybx+edI37WA01nQm+g3ipUadEqNnQ6CxF:CmT12NK+BjwtGnI7l3a11+g3iqW4F 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD.RYK 128.28 KB MD5: 5ada192f8cac623abf58383c5d5bebed
SHA1: 7e5c6a99dbead27d867b63a7bad0e009d8afe01f
SHA256: ac17291a9198109c4408e6dafbe56cb2000401089595a8b01bc60009137ba0b8
SSDeep: 3072:B0+/iqYt4ecPJ7ddq+/9x5NEHnrURVz40MImQvwl7zzD:B0hoR7ddqQirK4QmyYz 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.htm.RYK 530 bytes MD5: 76572a0dbcb9caa267183041b5ca1967
SHA1: c0b1d066f9ac6b09374c8c07db98b5c6e439512b
SHA256: 8b331a22fb94f541886b90842fc7f081ff7502201a7e82c2e5329d2c98d8d0a8
SSDeep: 12:Dy/e9r8v6LqZ1/pkygMeStKiDtqaQOGcON1jOfA38J8ctt:Wm9S6W1KyHeeKiDtqVOwxOfA3m8cP 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\WindowsMail.pat.RYK 16.28 KB MD5: 6c3d0b250eecfe54b8e5dd02e92ff282
SHA1: 1dad178f15d9a0dea3ce98e0c33f5560085831fd
SHA256: 991b8a77dba075f2cc32997a7176763e93ad1a6bc18beb9c419b5e13cc1e263d
SSDeep: 384:2+IAGK6pjHtjVqJsyNcwOHSUNX1sugimV5ly7kEHggPpYJ4L:BIH5Z00yHimJ2LYyL 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\edb00001.log.RYK 2.00 MB MD5: 65b4900f57f601960ea0d8eb7b118a77
SHA1: da807ed4e53126ade2d136939856f5bcb1b2773a
SHA256: ef806c10b2f361794933246db05397d420f61adfe3cf4b8af326a684303280da
SSDeep: 49152:IkX4wrHgtSLIsZtjTZNSOD6epA/NSLDX70XI:IkXDrAsrNhD6WGwDr04 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Shades of Blue.htm.RYK 514 bytes MD5: a29756895c057c6aa929fca6b2417d4b
SHA1: 928e63b51389d24613e86d40159ddf7123824acc
SHA256: 0b0b25ea9b4f839b44deb399c95ab1ec85dbd8ddda61accc946f92f207fa7cc0
SSDeep: 12:WY2Sm2Msq0NwGBdzY9wR42jaVDKUr8odZjKF1WbiLaEUFr:Z79TbNwGBduw1i9rR9RnEQ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.RYK 4.89 KB MD5: 02e84fed587ed9ab0ab03b31c5d67596
SHA1: 5707b9d524e1601ed5698b8fc0e472ffd8b48d86
SHA256: 212794b1a9764821965c979853fd408e4733ede9643622416a4f478658340f22
SSDeep: 96:azDiCGkMXb34W3I/Aih3zq4e22agvNe0c1WxNlBzzXr1WomGc:azDi9b34slqDq4Qe0+GlBPXxWd 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.jpg.RYK 1.33 KB MD5: 19ec90f3be1e2a7b297f33ffaae1c844
SHA1: f23dcbbd43e3e3ce3a2be2b268a824aa76d39f8c
SHA256: 6b2aac1156e1d826c57c3345974479c2808b825937dedd1ddbc771228c7e627f
SSDeep: 24:+DDpBx/D+FdzsTH1o8QEZI4AP/u3+yVMwN4Bp93OUOC7DqtQqbLG/cMkB:6D+FIHWE24AXEPVMwN41OK7DqI2 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.RYK 6.50 KB MD5: 6ad7ee83a993a4cfe2efc69b5659f838
SHA1: a3f3a501741aaa4c012bc859ebb77ac89363f752
SHA256: eae3828ec2e4b6fd4b975c22bed6261fdf4bc4d3201a66610f98512468acffc3
SSDeep: 192:wprOlcCRjsiNUzVIbEEQVDV8abfnw3DX54bbRfsww4:wIlB0+bElhfsAbREwb 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\HandPrints.jpg.RYK 4.39 KB MD5: 92a49b0f0c9b38b4db591004598255ac
SHA1: cd789f7fcd28a3e45fa9b31cb83ff8da76510908
SHA256: 198f1973d8f29892baabbbf6281ed6a66aa9bccf0ab4ef431d08d22f317dc4fd
SSDeep: 96:1TtSb8CbD4FDVdM+xpNeJ6d5JVIXakxsg23T7Dhhp:1egtpN66dVIX+gqbhhp 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Hand Prints.htm.RYK 514 bytes MD5: 4f0e15e0a38a6a469cee8c8d185bb5af
SHA1: 5762df8e9248bd8e20fac64878387a1e8ee9d3a1
SHA256: f9d57040d129713b234f80303ff4c11c35202015711a6471b4ed20c0b7eeb73d
SSDeep: 12:u39TK5mvyHWLi145PmfUph9BRJeo/kcyiznoEWLZbDW:u3Q5NHW2OFmfs9Io/mid6i 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Green Bubbles.htm.RYK 514 bytes MD5: bf25e4e8a7732cd7d11228c09538d00e
SHA1: 6820d4248600632bf6aed99ccf963a02cacd769a
SHA256: 5f96d6d339917e14d7a8c0b0bfd6553dffb820aadb9441cd02da5a98d8f748a0
SSDeep: 12:wHcFDsnTxDVwK03/peOU/A3jDU6qrCgz27OGjgkyGTwkMAJIig:yMsnTxDVwKypeOU/ATPUy7OG8kyGIAJg 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.RYK 6.53 KB MD5: 81d370e0fe7aea28d957965f3d8368d2
SHA1: bd00b3a12d20cc48071d89ad587fce13aac77ade
SHA256: cb6589f1f6a79e78300b1b62425ae4e644e9df2c5057849e46c20904e5bbe890
SSDeep: 192:6K4zLJrcsHo7i8gmnusNl/oEiTfx1ODvbaqIPgaE1:6KYC2oxgmnL4LT7ODvJ1 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Garden.jpg.RYK 23.58 KB MD5: 08562584fd31fd4ccde389b3f98bc5ac
SHA1: a9700074199e1c39c7997781627d392b28f3a183
SHA256: 6d03b7c6c44a151e2d5630c7415e6e5d0821d7d40202451ad974a39cf8bf222b
SSDeep: 384:VeBRygptM6uci9/JQeZmWf3ZyRYwTgPGDyaRiPXWgWygjoIOcK8ue3QeSOb/jrgT:VyywtvMbPEqcHDya6mvy0oIY8d/bU 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Orange Circles.htm.RYK 514 bytes MD5: 9ba891c718b08c0089f18b99533dc807
SHA1: 60503a5c483de5debb9c3d044460922e9132bc98
SHA256: c703463627437ea8c4d8b23d25d44c740eb1515c7a4e3110fd4f2d900a707def
SSDeep: 12:OIgprXa2EM6KLwwiuiMrVoUZcPp6wlwc9W:Ox07MLhqUuwc9W 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Peacock.jpg.RYK 5.27 KB MD5: 9e56205e3d5e4a48534efba67ff7d0a4
SHA1: 20ab11aaf093b644f6dac46bb1e11d91f554bb53
SHA256: dea5248dc49dea5701231f7980c139355fb868ea4abf3c77cf5945e4c85736cf
SSDeep: 96:iHyVYqahW9lE8pm7czrQQkT8J03F3jhLc2Qxow4AR1nWBRrFW6rdqyuE8:FVW49lE8M7HwyThI2Qew4ZRrF2 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Peacock.htm.RYK 514 bytes MD5: d4700d671e713124e8a867cebe8ba5be
SHA1: 63cd678a074f1e9f03f9862c2a18709702fa96f1
SHA256: 7c391c6223da0e91098f8671ebe3e65574ddef1cbf03b393552000b536bd25ca
SSDeep: 12:6Os4h13I6v53RKx3uaKPW5HtoS7baEAO3X2C:6OsONIKCwW5HtRqRC 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.htm.RYK 514 bytes MD5: 418c8904e6867501e719bf8165c20561
SHA1: 4164b43af6b9d55f29bd66cb551c1dd21bbfb255
SHA256: 6db4701dd60802d7c43a5127f7bc41b966bb89f417ce6b53104029d2a862de93
SSDeep: 12:sljmfh9aYL1bM8nlf7PtjnvTCc1KbCnFQG4:EjAhwWyof7PtDvTgbA+ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.jpg.RYK 2.16 KB MD5: d1211ae970219aff1e2630e826a18aa8
SHA1: 9d6b797cb281a55f7b46416116cf21e5f0197e6c
SHA256: 60812e4bfb61b00ef45863d399ed7160d9c2d46eccf91f2d4011bc5f7e6b115f
SSDeep: 48:R/F+yTuF22z/014qswP++Oo1CgLghRkSk0XI8GAjRLEMoh0:u4i2kc1hB+G1CgLgYf048BLL 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.htm.RYK 514 bytes MD5: 53a80a4fc7a5583571f5a590ad76a523
SHA1: 2115d9355f37a53e1a1950ba9d9d7aa15627632c
SHA256: b884ee34c58dc3a0e0d462963668a99c37d849197946f437df5de51d388323e3
SSDeep: 12:M+YoUZOS0rLfyp8rYkfST5MDdZr4p05jU2rre4CNc7:bYhZOS0HfymffW5+/rMsU2rKlE 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.jpgF9B.ods.RYK.RYK 7.61 KB MD5: 2f4d92b64e467d938b7000d7e725f58a
SHA1: bb4f0028f7cc4dd7978375a09438daa3cb4d73a2
SHA256: 9d72d8beecbe607b9b5930b6657c7883c343e211070f2432715e30a1fc54180c
SSDeep: 192:bP1grOprArkCb2lHvmPMCXVICYssSjlKcUX:zlprRCb2hRC3nlKr 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.RYK 10.60 KB MD5: 7acb6abc25f863a6f7099529bf1e91c7
SHA1: 932b0b1c060717a203f0a3d14ea74adfa6974456
SHA256: e21b296eeff7d05dd461f5f5e20f932de127cf4dd873987233b461ae6b183cce
SSDeep: 192:+m4M9xfx/EcdEAdEVF7RB/8z+o5U24YN1eK9wBVgJwEDd96fk4rUWzG:Q9ca7RNU5R3jpKBVgOod92k4rjzG 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\WindowsMail.MSMessageStore.RYK 2.02 MB MD5: 649fb9018557646e48d7466fe0cc51e7
SHA1: 6842bf710d7e90d81ff6606785ef5d1e486c6207
SHA256: d1221c1a263f939fa3ef93ad2e4a7eb0b7c2697b325f22455ac893aae8504572
SSDeep: 49152:SwOBRf7rl2DNsS09IQfc6P2nuPihNhYNM+t79HV5PuFnY3vioHRtPUco:JOBRfUDNN4cmINWM+t7VVduFsHRw 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Soft Blue.htm.RYK 514 bytes MD5: f9fcd93f231cfeb5b90e75446e79eff8
SHA1: f63197ffebd31a4225f88b7b0194a58c7dd8ed8e
SHA256: d31840219a1860fc3f2dcf808442d1a43f88a37c1ae8cd6ea80d519d7ec1fc46
SSDeep: 12:MS/YIDKNLfCB4tAh6SRKXGkR0nvjognDUZ5RFJZebo:r7KNLqoSRCcs19g8 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Garden.htm.RYK 514 bytes MD5: 2dcc5a79092fa82a2519d8da046c1d7a
SHA1: c5a930eb513650a76aee8fef179113ba335f4ed7
SHA256: 77201c794bc3e99c8b8c892610bf1402e6d8bcaf85502ac6ba3aea70ebf200b8
SSDeep: 12:YlRU3HYjngzwda9xyAWeVnEze1PfyPYl8VgIWp6MH6:YYHYD0oa9PtnEzAKPhVGp6Ma 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Temporary Internet Files\Content.IE5\index.dat.RYK 32.28 KB MD5: 7c71b9a215ccfbf07c1d08d332813507
SHA1: e2af94f28bdb78955831f01a2c9a9c5f28cb3133
SHA256: 9b55094a9fb254ff7f4cf32ad861d197013d1ac8f8f1a82cf82c9615e4054c78
SSDeep: 768:PqbmdFby9yc+6Jlpnm8QwTJMU7VsFlnEgPz6:PPhy09GFpvCaVs7z6 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\js[1].RYK 1.22 KB MD5: a0ac39186cdeb02b2e726cf09939be62
SHA1: 501b6dbc2b1ea94ee3bafd54eeed919fcb7fa48c
SHA256: 0ed1421e5f40e450d9cdee3689d5bdf919b0124627fa8c502fcf01d4331970b3
SSDeep: 24:O4Z2QxiyuY8kPQeua+7xzLfFIJMuBRbSX9dV9gub9utQp9UOaHZSj6+i:hsANElLfwBRQV9gubCzZD 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[4].RYK 11.69 KB MD5: 2effcc6f2d6181cce561075f92d3a220
SHA1: afef1c4b958c94aba1ebc854e37e224b5bccc148
SHA256: 5394026c0b4041d10b2b9c4ed3cb345eecfba61b2db9061b78aad47bf87d821e
SSDeep: 192:pZxNqIynOCVHuqKt39IWGOGu8m7m8BArVl+S7Lv2AmAG25+8B66yHVV4OKRwSPTR:1c5k37Gm8mS9D+S/vlbG25+BRVVzfSFH 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\f[1].txt.RYK 13.47 KB MD5: 7e585b7ef6e222db8e68c8750e4a514e
SHA1: f3c710de6ca288a5acd57a15385ab4bda8981c0b
SHA256: d661a6a1d89f0a23406ad3c74e30fb043655799bfca5017e1f0e77d732176dfc
SSDeep: 384:S4DkaFXq9iGIZT3wxGbUEpSEj9lrdrxtTHS:nkbMuAUEpSUfBS 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[3].RYK 12.19 KB MD5: ec078a1a45415597f7ebf5928f49f78c
SHA1: e953a41b102e4e916a880c9e02558e886aca8202
SHA256: e2e5c510f1101a6085fe2b55fc8ce8d4c411019a12fcecc99d1f9a1448d00910
SSDeep: 384:tjOcXi6uxSGDLkri6Rcro1wfsKtRvajwin:JvXi6ucGDLk1RcsYajN 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[2].RYK 11.56 KB MD5: 180e222f2ba1f0c66c17bef24f77e3b3
SHA1: 52825690daa4605a1a25fb29452f1fa92ce2ba63
SHA256: 552553b662d78c1f7910e99b01b42ae095f80d58d328703428fdc104cf39496a
SSDeep: 192:U3d2qfZxNnJVl8R6GhiJssIvg1aZ0LjP4jIOLoOTI2M+tDDbLnPFRG26JsUPzN:mfR/3t+o1g0vkIRqI7WDb7FRP6KULN 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[1].RYK 11.74 KB MD5: 89b3dd27e20d2dffb858982bfb446c02
SHA1: 44ed8d8581a2de56e845f3726dd6b4e0e83b38f9
SHA256: 462de510835e316635ac9df28ee02e580835359954cac90c8806c32f8d6b0cdc
SSDeep: 192:kINH+8aol5dC0Rc9bvdG5OcoxQaCWA47uIZx6yjOTUYlXokmluVeZwAT+fOM9uiI:xefol5djROb10oi16/6RQYlXoRVaA/l1 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\ga[1].js.RYK 42.35 KB MD5: aedbfb62efc3c3a90eeba3ceced2963d
SHA1: 0ed017d4441adb85b02ba18e539a7ac6b4c21a2d
SHA256: 8c50de02ec32aeeaa14c63b428a34adf5a871a11431730eeb24f652e77675ec0
SSDeep: 768:OGWJ3HNpCdO+Re7g3sqvjMyi3TYcHQpeA66Y+SrhEShDN3fOIn+99p:mjCI+RepxHcDk6S73fq9p 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\js[1].RYK 1.47 KB MD5: d7e739f1f651a25283acb4e90011ba30
SHA1: 9a3f0a851b487c02334ff845dd0a0c3aeb0bf36c
SHA256: ea7f35b232d071b4960bd32e53b2572b05aad5bab6e792412a363c84bfc5668a
SSDeep: 24:LmwZQGRk9ZzgOm4XHGWc8hR/7n81fBb2DaBYgQqiepOCyY7EKJRFrIK:9ZQl2AXL7b/7n80KY9qie8C5EK 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\js[2].RYK 1.63 KB MD5: 77857f4ed612478722a85b6cb49e0cab
SHA1: 41797ba06efd8ba699b8f3364aaf4b0a62eb794e
SHA256: 3c279b3e68f0bdfaaf7550d705ae04382d5d210d1b5335c64dcde7aa298814a8
SSDeep: 48:5EPAwr6xqSJvbDuclyJYmTrNugTu52JYEEGz9TXHRly8:YB+N5KclgxTBuhUJYuFHjB 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\index.dat.RYK 336.28 KB MD5: 9a7d4f9782df852b5fabfa8ae31efafc
SHA1: fbda1951c825d16ce7ba710231be26e82eb7f7b4
SHA256: 134eb447e3c18ce43f863ce096588cb134b1e2a57d1b574b0eadb583699b4caf
SSDeep: 6144:puEeCMBUJEbGbJKEqfkfnPEVcfy78nUzfqWHlSAhhSX81wek9Zoi7RR/g82l1VMN:pZEbsKEffngcfS8naXFSA7IMDk9ZzN13 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\js[1].RYK 1.46 KB MD5: f22db2e3d292e98032d50c157f1a270f
SHA1: f943d6525d8a9ffe7280fbcfe477f54f7e0a5822
SHA256: fe8352b07fedae2ae7853c079df2b58ade4365c1020460ce9281bd02012c3206
SSDeep: 24:P7AXw0gQIMjvEhOsx8n+lCfaL1eqvrmeR8FRC7Qz/ztlbYl+QxJ/Ddf:Pcg0DIMbSOsx8cWqvvRb6tlb8+QLDp 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\js[2].RYK 1.22 KB MD5: f202ffa15f4d17e79ac6f13f961fd87d
SHA1: 7d1eadce7abd2dfdeeb68f9c2fa4f372fd0b4df3
SHA256: 4a9c4a4625f9471797b38013280ed9f0a6fb1d9b1a00aedf2bfc9bf695bbcb84
SSDeep: 24:BcEFNehPSBP/JDSCKxrmsoUmuMf0u6qDUzD3V0HsgDEVwU9KICC:BShqZ5J0rLoUSsKS3VmEfKvC 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\v2[1].RYK 13.06 KB MD5: 8c73bc5b37498209838cf139ef1ae5b0
SHA1: 17c5a8e57a16db9869d60472b6531251ba909fbf
SHA256: b7d17e0a7a998df49a7a1ce4aea3ad24767db0ab84531076ab13e8793681e2b7
SSDeep: 384:lNKqmXMjEJU5CjVYRRs47GF92p+VWmvN0ZRz:DKIjEJU5CGTs47EVFIx 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms.RYK 28.28 KB MD5: 43a5b0c69434bc58d865833f4748bc2c
SHA1: 673ddb9bbb09699a81ac6908fac3dc54e1b7fd3b
SHA256: 8734eb91c20f53f5e26771e98ea2c2d56b07e32ae6fff25518b0ab1507e794d4
SSDeep: 384:l/fxl4T6FI59APUXk6Qlq/u8LvIp3xUwJfh0v6Lj4PDy0JNTK9t7isQKlhfTvCls:lXDFKZQURLGxpyCn4Oo83iVOfTalVjhA 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms.RYK 28.28 KB MD5: 1f8490936ab5d30b1a03979a32c9268e
SHA1: 2ae1989c7367346d84440ed841748bf1d91e2657
SHA256: 544a2eaef79475e991fac18d181540cd3783504eb92eb0c332cdebafbb7f4756
SSDeep: 768:QJAWK187fA5Jrwwago3Z/wMyHN1e46JZYnc/UTz:JW3UItguFwMeePHR/UTz 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\11_All_Pictures.wpl.RYK 866 bytes MD5: 9e7adfa44282beb98ff295b99f211050
SHA1: 1a4c1fb8ae4c41954bfadf61ec99ede501d3f410
SHA256: 077f6b6d7ac165dbe811550cc871ac3dc61f953a78bfcb7895eecf378b7233d3
SSDeep: 12:80RNxi9sh7YCSEyar2fU2sXAIgBuSDBBc3j2U2CuW7jRJ6IMhq7ec8qrD5/ui:FR3hMC3yar128ggEcT52CLNlCa/ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\12_All_Video.wpl.RYK 1.33 KB MD5: f7ae6c87b56a97d751fc3c73df4cafaa
SHA1: fb9c0707bfc9a1e18fb672385e5eaca1eaf64f4c
SHA256: bec4c645eb2644c80667f903fe41781fc69760abfbe3b868d7a1ba41de58c572
SSDeep: 24:pxCDLqndsEQI9vPJHpAqIBY4/P+du1b99knG10WbGbhd8cSxGgVZD4iRM:LCDLqHpxmPeEb9anfhd8vwgZRM 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\10_All_Music.wpl.RYK 1.31 KB MD5: 829ebc2ad5a0b23150e6acf942203818
SHA1: daaf2755762b4ce39b8bf2946326addc292c8092
SHA256: 9ca069998d4eba3a140c66dbb77beade64f444cf99efe919f59c72ac779ca17d
SSDeep: 24:KNCCt7YpTXojVgqvatEE/yAHEyVWVTLuB1FhutpG5tnXUdLzLy7pN5M03ZjcoMrP:KMZtojVgq4hEJB618baOx67pI2woMrP 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\10_All_Music.wpl.RYK 1.31 KB MD5: 17d06e0b5ae3564bcc978334b600d7b8
SHA1: 5e392cb0c7e488344fff601c45c36cbbecbad35a
SHA256: 03b4cbe8fe0700d5ada684a0a54f661b89325ffe72b1d2994f5209b56f3ac6fc
SSDeep: 24:+bvcGLXJyrO0g7LIAceAZ3LLgV6imJuFpVKHG8Kcdoyzl7Aolko5pLprUlW:+bvRLKi7ELeQ3LLU65WOzlU4/LpL 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\WindowsMail.MSMessageStore.RYK 2.02 MB MD5: b31764ca68591958ddbcdae975dac95a
SHA1: a7f2cb622b05e0ec396d875cc2bc23fb41e5ccc2
SHA256: bbedec47fae87b87e5f23b31b61dbc2e59c0134deb6c875204da925819fb1ae2
SSDeep: 49152:HBiUOfwyk4/CdchZr8IP2WhTp0tAkVOzbj/bL9qPInOlXiLy:hwrk6CdEr8xqmAkVObjBelZ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.sig.RYK 418 bytes MD5: bde3be68e49e634d0f325821b4c23b07
SHA1: c6ec83faf8d7aa7bef19af832364a04861a9583d
SHA256: 11bbbcdcd0537ba709f45708432cd020e58ef6a8caf8abd2d0f8d47b3e636ae9
SSDeep: 12:xVc9XG9a6Llh/vI41PyFPvaJ8gl49zHa2vWHC2w:xV+WA6LU4RG3mvkDaBw 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.xml.RYK 2.25 KB MD5: 9356c4553274d6823ec8348893040f92
SHA1: 0255ae40e04fb992c4bff29a98de323116bf6dcd
SHA256: 453aa92e2d5e4bda2b1f1889001adab8dcf9266f08c942c9d5c67b7a6ce0e847
SSDeep: 48:l3mTLAqN2xPOhGTn/SI6khnzgIJysrlV5JeD49TIpUpHpDc6Y6kIJ:l3mTPcRtn/SI6kdc2ys7fTWOi6kIJ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\12_All_Video.wpl.RYK 1.33 KB MD5: d1cd1d919711f5e86d603830574afc3d
SHA1: a72508b04443c7ca71f2d784e22b3b20c282474a
SHA256: 3c4b929e29cfa1e2e0adad66a58fe7832ed75338333e102fb66438f8a4a8076e
SSDeep: 24:y/lwaGKhUnnPv93zubK08qjgra74A2YqtCVP1G3dmHkB+MCiRYZ+69GTmzUiGa4B:OHen93ybKmjgW8jYq8VPSkiRYUiG0pUB 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\11_All_Pictures.wpl.RYK 866 bytes MD5: 478177c326a4d93d0292fee8ea51567f
SHA1: 468c0dfcd8d8dbeb95a03df7d5aa4f1369d87ba5
SHA256: 12e3fc4b53692c180eaf4a5352db5a6c9a2a8fa8fe90b0ec6a148cdac4275470
SSDeep: 24:+CmKBwFZbEEec07DkzIfYEe+6YPZ4LG4JaIf2CyrZP:+oOZ9eH74cfN2SZ41JDOt 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\Passport[1].htm.RYK 610 bytes MD5: 0ed9f61fda4bf11011dd57daa3051399
SHA1: a5fb7bb48f50898a34155efcd93a889d0cdae77b
SHA256: eee12e1301f2762e27fefd50adeafd0bd1dbd167dbd8c017507b277ee7f10209
SSDeep: 12:p6J0zUpdLgQRvZ0ycTZP2swlTV0FBKAAf+t49UlgIaf6ma3QDUB9JfjNevbM:p6SUv7RvMFP2sm50WfS499IayPZLAo 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA54rQj[1].png.RYK 690 bytes MD5: 868ecda4506fab4d9bcadd17d3ff2b92
SHA1: 149168d515b2798032cdd5be93238237cd28716a
SHA256: f37b1fe0a9e0eedad35ce03b6af3f94fede6bb824986f4a0c835d4e78cad9a52
SSDeep: 12:7SnThzRsP9KNGecrkQzSrKvUIDxEV0Qt7zN4CQOVloarlR+rIgkr0jFjcQqPENrj:7QRsPosBkQzSuNDqV0mzN44VloYErIg9 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA42EP9[1].png.RYK 738 bytes MD5: 6617b1d8273915a4a1374511c13641f9
SHA1: 1e894a59fda7ac0c978408cd4e1f1b39bc99431e
SHA256: fd50e757bd6ff96c647e2de2fb008d5a514202df7622d3564bcf6e196c409886
SSDeep: 12:SdlszjFUKKN0UkKK7gG/hFLwLYFIduSU0i5jSU8cy2Qo15bEqQ31UbSUmm:MlszjAaUkNgAJDIdu3jSF93wlEqQlUbX 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA3e3XC[2].png.RYK 594 bytes MD5: 5d331549208536f4641541b157a37636
SHA1: 88847a1d4136e2c5ffcabf47030095ccc75758c4
SHA256: 1d65e4aff83fd9eafdd6a52e4545a14982c5b36b83a93d5a099ea7c9f95af255
SSDeep: 12:Ca0Ms7za5u3nzcffrfeSIy1MYppMAoCVydbz9v:QMs713zcHrfeeMAoC+z1 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\528d82a2[1].js.RYK 11.97 KB MD5: c513a5c7018684fbe25e887d8211aef1
SHA1: fb5b74d0c930e362611c4af73032fda27ad646c5
SHA256: fef5ee8ca895def8ec5a40e0b299470ec1e387e321b383ec67aaa89d4879d534
SSDeep: 192:wSdj+qcRSBAvGTiUyOgGqlIkvD8+lj1ex8K83bJzmA0DONXO/cbDsg1g3xfT:Ldj+qc0A4YaqW8RpeK3bQXDIXO8sBB7 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\async_usersync[3].RYK 1.58 KB MD5: 7fb3bb1d56f6de741f1bc5a9b31f7d31
SHA1: 5dd13b6ae1b342a37212665c65442da8495e859d
SHA256: c0f0a2468b13798043f34779ec5cbebc5448a77f49bd8c56b47c581ffbb561e6
SSDeep: 24:6d79LT8rTQ4cQJRF05JEf1J/kgW/1ahMXDWu1+9Hsl0RjHQMiyXDGNcVmAU+Pns:a938fUQJR6EdUtahiD9U9HsikMixAr0 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\adServer[1].htm.RYK 8.75 KB MD5: 51812c058c3a39b1a04bf83b8966a9d1
SHA1: 027351ab1f4d730809c6f4573faca4704de13341
SHA256: 566734488b216c74fe5e89589b80622eb94ff4abd283f4300248b87f45a1d40e
SSDeep: 192:T+FFhreoZmCO9+ePnvTsMi8Kfl0//a1cM42Dhr3a1xbqewEPF+wl:TW9ZH8+eodnlYauer2xuEtp 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA8uCo4[1].png.RYK 994 bytes MD5: 95c4587564aaf14bf8cf65e2aece3152
SHA1: f943352e902f0aac9255c1dec5725a992bff713a
SHA256: 71ebcbe9e08d661b6450485759970ce8b35aa71ad07d6686cf0272f583964f54
SSDeep: 24:tpb4wLJ6fdMt7u3D5N82q5N15vGDurd3qGIQ0H9I:X4J2E5NHqHQup3qrH9I 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AAdAVrM[1].png.RYK 1.10 KB MD5: 9e9e86f0029cd24de757b63e3e39b3d1
SHA1: b1ada86e7de851f6ea1242a1663b0117af00f4f5
SHA256: 36b396887f051bc8c014d1bd0c2ffbe476f5ef3bc953482446f4318041022c83
SSDeep: 24:GcZ8LWjNkqrxKQIxyCyoHVir9YXWsicET4wzGoR:mM/xK/ECDHVir9QWsFET4Q 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA61yi9[1].png.RYK 690 bytes MD5: d18f9f28df790c1bea76e75f794616dd
SHA1: 08186e431150aa62a67e02c6d993b5ad9e7c4d80
SHA256: 5f39a3d26fa7b681d037020b76a58fce8370c3eb3be731ecb0a560ecb9a21f67
SSDeep: 12:xfK9wzvXiVBsjreKKe2Yg+jMnP5nQ3nkF6OwihDsL13Fnl8NN0QBwpu3PP6nskUx:pK4vXizsXBX2sjCP5nkkF6OlhSr8NN0+ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA3vOVA[1].png.RYK 930 bytes MD5: c0d9bb6bf4dfde8b7d6f8fb5f835e675
SHA1: 3cca9da7927d2ddba901d23889a32eeb5e742c52
SHA256: a97709171949900f08816fbf6f2ffee6df5dd51a2036e17ad3f475b87dac192a
SSDeep: 24:AsN7bId4lmP2bOqhQRYtnAe1FYyZDDA2i:7KGmPihhtJYEDA/ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBPUFJ[1].jpg.RYK 8.00 KB MD5: 2bb215cbb66dc568227c79f1289561cf
SHA1: 17b91796cfd4bf27247d174c4a8797436b8f18db
SHA256: 49f93147cbd90db8e98abbe3dc3c84b2b0d5a093a157dfb5aea3a8678e40cc51
SSDeep: 192:dYm5LpAfOmD175T5ECe2SECrpc9MyPTzGGey:bKzx/Evk9zGU 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBOe7C[1].jpg.RYK 11.66 KB MD5: 7efa651fe160dfb47cc7796b288e4676
SHA1: 983efbcb4977aaa178ccf8b327ecf28e1a63a409
SHA256: 3ad7b3c898c1926efee84fc1688c098b206ab2e8728819617eeaaf144a527d07
SSDeep: 192:Mf1RsOuvbSkALWslPBwf1ay90itAiYpERaHGHMzw/B1SLZMET5bfd4VzqKCSf4H:b5vbSt1Bw95MiYpER3szwcO3VOD 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO3tl[1].jpg.RYK 24.80 KB MD5: c252e976f09d957ebbe0f048df99b8ff
SHA1: 5826b53ae7c020a0adb522c6d16fcf03654385ac
SHA256: c25f9a358f20d06f620ae3a37f7f9b6a5dbe0fe43e2d6350ced81b3a9509c6ee
SSDeep: 384:p8kXEGJKthhErYnzQLy+l0XZ5GN5N8hwJ9EOon8ynxD4EZrCdoEq2a:pfXEAKEoJ5IEwPEdXD4EwdU2a 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBNiEo[1].jpg.RYK 10.46 KB MD5: aa9404dc8956a911302793b779dce566
SHA1: 57641aa1c091380de54e2c1ac62e6af8fa78e55f
SHA256: cdcb90903603049336f0ab0a8e42a6ca6252e26a9171d54e1d2af697b0571c55
SSDeep: 192:iqcc+4F79wiLncZbqu1co4Oq7wW21YolSN+evgHyyXX/pklJiPUEXZyDXXc:iqcVm79CZ+o4O232CoaZvgHhXXAJiMEP 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB6Ma4a[1].png.RYK 674 bytes MD5: e918b48f55fd9dd52be5e9fa5f9f37d1
SHA1: 2101a2dbc3d2ba794a11f23f09fddf04c708233d
SHA256: 75ba8e8ddaab2ec12d7090e06d8342544934ced92428eb8b9f487c2de83269a0
SSDeep: 12:2UkLQPC3W+v6XzCMectNqAnyh1gGsnm5n0K9q7AYzs7rAG3fkhzzOt8n:VqQami6XzCmTqksg7nmJ9Kzs7rr3fkdz 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\28-8f3193-f30905ea[1].RYK 231.60 KB MD5: 40f4483117db744aa23ca8c521586439
SHA1: 6f866a62ff7dec46f2e24df2745591cecc10cd9e
SHA256: c1bb443c049a20ada386f0fc0c3e2f043bc02ca4933fda6960890394d27cdb38
SSDeep: 6144:RjRUBWEQwIUW5VRWr4hm9Yed0/YXf/f9XRYa1/X2XVZvfq:1RGi8bscKeLXf/fEaNKVlS 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBQxzx[1].jpg.RYK 2.56 KB MD5: c5f52ce7632b48444d73b989fc2fae3d
SHA1: 36e44a73f427cd47454bffe5c9c11b3de47185f8
SHA256: db74f02593f543acb96534d1c0898a2af9c4f67de043cb19939662a87a1edc3e
SSDeep: 48:/5+F1+6uRhDPh8G68vt0sl3dDR7EhjbBb8R8qrx1CZZaBsb7Ftig/NWVahn:6uvcQbEhj2R8qrqZzNWVan 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBPThN[1].jpg.RYK 7.83 KB MD5: 85259141f8aa9683af9a3ab5e108ccc6
SHA1: e702f65643d27a29027c0ab7c16d67f41e068751
SHA256: f991ea4d6b990bd960009f3e3916965ac04af7d4533a46e08b42457d020acf2b
SSDeep: 192:6S6bwGjKqmozle+tYanQuAjlhWNA3YQCqH4ZRy:69bc4esYODARsgYQCFZM 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO8dQ[1].jpg.RYK 2.11 KB MD5: 57aa2a877cd8ae8a3b777c51009dfcc3
SHA1: 0f593118a574c3b7b633c2dec3b5dd0224496aef
SHA256: cd15bc956d363c24a04cd17b5a61dde26ce1e61515b2b20e251d1e6c866e731c
SSDeep: 48:+4O3I7WqKPIuJrdlfnEZ+O9nWHOc9iOBQfD7+ERXHilDAlCHpwFhc6IdKCFe7bew:+o7WVB3xg9nwOiiO2XRXsDA4pwFhc6I2 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO1mQ[1].jpg.RYK 6.13 KB MD5: fb07aa0d489758367fb079ea42b4821c
SHA1: 3ec2b781781a5937e5e3640d3f90bc9180e6fe5b
SHA256: 6b3b167e242e129d28ff861cd1fcba2aab58b7b04b5586a534fce1c2b364cc96
SSDeep: 192:VDD++2z9cBFD7YPIADkBGy+5AeSMlhrz1:VXgcKDkY5Aevvrz1 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBLhZX[1].jpg.RYK 2.67 KB MD5: f3c5448014c63a59021132710decb65d
SHA1: f8eaddf63a4d0216e41ca965d28c4780e3c65881
SHA256: ec97f011d723b3460f717252615b5d0b156b65bd12ddaac70c0f428e17acd6b0
SSDeep: 48:2XNb2PRo8R91N0T5LvI5EQ/3+O824+BtSlt2QV3ikDOl2UfmzH4L3P/W:uY2dL3Qvu21Btct2QwHfmEL3P/W 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBL0ij[1].jpg.RYK 2.53 KB MD5: 021ccf04c8d11594e38b767a43ddedc4
SHA1: 88416671c5006919ac477b287343f17339cf40d1
SHA256: f173022908b960dd464ed12c335c4e68ab3d1de53617791e46f4a81db6bc1d25
SSDeep: 48:8/OTgFZjuUXhaW2zLFnceOAlNjNC8Ou+KPG6ZcJqN+P0eclDE+nj6PU/V3OaFI2B:8A8j6jvpnvjjNC8zhPSJIw0BDEgmPU3D 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBIqq8[1].jpg.RYK 13.08 KB MD5: 76abf1829d8b758f40cd2d823ccc6fbe
SHA1: 5a671a1766b549d0425e939669ff196153d6665f
SHA256: c9474b68a068053dc230a4513b42bf99627da8e3d3e29ed935d5896db725774a
SSDeep: 384:nL/2qk81LcWojqtlclZNemGWJlTZonX6mjVIMbE39Be:TtMWMqtCBeBWJNOX6mjyMA39U 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB74fLs[1].png.RYK 642 bytes MD5: 66f13d03269e17f318d1f9466966b5fb
SHA1: 8ae56ff7165976d7e2b1dbf1574815512edc3dfa
SHA256: d8a1d67030d81ae08cc000146a4c4753007d7fda59657ed7035d750850c4d1e5
SSDeep: 12:5a58A1DJMlvduFR9B9xTX7depsPX//Y/VoqFmSmRCnd0EWQTS/lhHEn:jAhKlvd2HxTX7dZfnY93FgCdIQ0nHE 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB5kTiV[1].png.RYK 578 bytes MD5: 0f64217d5fb8a533b022eab025488c1e
SHA1: 324228981d264a652ae37415b7d6b11e892dac10
SHA256: c83d992795aa0d3cfc2de4b913b597a1a6aba488b3dfdde7aea60aebe8f52778
SSDeep: 12:ffQO3VVuAG3P1UqPwXUocbuhZk36LLIA401S0TQIEyWPeaHIj/Ztbvf:Z3up9UqPwXUocb4k3sIA7S0TjX/3jPvf 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB5kJAC[1].png.RYK 578 bytes MD5: 587beebebdbc09f5e8883505e508bb6a
SHA1: 7d092e6e2bf6ca728a425d60d972c47f0e1b2c43
SHA256: 58713df95ff0f5d628bd18023ce9e25fbec904731db33c62ad9b42cf71c5ca7d
SSDeep: 12:yuQjkzQ/2xdri8NZEgtt3pMku4ugktd0N/AiqkO2gzPRhuRY4T:vQIswRrF3pwh0N/AiPJg4T 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB46JmN[1].png.RYK 1.05 KB MD5: 4ad0e2a6ae04c4fe5d0026284458e4ee
SHA1: 8300364ea4baecbbc3e6490535812297bcd97de5
SHA256: 83d35136b1673403bef76cfde72339499c73604a0554d5773d60757c63ef8d49
SSDeep: 24:UXPGSQ6Bq5Ci14Ov5vN0GO71y88rQFSJG9MP/4LWA5qNK:jZ6Bqf1rNZso888Fv94cWWz 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBDZoZR[1].jpg.RYK 2.63 KB MD5: aa623872829c9c5f520789ba89c43f4f
SHA1: f6799202f60cb808541d22472918edac42c7e6d8
SHA256: 44c452ec51f9b47a13ca222a796ea9841ca266bb4535102aeb1967fb1b14ae4a
SSDeep: 48:BUdtywWSrL38CpS1AwttR1AQIs0iJH6V6vr7ksO2Yu2kFDVgL4jDnvBnmKZYLHjI:BUdtywjrLLWAir1JIs0c6QDxBD2kFDVj 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBDRbsH[1].jpg.RYK 2.33 KB MD5: de7bafcbb94f7f43640b73a9818a3f7d
SHA1: dc0fe81cae146f3419ccd3458f0c1476697b13f1
SHA256: e5ef8a9b884eaa30556961f2e067fe76c8caa206152b2360e7abc8180ecc1482
SSDeep: 48:fKmex5C+7VxP3pHItwKhWj5ISgXo8ysi8Plm4ynZB+LQlJzoat+g6tWII9BL4J:fv49do5SqSg4cPl+v6kO++XtWpo 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0rDa[2].jpg.RYK 2.27 KB MD5: 2a9c22800bad9b6b8fcc762742bbe182
SHA1: b93c344534348405d7d4c33ca8bd4e968f9c6ab1
SHA256: fbf97241dc25f8019fb683683c88e68ceeb0d9ea65292e92c2f864e4d57c7902
SSDeep: 48:XA/gyL32r1dwGi1INVbuGyp9fmhW/h5lCLkfkUw6p7IIw3mxPk8:Q/nLG5dhi1INVFyp9fgW/9CdB+7nwWxx 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0rDa[1].jpg.RYK 6.41 KB MD5: 07a03f662df69ba52d8357e86479c636
SHA1: 59518cdb784a5994653d9617a9abd70f5195db32
SHA256: 4108c4817d97a7b70d703fc666f71bd7bec97d3273eb45835e63cd87670d34cb
SSDeep: 192:zupLHg2X45APQBKm86+xW0GkVZb9RH3GX:zupLZo5AIBKm86+xWabvH3GX 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0mlu[1].jpg.RYK 1.56 KB MD5: a8c6e23612c6eacdcea6da1f4b8b17be
SHA1: 100bf0988d8ccf6eb94fd47e4d6716269b358f28
SHA256: 60d6f93376ca1966c26a3f5104225605db88ecb1c9ea4268f969d67303a7ba04
SSDeep: 48:gju2oZj1xShzysQS0lBmXM8aNsXsOKKm0IYEhP/:92wjrMysQrMJaNoxKKaY0/ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC06Ub[1].jpg.RYK 13.19 KB MD5: 59501662851663e2b855a640e8d923d3
SHA1: 04d68eda70989a209433aae6f465743792316bae
SHA256: b57ffe307e7a7ddfb2448a9bfd58305b54c48b5cb63fd61bbefadca3c57ba253
SSDeep: 384:cTnp37rO19b03pp2lo0nSr77dMEcaUFyz3A4gyzlNth:cTn9fDZg7Sr7ZMEcdAAIX 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBzxW1[1].jpg.RYK 9.46 KB MD5: fd46a082a39dad2a348dc6d377248720
SHA1: 7bcee300b90ab9c005fe838e0ec28e527ef71892
SHA256: d67f15e9da784b40d1eb46063be9a23dea91d433502b6fe341281a290451e290
SSDeep: 192:7K80v1mgDMe+qAYis7byvq5tZw2gVnlyP98JJf25O2MmEumGTpn5sHV35:70ggIe+qGs7br/OFwP9YeFRxTaz 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBz9wz[1].jpg.RYK 2.49 KB MD5: c27646a5a84093b6492b6eb71a74ee2d
SHA1: 9aa983a6e5fbe34215b997de9f3cddb9913f0a15
SHA256: eaa5c3120ac49ec429805062a799f1e7870f67bece562673e36432e5082c90d9
SSDeep: 48:ou8XxdLy+D5HODNH/MZ8fiDxgxklrsujsfWUQ+jt/YKL2oI7BadDuQsV:ojdew5up/+UkZHsfz/JwKL25FKDDsV 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVxM8[1].jpg.RYK 2.24 KB MD5: 9e7f8581f0bf492bdb714b7e9192e663
SHA1: 28ba44022b70c2f7b02e18fe5593eff01fd2c7e1
SHA256: 4eee461453a18cea0e7d367c5c351c26e0e714500bcc4100e3aaecb9573478c4
SSDeep: 48:vG1XQoZIbQuQCXCmnevh6PJg5aDa/p0RfpXe:QXQoZ3u5Xsh6PeID4ORfpu 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVGsM[1].jpg.RYK 7.88 KB MD5: 2197aef1806f3d088b41a90e2566ad44
SHA1: 14108c403350c7c784890b6e7b0bb6db48340248
SHA256: 4b980499f0688a9e575ebd689e1093265aafe61aa22967c749b96d778ec17014
SSDeep: 192:rJK5LFYLEIuWoX5vVqLdh4SIXTrqi16J6OjNB5pN:tK7Iu/X5vVqhhpIDOi141 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVEOW[1].jpg.RYK 2.64 KB MD5: aa2484804bd211ac6b2e4a9654e8d3f0
SHA1: 40a611f538ffbe7b7f6a91acb01d7669c879595d
SHA256: c0b0b1dcda0683aefc60d5396eae8167e918dcb4b650b20f5140ecbbb829ec91
SSDeep: 48:uJYCp4i/nMBLXIPhrp+R5OECIHzBEHbb6bfFvO8Pn5lTu449YuL41QTynfJ5awG7:kP4unMBGdmTCITQbbqvDP5ZvQIOTwzxy 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBTpvW[1].jpg.RYK 2.19 KB MD5: 2d7ce5789df45f39d6ca3a73cbb76b3b
SHA1: 0ddb27b813a29001f2f4522ca23d624bd3aafb22
SHA256: 4fe4fea988ef3c6a8d2acc79dfb8988465049e40d1c3d2c1e51e0d6fa92f6e8a
SSDeep: 48:cnF6/sDaSC0LFaIjX1Fxm8tFWQWAMXSOsA7Jn98G:nUfHBjsQWMOFT8G 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBsqNL[1].jpg.RYK 5.99 KB MD5: 419091c862ae7953d05ae9b9da1b2e7a
SHA1: 98db33e13c214f3b12da292de899cd4c16b7770e
SHA256: 0ad61566a040beb3dd3a2197567de97e728db8570c3183f1a1a6699be7154d1e
SSDeep: 96:fG4Vij2J1sAU49edQoAJPogDsVwgD2YSUqZKKZc6OHCnJligpN1cAGgDh:fGUiC8AdedQHzZK//Cnm8Gmh 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB1CcOi[1].png.RYK 754 bytes MD5: 93e9649a4380c9d4377cbfb25e8cbc49
SHA1: 3c51578deb4abaa784f964cb5cc06f6e19d320d2
SHA256: f3858d723089c8de9728d2de3b153a826dd335a29b8cd5b3278eb06c87974a27
SSDeep: 12:MSJCptfxVBRfJIP1CvlG61MjEAiMjYDIpL3haT6bNctIU0TM:zJYflJsCdG61sEhM0aTMT6mtI5TM 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEeP0k[1].jpg.RYK 9.47 KB MD5: c248571d8ba70089c2eb00d9c357eda8
SHA1: 0a4dec2bf6a6b8f9e7a21278bf795aca2c6985cb
SHA256: 3c61e724a93ee753b5111836a018579555872113c04555210e4786e800817970
SSDeep: 192:a2brY+UREd8/wNLab6AWy/0aPG34BL3sIPMu0HUnqUIhzT3/E5EJcf9:M+Bmwab6PXge4Z3sdHuy186OF 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdXJj[1].jpg.RYK 1.91 KB MD5: cef71e3a87c9803f1f51ea913728aa37
SHA1: 7716219d282cb0a16a0ce3cbdc8e015fed796965
SHA256: 31017321cb18b45445bb3e1f653a3ef39206f6701f5bcfd92dd66d56e5961d20
SSDeep: 48:BxRvrMShmTqAlTIs6n54LqGLeDHnXC/rhIgC+y4tDN:BxRvrMWmTqMxm6erS/PBDN 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdqEy[1].jpg.RYK 1.92 KB MD5: 462e2824fc548fad29e3fdc0239579b6
SHA1: a3c57a09a0d5b52e5edc96fb686eebc39bb2f6b9
SHA256: 87f3b619327b79a52f28fd6f5a0fed23bf65c13764f627f701bb315d04add865
SSDeep: 48:y6h/gxFshBnErjHM2Ec2IjU2pGJweonvfPTxmtQ9:54a4js0jU2pG+eonvZ9 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdtWw[1].jpg.RYK 1.99 KB MD5: 65288ed15e34a6284e7e221e2763d36c
SHA1: f57485cf101b64765f6a62b9cdf221aa28ccd398
SHA256: d199fac10f404ca08d135e0b3c1bf60ee52b9c43927fe8bad3b24cfafa60cf1d
SSDeep: 48:S/g70cdm3iie/aZToMyAScD0U3gVkssAudUFg53mD5i3zK:S/gnmcaaM/RlwVXP250 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdoQv[1].jpg.RYK 2.64 KB MD5: 92221557840f12cd2d351e6a2f74b99d
SHA1: 19f669534774ff785a7e274c5d7d1be561c75d93
SHA256: cea4318e04fa10cc400439d5203cd2934b1b23e8ed82cd2674e1b10c3d6e0df6
SSDeep: 48:Dd2tWEMFwKp28dgt8hokz/seeZivGz9HKXfclSXKamDseUQ2lBaYM/U0cQ5:Dd2t8OKDguhNSZhHW0SXKvseUXzoU0ce 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdE0f[1].jpg.RYK 8.41 KB MD5: 6d3c5e2c660b40a2addee037f234cb37
SHA1: be81992e9db6be9e661d6e911d1fa151b7bf9025
SHA256: daa7e21614eabf0ee8468c9a5d2b7cdc999c26986e5a6789c741a278fed34dce
SSDeep: 192:nq6i8JtIjnJ3Do9F6LzRK1LQl+xqQB7hJTDRBl1gsnIhnojZvzbRk80:4YAOi3sLA5S7TDRBrVkoNvB2 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEcHle[1].jpg.RYK 2.46 KB MD5: db6901a061ebb2e46ca7eb6c0db2a841
SHA1: 35b10f6ebd3b8c9131e52bfc9398bcf5b525a544
SHA256: a9abc6e3b6ff947b31860ef2c41464f6ab7647212e8fd927983db712e9527404
SSDeep: 48:TyQ/D3QjppuWUX531MbQjE4eipMbUIbarnir5ky37MLXWDlLjr5Dg1aoUkerTHQ5:TyQbgFoZNubt6MXWTULLLjr5s1lcjIbD 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBE9wSt[1].jpg.RYK 2.00 KB MD5: 083af4027fdf7b63358c44958a966d4b
SHA1: 2fcc403ac434b6838969878d40782e0491e23a36
SHA256: d301f929cc08356a97ef925ac3c029abaafdc69e301629ec1cc3ceb94df724de
SSDeep: 48:hn27BCoT1JwkIw8PqyeJk7hEMAMozQnhS3I:4749w8SjzYhS4 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0tCi[1].jpg.RYK 12.78 KB MD5: d5bbacc3ad173e04d413afbe562d69c8
SHA1: ab4e18f1861a5fce3d1a3901d48634d3dacb7d3b
SHA256: a4aed5bc9e28ec18a904a541d4b8c3867c0dbc008d14e2fcd760b07805cfa93a
SSDeep: 192:Py+R5MvmOnh/CnV0Ph3Yj0zI9h1PYHBHol1t/pnp8blK74Sn:606QiJ3SiIPVBp8blKcc 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBDK7Yy[1].jpg.RYK 10.52 KB MD5: 7eff755575112524dd6255ae6bdaa451
SHA1: aabaa990c8fd13448ca9750a9401f6ba262ec6ba
SHA256: ba881da452a19860cecf3ccaa8f65910c0fb8f24a27b4da9fc8f97dd1cb2d93c
SSDeep: 192:l+4vD33dQqEWuHWtWFXQj/QzkbXLeQXVZ0ej2BW5ZLfAD5VrV:Xb33dQqPu2tWFXQz8kbLr/ZsD51V 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0lYn[1].jpg.RYK 10.06 KB MD5: 1112273202bb3b2b575e3351759778d6
SHA1: bbd47b20971dd8bfee18e730e09d9cc157437de1
SHA256: 191c58d8474eb0061a16cda6af82b424be9fbf5902fdc1f529f3d1967efef8d3
SSDeep: 192:qkwqCV9pWIQGRadEDQ6azURmSyB+lhxiROGsocRWwqI0RKGEJ1E:qkw3TppQvdEDQ6WfSy0BGsocgwSR+m 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\css[2].txt.RYK 466 bytes MD5: ce1e32dcd07ad83e08627d959ab44fd7
SHA1: 9cb22bcaf2e2d351dc8bb4d940b15f20711ca0b6
SHA256: ab83922462549e2ea46931c5761b0affe2bb5afbd5583bcba44dde7c9679ec1f
SSDeep: 12:wmbl6B97KJUomirV45rKdjrF7CTH48nuJJH:R6yxrwK2bu/H 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\ie8[1].txt.RYK 386 bytes MD5: f9624473131982b6a932596090466048
SHA1: 7c4df6174a369879eb4eb7944ef7358fce520fc4
SHA256: 5d70804b4bee29da856ba574947f847141e6e50f2634068d13a5f87a7bbe9f92
SSDeep: 12:dpsER2281OouYQgMosWtK8zblMkd8r230G9:zWOouLBfWA8z5TX9 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\meversion[1].RYK 4.66 KB MD5: 31f176c1899e61d533fab74b3038e11b
SHA1: 90b4944e18ef45af544b768bcf8a65d8a376a8de
SHA256: 1ec073168f1989f3eb323e67b1e6676f5c1632459963f513064ad398216eb9b7
SSDeep: 96:SmqfgWwMStkr3KFE1XtZ5BYuOIovFsb2jPXIcBN4zYPTviD9pG7X3moi:2xGFE15vFWXbNcYPT6D8X2oi 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\print[1].txt.RYK 450 bytes MD5: c99b419c4fc3d6992b23494576e5e2d4
SHA1: aa8108a618177dac46b8423d292f89b021f5b1ed
SHA256: 07332c5b49570c1e3bec5f2787df12404e8356d5709ad9095b4debea38368dc0
SSDeep: 12:eeuiaJVtbOHSYjNAaOX6gLlKYgr+umU6ujPn:eXiaJVtbOHSYjNAasTy7zn 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\Standard[1]RYK.RYK 85.31 KB MD5: 93eb579e0fe4d330ad3537a5879d5fe2
SHA1: 54f71ac1f22e66f4468c338444fbace73d985dcc
SHA256: 886a122182795f019b88880f4fab46c56df65f65f745daefa9487e9faf4a70d9
SSDeep: 1536:O7gAy8DCLS8mpUWj9SkcGWtAsLs6jk2PeuMjUuCQwFdIgSC5Cu6ygXX7pWP:O0AyKCLS8vc/Uk20CfXkuDgXX8 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\core[1].css.RYK 165.10 KB MD5: fc31d53a0582907f0455a061bc7f5e7b
SHA1: fd0acf14811eb1f13af12c4a0993841b0efc35e4
SHA256: a7f31f485e9e886b23ba08bf111bc7657f63d80f859a18e7c80b45af465bdece
SSDeep: 3072:hykWJmXwyIv1AleP3evvlXPsjnVdRrbRPKuOaJrAm7C6jIEZn/MP514PMs:8kKrv1AiKvlfsjVdRJhh1qEZnRMs 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\th[1].jpg.RYK 2.55 KB MD5: dd60a9d94869dc55a3098b5879e45dc9
SHA1: a29b0e9431f3f69a4b2c25ca636a91fb6b651531
SHA256: e3bd8341e046a266ab78870bf4161b2dd3ea98992f700c8817b8e78322c536d7
SSDeep: 48:BEEx+dAban4YUzYY1yIwbfi6SUEI0KMvaGdks00gkbaE/vKck/OU4lp8TKG0:NxHbbYUz3BwG8FGSsBuE/HO3g8TK 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\ast[2].js].jpg.RYK.RYK 70.33 KB MD5: d8db068c41c40ff835279b89bccc3a02
SHA1: 42e0d654182161b8507522061e5794c106df0056
SHA256: b6581150d4078d6a72c0df3769c8c75a7682bc9dfcf8b1e51d1001567feb3fd0
SSDeep: 1536:D/XWpYPdia89s7nkv/2iCzDhzlJuazmRqReJOCmPRcd9xAh8:bXtdDwv/zCzD7JuhqQoCUk/Ah8 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\adfscript[1]pg.RYK.RYK 10.39 KB MD5: f5f15c105566eec2be911ec3d27438b3
SHA1: 236a64d56ed992886a0a29a6eacc43e3d96e6d81
SHA256: f5e3930bde6025b37d9394959a918f4b8416e544ed64e3fb59456e20fcd676fe
SSDeep: 192:fF//L1A1DAB/LK9GD4K05vwAZpym05upMt/FWevZ:x16hMt0XZpo5JPR 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\adfserve[1]png.RYK.RYK 4.05 KB MD5: 7fcbbf8864845dc571457551fccd168a
SHA1: 93472cc3f1b6be0f1078ab189605999536493c4a
SHA256: 35b1d82d75f2250f43ccc0867c08380bdc5c170a8fd6f023e4a80f41c30901c0
SSDeep: 96:qUlhsmCTpMv+eBb887b2NEiGLhhrJtLdlYE0EluF:qKJPv++7SNENLp5ATEAF 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\player[1].jsm.RYK.RYK 27.13 KB MD5: 739e86ae57751285af003e766999fdfb
SHA1: 3c096b8e2c370c487c0fe91484ff116b81771b2c
SHA256: 2da8ccd13bff0061671dffb147e1a3224ccaabd8ffef43d0826e4cccb38db359
SSDeep: 768:bgxs1piPgj2ChXFf6kvMdzpBnK3B0B15TQ:Ux4Y4jxp96kvMhpQ1 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\player[2].js.RYK 24.10 KB MD5: f2adcccc33878600ffafe82ce02af2a4
SHA1: 8a4f83df109233ce9c175b3258d6b6086b438742
SHA256: 80894a91b329abb7e33e25e3376330187722ad84d565876e8f0b8ab0cd334300
SSDeep: 384:yr9XvFJ6RwTeXhrF22MeQ9Mm84yqmojcphp6p3fJQqLL82ZZY8Ip0SghR2XTUXTb:UJ65hp22Fm5xjqp83fJ3LDZY8tSUgYrD 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\26158[1].pngpg.RYK.RYK 48.36 KB MD5: 6588b75366732860445d40649dd9b918
SHA1: 1dd74d9d2a3740fea1a3b88f29427b2f09ef13a7
SHA256: a83dae7ebc9ec1b923961201be70765c966099bd3d136f4ee9f70ebd154b9f35
SSDeep: 768:c4CWHB5FhivAfs992q7EEtMOPeafyMz9tal5o6v1lX/A5qd7CjmSjp4RTd5TqZu9:L/HziRf75igect7C5xXY5m7FqiRiWOE 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\adex[1].js.jpg.RYK.RYK 36.74 KB MD5: b27f31a93269a09d9eb6aef13657b8a4
SHA1: 9f663e13862924d5c13c578baf791196b44d6174
SHA256: ef777a3a76e4a67942f12d00ebc4f982d5f479bd142235813421ceea1009dd0a
SSDeep: 768:ZYAv5iqi3OqtC0iduS01glS0wooOtCtTbLoIrS6qdlz5Q:ZFvQHtfidV3lS0vgTbsI26qd0 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\adfscript[1]pg.RYK.RYK 10.39 KB MD5: 518628ab561e76710dd1864076039a1b
SHA1: bf62412844309e79abda941483588c688b35b214
SHA256: b0b697e7b35cc73486c6855e1483be7b72e084f9a13636064f3586a8821104eb
SSDeep: 192:+jGTtcFKieGhqtFYsULRg+4ewToZ97ZtvZidJ0pAWREwylS38:+jG6IQE1I3w0tJpWwylS38 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\ast[1].js].jpg.RYK.RYK 70.33 KB MD5: a1f4f43389c5026eafe976db73e19f4e
SHA1: 168df350c61036e2db513f10f6c0c80738bb4a4c
SHA256: eadfb54c58d9cd018a2f6b6abcf9de6f97a919ee410ecbf7016a3d16bdf88238
SSDeep: 1536:RJ+QH80AJfVlpHLKLHoAJdb/hHBNyCC65iPjG0Q3mtFwmBkG1Sd7/zFZ63oFeLDD:ZxwTZgHosFPNFiPj9pBkG1Y76oFeLDD 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\css[1].txt.RYK 154.71 KB MD5: 7259d98ff01daa18ddefbf19c19d7cad
SHA1: 29ecd9552ab39a849aad3ed95b5cc7042f17d7b3
SHA256: de4fe8ecf44617e325fef65160fd33ca62a4dcc97f056507142afd7dd8054753
SSDeep: 3072:+ha9CSEHahBZciaj6aqaKoe6cZjA5L33BwP8w4CRrTw4K:M6J7aEY3Rcuur8z 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\msn[1].htm.RYK 2.56 KB MD5: a0c5db4781d8eae1278c6a65b87f6b39
SHA1: e4a14192510f156f71572ad1908354b2bcf132ac
SHA256: 4828bc395752a83bc8abec4727b654a3989de7587deba75363aeed063eee9720
SSDeep: 48:cZjLTaHP5gU+SMDQzEivRjVU+L0zf5CRwLmjSh3fL4xJ6j4ITPhS9vgQnUpjkKR/:SjLTaGU08Qi5je+LsfERwyjEcj6MWh4m 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\uid[1].htm.png.RYK.RYK 2.83 KB MD5: aaaba6ce5f1743490882216b805b2165
SHA1: 45ba6bb912f20aed2034dbc11e5e761cd30f3f34
SHA256: 4950232fcd72845c7fcbf8bba44b4608650f0e491860074a82058a1781539d26
SSDeep: 48:YBs6aYkz5TRtFUlcpkqAfOGHbxiPXzr87u19IgSjDtR4axfMP5jkMBy4s7wrqWoQ:YiNYksSaRbxinkXDtOax0K4HhWWeYL7V 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccountwpl.RYK.RYK 1.97 KB MD5: 44f76189341de80572df1947e8956240
SHA1: 8ced369cb16c3a45a9ea80d4e0ec337670ef0af4
SHA256: 9693f57870870cbd92ba9405808a187da4272349e521437ce88d5e6ee5258998
SSDeep: 48:IDxs046+vP1o8QXk9Q2gbCxWTbyjcEfDRKWmQ:IDM14X12WA1fDX 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccountstars.wpl.RYK.RYK 1.75 KB MD5: c4ccb41fa4e244a66f22b856d9c183bc
SHA1: ef96f78a44fe03f7c27b746f0fc7a53e91e76282
SHA256: 11632dcc023a9af47dd9307379b424dd030a534b793fdade2aa8d99ebe6bbb4c
SSDeep: 48:bZGEAI9AIIGwYMOSqAwA/EpdiX0LcKwWv+flm:tNkhYrqwhbKAv+4 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccountt_week.wpl.RYK.RYK 962 bytes MD5: a6a0ccfa29a027450e19ae9d236565d5
SHA1: 12fa7031d129d5c15982c52db2f729b64cf748db
SHA256: 75b4734229878353eea3f6a3fcc10ab672d2eab13806dad1c8805997d233bb28
SSDeep: 24:Ep7f9/IR37YprTiCbPfyt351KqjsyGU14r:C71IHiP2tqt 		True
...
c:\programdata\microsoft\crypto\rsa\machinekeys\08e575673cce10c72090304839888e02_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f 52 bytes MD5: 93a5aadeec082ffc1bca5aa27af70f52
SHA1: 47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256: a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SSDeep: 3:/lE7L6N:+L6N 		False
...
C:\Users\5P5NRG~1\AppData\Local\Temp\RyukReadMe.html 627 bytes MD5: a776d43a8038adcd2fa9da796a41e148
SHA1: 40b9ef0967f8204527a185103ce14518af4e553e
SHA256: efebd27ba8aa46494c513febcf4ebd34ca759be637311fbe0da80c3b107ef15a
SSDeep: 12:kJlzqZY2/xg2/MbHeIH/GJHbr+OsKXUM:kJlQYm2mqHzbM 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
C:\Boot\BOOTSTAT.DAT 64.28 KB MD5: cd49df5938865b27e52e5e64a94265ab
SHA1: 6ac54d11e5a9a9ae147a21770439d8b8fc9c7607
SHA256: 64691d9214b2c5e042f59cac6ab37ae56d5c0cb210112184eb7e329e74427d3c
SSDeep: 1536:atpnox46yLgpPYJF/yWPLECYRdBA8kWcgvEm:ipVQpQz/yWc3BAXuJ 		True
...
C:\BOOTSECT.BAK 8.28 KB MD5: 46f9ee2d85d17dc92d20809f5f5766a6
SHA1: 1608a0217edb9a7532d9e3cba28673b94de85b69
SHA256: f842bad2abd38fc843237c6195f13a81ffbb9cda240be4c3879bcce917ff4e8f
SSDeep: 192:zrKmCJc1wqdyBZKxQUpGP7xyLTDJSzg4MvLRbS104/GAHM51a2B:zocVdyBUYDxyp2g4MDAXGXr 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst.RYK 52.22 KB MD5: 5177c059c5169bc603787ff18d70edcd
SHA1: 8d35be69f9a52da61dc9cf5ae94ec69a4eb0c00a
SHA256: 06970ed432ebadadb8f65bf0346ae76e1429b9d972b1c3456bfa9e4259f20b76
SSDeep: 1536:iex+e7tAo1JGQWOEsqqtE7+iMfus3xBgMOPdyy:iexDtfknetXfuzvN 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.RYK 2.89 KB MD5: c7603188c735c2ad038260aaad36c22c
SHA1: aabae43787e2271762e5c32aebb50ca220e92009
SHA256: 4087e763dca0cd64692ab1a988d8628d8276c63857c239723cb4cdbe4ba6c8e5
SSDeep: 48:katddhhbvBV9uOArwIVP71XyiDtCLUE1aHc/ywKTtzNV+UKoaEk919KYACApn:katddHwHVPJXyBAQ/ywatyUKE419dA7p 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst.RYK 1.42 KB MD5: 647308de310c1c21f01fd1290df321bd
SHA1: a189f8c5252b573989e94b02f7180ad225a53db3
SHA256: cedee87cdb2443c363d4aaa42b5ce5a56c42a01b8bb7cda8b84d5f2d6cd2e09f
SSDeep: 24:AN9tGBSsGlivSbSDP6m/2W/k7RlQTZTGXbKUWu6fCwMZmyD:AN9gBSsGlicS3+W/kH0TGOW9m+ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin.RYK 75.94 KB MD5: 2c513927f9fac4bf951c6bfc6e7c5fcc
SHA1: 73274303e7632c0068452ee5c0af69833396f1fc
SHA256: fca5ad654c2369891fc7dc81d058f8e283f106de079a2f0a0c4de0b9cd07218b
SSDeep: 1536:JuEwTZ1J+Gcvz856HJSXb5irEVVG6TajOC8CHMJaMaKnRJcBGw:oEk1J+Bb80gYotq8CHMwMjRqBX 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst.RYK 135.49 KB MD5: 54aa4ff368379b1c0eedbd2c5764348e
SHA1: 302c82e4329e5ca9178fe6dbb4dfcde3109d1246
SHA256: 189170fb340359ef4ea8b7c7953b411e0b78da28b3af13723ebc718843684457
SSDeep: 3072:o6rvPgJ079RNDHGqManGBXPfBnTeuoJ/+LnQB0K:PztDHnEfJe7JWDQB0K 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst.RYK 34.56 KB MD5: c652be4cf90b409144828e1daf2eb748
SHA1: 25e5cd3ab8fbc08366598857c52f8afe2e2030a2
SHA256: b0a2d106098c97b7c1ac5e3d5be51bc80dc9ec2f77749d8450d5d449b68ddaad
SSDeep: 768:tnDZFhxd80FwXlvJne8jKQpwiOKkCJL4q3TnMxtAiJVcjLQ:tnDZFhxd8EclLLECt4QLQ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK 64.94 KB MD5: 02e6d3227cec11f5b2944866c7d8b9d6
SHA1: 0f7830d45282bd14db4bea2a5f2e5fa4f720c85e
SHA256: e725818c0450deacac4c6e3235f92eca85f4a1b0e7baeabd7936c26a5d8f6b4c
SSDeep: 1536:2ux2nEDL/N6WSx8u59R0+HhvX+MeiIi0Np3+5gi51o:2HELF6WSN5j0g+piIi0Nl+5g/ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Acrobat\10.0\SharedDataEvents.RYK 5.28 KB MD5: 0da8ec41785b87913b6c3f203c94dc12
SHA1: 39d2cbcb19789e622e05029e9fe3ee5036fc38df
SHA256: 8879e308c01fe2c87a41440ec64ce6e26bce3550a3ce76a2da125db62a6d06f4
SSDeep: 96:oVK/Yd14JbuAkvvsHDlENfUuezSKBRmmgQ6eT8euhsTgH7m+2ImHxZf62E0wcMIy:p/VuAkvv0CNcRzSIweGs8H7m+2bC2LM7 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\GDIPFONTCACHEV1.DAT.RYK 106.55 KB MD5: 5f35310ac36a477b0c299708a9366882
SHA1: 5d169f46278bfabad7f8026a9180d5365e8b53e7
SHA256: 033805e63dfa3ee5b9dc7194fd19a6a01c1e4ad0aa883638ad1bd20aa1fae06d
SSDeep: 1536:te88+a7aiuNadaiiFMzTLsNhDm1aawAzjjCRGuN1PEiYJOP9w1Sdn:tsaiuFiEcT6J3gXj0/3EVm9CSdn 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db.RYK 1.15 MB MD5: 4e339e3213f4ba4f2200277e608db0f2
SHA1: 9adc7bdc780881b479772fc81a04cd62b40ec127
SHA256: 1095311d794b360470462a044ab534fbcaa9f660d28ea58fa634fc2db272c14e
SSDeep: 24576:NWSk/piFXxEjYJapsUuQEblpSnwGxFCjjf5r2Szuyk/CqlpEv+W3hOS:cH/piJCgTDQEbl4jrQdX4nl6V3B 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5Kvc aIyBu.odt.RYK 4.55 KB MD5: fd68189bb682d61c24e38a7dc9754d0c
SHA1: 5a1cf81cf1fddc2bced46c92fe39e044fd4081d5
SHA256: b9d5e1e892d0e3577073e05def14f901364dd72a103d4d1c6f8307245ea874de
SSDeep: 96:2ymqbuu5OgR7EWlbYqNCZ3SouV3DsTHzfvp3JITHTG6twcLfT9CskMn3D0yh:2yrmgKWqqNCV2wp5ytwyfTpnz3 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7LC7h3NKBPeoe.m4a.RYK 38.08 KB MD5: 3db68e2fe58355d5575f09104c542152
SHA1: f5c8bf3c741958daba26c59ef3f8acad0d67a1d2
SHA256: cc763ff75d7f2ee3e8347d3b8ff18063cee363e5a2876b35f28a826d4b3006f3
SSDeep: 768:EPx2LvshXuZVJTLO0C0bp+zKJmhfX1mAvQGq1V9DZSLO9XNjfMmcet:E5eEhx0CaEhfX1ZvjIS61xRBt 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\A54yMyJIBKZ4.ots.RYK 80.27 KB MD5: 88e72b26a29de2cc7e979b6c2f412356
SHA1: 6a403bc6d5b99b3a8371a95f3d616b2ea654d847
SHA256: 4e8ecb0d36b6e315ba4ee940fe88a89bd76b558742c9f41db3764aef96953cae
SSDeep: 1536:Pgg38zQITFsniRtXcQOYurxN5rNvVWAO472aoH9hFy8nxi6SJ:PW0IuniRtXcQJurxN3cA575oH/i9J 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Cookies\index.dat.RYK 16.28 KB MD5: 856fa5e535815b99dced1d1918101ac8
SHA1: 418403bb60d2e2b444d1c51322cc4ba07038cac7
SHA256: 725fe6de6638def37cf0874206a8a8acfaea243ec4f08bb77361076a6fa51a95
SSDeep: 384:GlSVBObFMYKYycSwDqJPlpSTE8ayeqTUHtk6xlfyGYT/:5aZrKYyzJdpSoDUKthWz 		True
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\ap3qnxm9od.flv 62.78 KB MD5: 038fa7e6d49f7dd593fd92d97a98c83f
SHA1: 465c3554bd59b171fea8e7aae8739f25d0803116
SHA256: a229d18a4ae71602bd1adc14a2c2ae48c9fbd0068de0e06ffa8454d799235958
SSDeep: 1536:jv5bN4ikQFUgD3EfO0jZz8fbcfJ+KDb3Ne/:bgvkBD3EfP8fbgvY/ 		True
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\effx4divca0tc4.flv 16.60 KB MD5: 489a0898a301ac228260950b80a33936
SHA1: 6b1ec7dea10a8297b2a05bc1dcf9f6f6bee86834
SHA256: 5490214e095ed4675a0276fbddda2d5adf83b1aef42159dc0b2bb8e63f5aa97d
SSDeep: 384:o+l3VW280pjlnBeJd/EMjhSaxn3/wk378S:o+lG0H4JJEm/xv3YS 		True
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\emljy8wk7h.png 14.89 KB MD5: 2b9202cbf756ef4fc7c9c55e90216ccf
SHA1: 487fe772ef234bebb4e2490a357fdca4304e1588
SHA256: 76d5fb5924dff98b5b91c0dae95dcccf9ca4f5a14495caf732dc441937f9e397
SSDeep: 384:ej4BkixZqUe1yVm6lykxy8LGLNaXIErwIYc2OyPUIQWpqNC:W4KOZqyFy8LGLNaYGqc2Oy8fWp4C 		True
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\fdb1k.ppt 68.56 KB MD5: 679f8c6b6d8b1368f19c8348e64cde4a
SHA1: 7dd31c4ef17423c250341d319fce29094fec4efc
SHA256: 8a006aef0d11f266e65b8fac72e09414755a744bf56c6cb1df83be6ed6d16ac5
SSDeep: 1536:74znIHNUv3wwO/e4WzY58A8+3ykOvFyj3DAxH+X4+rpP/Q08k1P:7inJf7zo8w3VcMTAxH+XpQ0/1P 		True
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\mpoa-.m4a 45.88 KB MD5: 2d116ab7cdcaa311cadda91799b6ba26
SHA1: 210471fcb71bedc63c40c46bde50abf9bea747eb
SHA256: d9d64d1b522b33e7f247ad835ac7ca152cb0b7ae271f4416a47d8fc404b8a784
SSDeep: 768:sjW1CwyAXGXCJC9hVtI6WT9EqFCVvSppsKJSXpeCh1SgxCzihZHr8MniPU1tgCXc:dCwyAlJC9hVS6ISSCVQq5D1TCzsZHgww 		True
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\ms8ez6n.docx 71.91 KB MD5: ae2ebea0a8ce5310cd4879399fc59d47
SHA1: b1a4351e0777cc0ead812360e6310c62ed1cd2bf
SHA256: 935d56e4505851ddbe9e658c6014f74b598ef397f197650c0d5d6d2f5371dded
SSDeep: 1536:Q93vU9Y5NdghZjMoLb1bvWTPyBUPSxLTD3ArNmSBIIwFfXdw0ni8+M:c32K3gzMs1bvWTK+ObQNxavvdw0R+M 		True
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\omts.bmp 13.78 KB MD5: 822589b30a818302b7c648245b48a1b6
SHA1: 00b72d4cd8546ca7ab55bbf33d64f50ed6e5347d
SHA256: 4b2861138a8d44395894345e23ad41e1669d834f6030adc910a4df8bf604e07a
SSDeep: 384:ovB3LZ9eVAjyTrVFZyq/MCudfzmuw/wLdruhW7wIZYYDg:ovBzMfrwIjux1w/wLdKM7FTs 		True
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\qg9fuzdvmpex.docx 67.24 KB MD5: 6f62e1a0cffa6cf05d0d2b2f95debe4f
SHA1: bd20afdfb990e54520d3812d0d859ffe6ccf9a3f
SHA256: 95bc31dfd0cbe1d2f521bd635a63f1933307eaac87096f475137a60329c15312
SSDeep: 1536:PxicMsJsZDy3uy0i6E4PKclk9YQlqQK2Jd6qkJKvc:0TK/PMvk9YQIGd63JKvc 		True
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\qgba8xp0yphpg.wav 50.75 KB MD5: c3bc3b92500aae3dd605f0a11d80acda
SHA1: d42616903bf85d6e36a55ddc5b4e612f089227e3
SHA256: 5b4e67ed3847bd4b8ded6b7ef27ed155cf8a178681d0f3fa420eeeb38fbd3f04
SSDeep: 1536:ZKXGMm+ih54sgN9oi+HeqOYm1n/Nor7sDAiny6bYlqfshKpvoc:0W8ih54ZNn+Sh1nVSeSqZpvoc 		True
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\sd82f9b.ods 7.99 KB MD5: de5705196253781587140be332b95678
SHA1: 37790d08522081c8fc0472b559b7f6d7f12e36cf
SHA256: 31971df7a453c1a2d9c49496fd68fd41ea620b0f212f7cc82693779d44886f27
SSDeep: 192:2E/LXUEiKp0F2TPdxcdSceQ0TUgxpjBeYlQhA3fmZGPrFf:LXUEiTYPd6dvq9xpj8EvfmZCRf 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\hViKCLPrU.gif.RYK 75.19 KB MD5: 9f9923d36e893889910867c407e360d9
SHA1: c8bdb6155070ecf5b1dfbd7e79db69337ea2ca4e
SHA256: 400d44c3b65d87f0016eda4db3bcd45610e5ed30a62c68667d6b76c9ebf17070
SSDeep: 1536:v+CvITUPbN2fM9197MzlkrYY+ZYhZEf8Q5WG87jrhAEe+nwd6t8PdtYiJcWS:vzwTUP0M397KY+Z4e0G87Pmgw2mdDJ0 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AhKC9lHcLc.m4a.RYK 89.17 KB MD5: c55e86b8222b100524c3e9fbdb965212
SHA1: 7abbf0b883470349efe9efcdb45776c008126060
SHA256: 16d2e0d09df67fea9cd3116bde10eb193c7f8a095dbb8e7bed6b3204e3a58bf8
SSDeep: 1536:rOeSy7M4+z6nKcvru4uh+xo3btc2uehaOe3Hzb3VrubYTC+hHj9uBx6DJ:8eM4ucvihTRvtelubOPhHj9MgJ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ldLFid8fGd2Cz6.bmp.RYK 22.19 KB MD5: 49166e60174564c86b809add5b87e760
SHA1: e315debc974d2d6445b3657b9ae76e2fdb261f76
SHA256: 6bf3c2209603b3c882510fcb118d56442f7844669192034a2256b98066e498e0
SSDeep: 384:PaeBESYIa6DIkSwhr1Yyw7/+XcqYF3in+cYsB0rDWTdeM0JboegstsVb:PaeKSYZk9+rQ0F3I+MB0X+wJbjgsE 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\kmb QJZmXmJi_.m4a.RYK 23.89 KB MD5: b2777feb34fe78d53c2aa96ec662612b
SHA1: b76303d83a7fe1649ebdec66e4daecdb86f0beb1
SHA256: b5408531b24ded2303462f627cdbc90dea904a00a7db2ff6989f4a3f965cc56c
SSDeep: 384:Hnq5GBAndKKOPWH8y+/cbM6HUSxeOWTfWQvi/Liwz5PA02p8XvBuwk2W51:HhAUKi8xMcI6HxeGLgKG3 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\j4n6VZ.png.RYK 63.78 KB MD5: 8c467a59e75283c1aa9d05cb702ef8a6
SHA1: 789f936c7aad881a65538764c9e0c1d78cb58e9c
SHA256: cb65e281c57b0371aebaa0e1660f07bddea67d43161d518fa526a2eec59626dc
SSDeep: 1536:yOsS2GkYR9E6v1DQBVHb9EBiuj8ypJQPYwFuRkJ3EkNwy6GbeMi:dA69F1cVpuAySAeJ0gwKbti 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\w5mAGJ1Y.bmp.RYK 52.49 KB MD5: 2424d58def03e1a949dd09a1935cd727
SHA1: 0ddd658dd2560f09f0afaacd45eaa00595ab7f2d
SHA256: 8688848aba47d452539f052bc21cd1e3d7bede98e68ef518ced44540035360d1
SSDeep: 1536:bUOvLyy45DC8dYimuimAPcA/hpUfDFi6nHWcV:bZvLdzxiPiv//SFnnHWcV 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\U8XmBQFiP7PLq9.wav.RYK 94.85 KB MD5: 88aecbcbece54d3757b0fb1039128c2b
SHA1: 9fa735147795458d34f07903d362a602b24db2e8
SHA256: 00b7395fb6ce1f388159bdc56127810dfd090f46ce484f5f6ab77523a307da1d
SSDeep: 1536:GRvzUHniIFLDWVrXOiO/fHh5aWOjhvHVl0a/IQgydPQ3on+4YH:QvzCniIxkO/fHT4vHnLdPQ3oU 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AdobeARM.log.RYK 1.02 KB MD5: 7ca768b3a81500014da192b322e31c47
SHA1: 03cd2885849793b01e852855905084d01d187460
SHA256: f2a058dbd1a02063fe0ca88348ebbec986ebb799d6eb37edf64a39cdd594058f
SSDeep: 24:92zu27Pf7wIDuu3SlliBwx2iHNsFpwS5ZZeidrsbjs+NZaQai+lR0lxan:IzL7f7wILSllio2iteGqZtsbBaq+T 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WTSuSWDiNChTS.ppt.RYK 79.72 KB MD5: bb2adf6a28e6ba8991e2964c4d08bac1
SHA1: 3afaccb2d2acf7184f38cf8fc2ae00ee27372e90
SHA256: 1a6e3e00dcec3bb9cb0b5d11cceab3f2454c75c1849b7e9d9ec253890958a67a
SSDeep: 1536:bkQVxiHQ7pmMB/62Pou/oM65p1/TMEhhUrvf9Yb3eE2MoA3VnakelUyDlVA4P:AwbByugxniEbUe2NA3sdUYh 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\x850.png.RYK 49.03 KB MD5: 92fc363a9b53772955a74c3c9858ccfb
SHA1: 59e129ecd504cba9821cf67de3ccd933de2db51d
SHA256: 9488df257f76dd0fa166ecc0a26971d90eecf4abb97fd99f029b242220e40f48
SSDeep: 1536:QJAUbxKhE6pJgJQQGucTwSa4ivBCMEm0H:UxElMDJcTja4ivIMcH 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ZpuiP.xls.RYK 79.56 KB MD5: 83ff91519ca581338537ef6042c57c5f
SHA1: 8713a5577d2aa6993311febf6d25a8a60d7d46d7
SHA256: 1777fba6fca54ef6ae4026851064f07e13e4c46228129ea3b94b8fc3be49db9b
SSDeep: 1536:D6F2eXwiNiVbNPBDPfke6aZR+OyMNpVhYsyD/EHoBQczukwaJGYQk8OPqabxWubP:D82egTTBzf/NyF8o2suwIOPt3P 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\index.dat.RYK 32.28 KB MD5: bed430d932388aeeb4a06c7b481f2687
SHA1: 2f37489b38acf7f80fa730af7e197978f2985e6e
SHA256: bf62a04f8478d342901919c09773f34a828dd80cc79cee8f18a8922ddfbc7997
SSDeep: 768:Osp1CENmsbAFrvQCCH7MKmyN/Ve+Uf/4oafsTxFiOf9OKS:l/ksMFrvsbMKmkI+e4oafrOf9OX 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK 6.78 KB MD5: 4edfb455b91e4a4935fd9832a7d1af8e
SHA1: 8347727b46384d6727927bf265544d3492358e38
SHA256: 1f1a75a9f8e29e8d0fdff61fef5ea3269f4452ff425a14553c013442224fed39
SSDeep: 192:zgp5qwASl5dkvvdaXSWBapDYWcipSYgwEi:chA0dkwiW8t1cioYgwEi 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FORMS\FRMCACHE.DAT.RYK 240.49 KB MD5: 17d37ecfbf33f61a60caf568edaf352f
SHA1: 45c656f609f3a408cbc8a8a48b46b79cdfdbb2f0
SHA256: 4dc246fa0a4835a304f5595a29c1b342dac3bab4e0cab450972468b4dcc3993b
SSDeep: 6144:YTM3NwEwX9G6i0VDIWEAaPtrm12cY9+zKylGMRcc:YT25wNG6i0LwBcY9KvlG1c 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\index.dat.RYK 32.28 KB MD5: 1925e48ef9d6d44e248fd1214ed3f94d
SHA1: e159de24e3a380572c2d60d288131aff3eca450d
SHA256: fc69895a5baf69fd1867390b177f98c7430fa32fc58a69a3d18518d6a6f9e445
SSDeep: 768:t8EiFSZWf9XladMhPlPBEcZalH/g+lbanV+uaYcV9uggX1Ot9O:t6FZ91BLPBnglMPXqbO 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.bak.RYK 12.19 KB MD5: 3e624ecd6737da73e5f46fda284768c5
SHA1: 3506a87dc8811744a83a247dd7329d720d6cdbd9
SHA256: df6bc3f1811a6b29de20c6732ef65d913a56ab3cdc5260444898bf5906477166
SSDeep: 384:1q3jrUN5b14yoEznAFCrWf8otPtIEZ6+Lq:I3jr4oyo4AESf7t1z2 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb.RYK 68.38 KB MD5: 7a186ff4b5b4ba9515d43ff41735d7a5
SHA1: c615de7ddff4ae7ef49de3fe767fde333e2eeff1
SHA256: 51b626e79a322496ef7d13a01adcfb4f4c1b050cd2a54eac64993b6c0b8b1db6
SSDeep: 1536:DQyCD1TLvMraChYQmwjIWy4u0eVBkfrCM8VMxRu:DTI1P0ra2YQmwjjtnh85 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.RYK 12.21 KB MD5: 1439051625e2f381c566dca9538e347a
SHA1: 98cd06f7641470688d86a402247beba68f4a0e9b
SHA256: 65123d493af9dde1546f7d9ddbec9163488e984f8ccccff97600728f4e08fe24
SSDeep: 192:5vrCkCVDtb4k+piYpcGuTXs5yRzEUtent7tTfJI4rfVtwTjvcBQguQGzl:5uzVDtb4k+DcDhhtenhhHVtwksl 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT.RYK 16.28 KB MD5: 2b74ab661b6d161a13b7c2f2932c5a3e
SHA1: 020674bbbab7cb64dad88fde1aac942b0d0498cd
SHA256: cb6ddf87a2baee9cf5ea8ad23b95677ebcd294889a50093800d9348fb747d0f1
SSDeep: 384:B8HlnJzFnj4f/Ros912vcuC353oqr15SrKZ8H5ALOPu:8ZJzBj4f9SvBC353oO77Z8OLP 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\mapisvc.inf.RYK 1.38 KB MD5: e69163ea59e8fc1f798c7a112752af42
SHA1: bbb09012602041482617ba7709deb4e3c4b9dbbf
SHA256: b770aa0a7768a97a8b4e63ac6ba6d6fc56409df344d0739ae00383e7f70f4b76
SSDeep: 24:jYO1ZXfZRriQE4YWoF9IEysLv4F+zdYaT+5YQL90U23TZlpe8QQrfj4OrQYqrkWu:jYOP3zE4YZQ6vXzWaL4sTZlQEfj4OrlJ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\Outlook.sharing.xml.obi.RYK 466 bytes MD5: 9f481fec248a82644d278671a2cebfd2
SHA1: 254e65d04595a720c40a5412fefea7c72fe39237
SHA256: 02b1eb1fa07687125b2cb82c4b4bfc7830c6b32e5b56fa4e9b9a72406c49c996
SSDeep: 12:xk85Zq/FEEvX/svMa21lqVmlhAa7lgJ4L/f5:xk8WkUNq84b4N 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\content14.dat.RYK 99.50 KB MD5: ec0fe8f95eb59450d44bf4bd9f5107e0
SHA1: 32437fd575dc9883406bc1c2efed519b3745a09f
SHA256: 1e2c252c0bcb137881d5da445cd9af119f5d85fe42c63306ab41bdf8e2911884
SSDeep: 3072:CI4QeZrauHyyvX8180JsKnT1fosmUIMmMwn:B49rXHdGfvnT1fosiR9n 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\thumbs.dat.RYK 125.28 KB MD5: 0a1937134f6040083c795b610ba42885
SHA1: 3547d03e948a85469308b074ef14781bcca9ef92
SHA256: 4b4c3dd1a75ccbeff51af1686d81e17e68f335438f12206b68294653edd0da6e
SSDeep: 3072:tDbNLMvArKrCbAzjr44WZ1CIZLa9DWMbu/wZ6YbAW:t/+4rtbATHmUWEuYIQAW 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.chk.RYK 8.28 KB MD5: c423e7e1ec1972514f22b510bb54f7ea
SHA1: a39c8cc08a1b3238e643d7bd0f948881eed0e320
SHA256: 905c13b123cc5ee2be0183ca43a33f44d8338fe516651f0f73fb8650a682f136
SSDeep: 192:rGqD78YtId+kVx+faLx3Km6MFqgxdMGiPwEkyEpJjk7u0ZadW8Xb+:iqcL+NfA3+MFqgsrPJ6pJY7Sr+ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\oeold.xml.RYK 546 bytes MD5: 3f0b6081c5fe53df3bb643377d0c819f
SHA1: 7a28448f98332e23cdd4e0f17691a5162cd6b7a5
SHA256: 56fd4245860c01a5ef9d5a28f628c93e262684e469c45457c1231f597557bcb7
SSDeep: 12:iGWsYGRffZ1zGLXkiaI8XLp4FzAPHronujpKqiA3LCgDmzlaQ:iGr3ffZ16D/O7RvVKqhCgDmzlaQ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.log.RYK 2.00 MB MD5: 2d8eba509f2c4d4f8b39512eaa28dfd4
SHA1: ed4ffe19e919dd7d8fbe58ca70d17bf4630e0d4a
SHA256: c9d0997dfe82f78c8ac056cf7639a75a1e1b886e5734636b19e0d266a45bf540
SSDeep: 49152:0ro92eoZAL13LIU+sgxQ13IsVLTcxIaLoMmnLvHouPedgA8qot:voZALJLIU+7xQ137TyI8NmcOedgA8Xt 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00002.jrs.RYK 2.00 MB MD5: 6517eb122dac72c55e562a5d905239d2
SHA1: 49e528c11029345e04cfc50102d99ab9846de602
SHA256: ab260a1b3f63aafb5c52a0cd2ffd88fb20faa464534d512a28794171d0196062
SSDeep: 49152:Kn5NwgXFZmMSmlsfDlX4Z4Uj/Al6NMLoAgPqXC+2CmqdPmk:KEgVZmMVwlAbj/CvCjp6Pmk 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00001.jrs.RYK 2.00 MB MD5: 8ed7c6abbe79e509157af477c3d30e14
SHA1: efe2fe27be20e2c351c08e8f707bd5f748c007dc
SHA256: 4685d7c5b51f223d3f0574b19beaef9f4bcb63f86770f7b3c96de4ac66dbb3e0
SSDeep: 49152:EYOvf+x5MVBDUNS6vtmy2mQIIBNbS0VD9t1uM:EXq5iDCTt12VxBlZVD97uM 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb00001.log.RYK 2.00 MB MD5: c260b7df7147d6caadd1211a6273b88f
SHA1: 0e17b6fab61e34fad54c4b2e310b9ffd212c3bf6
SHA256: ae6f01e57a834504ba036cd604ec855159b3ff79fdbd90e25b018117f046cfe7
SSDeep: 49152:GCLGdxn95oegPUXT6dKphmIylV33PHr2RXZqzO7:ELQUGdV/2KO7 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2iI83Xqu-SUm9ZsQ.docx.RYK 34.41 KB MD5: 66009655584467700287c5fa36c000a2
SHA1: e49423c99d3914b2915f8fb94c16f5106f9d1b71
SHA256: 558070cb1e9b4a035d1c879227d96a798ccf3847b411c5e400a3c22753c5760f
SSDeep: 768:kKTe/gtfCdDGcb8EY530e86+0Hy5gLqd1DyQu7gJ3al76lF:kGe4wgcLY5S6+yy6asQu7O3al7y 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8DDixiNZtZLaWeCmu7e.swf.RYK 98.52 KB MD5: 2492bbed52b09db57cc88a71e36e16bd
SHA1: d50c8acd5e6a96f7fc0d12c35f95927894aa6a4f
SHA256: 663dedca0e4530ec90837198c4299ab2e0db77f87bcb2a2adc121d2100ddd656
SSDeep: 1536:3T/zv3sgoq+RsURZQfCSWqWJSAeSUyanojcxyP+7yKeDW9CBdw9IrDqxSF:D4gX+WURiCSeSA1jIyPXcC/RrWxSF 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\WMSDKNS.DTD.RYK 786 bytes MD5: 93d2cfaae990b8f9db8ddf88106ebbd6
SHA1: 0563fd059a6c96266ce9d69d540319a8652c3af1
SHA256: a9dc9ac57b2bfe9c68d6482f879b46faab2434ef945ed5ece91d43d72643eb4e
SSDeep: 12:knxNArZzdMQdjAS2zLvFoGGgMyoJDA3MoHGzFDs/z+ug0Se+io4T1TjXb5N2Y:gNUl/jIqXyouMoa49v7XL 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\WMSDKNS.XML.RYK 10.22 KB MD5: d6cc99bccec80981845aee8f97b7b151
SHA1: f1663da3a75ea6cf3c0d32e9c10b6917ff9fde08
SHA256: b248921a9f320e3db792e0fcb4ddaf23a56d8f58705fb2441c46fab24952adde
SSDeep: 192:xo667fh2ENfcAWPKNRaiUqbyGpRTxERPWKSZT1/sa4PCyLZKGc7dQmbk:AJ2ENfcAWPZCRTaPWtZBsbPCMZKzhy 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\BtC5B7IXSKDZSJgLAe3.swf.RYK 69.06 KB MD5: 49987034a344de8059bf6e946438db53
SHA1: 31f9952dc1bd481ba8fd81da544ad4791bc6028b
SHA256: db286058be7bc0d29adbd0cc01219f7fbd14a0d9f0eb2e0202499866862e6bb3
SSDeep: 1536:4DTq9qxAsoyIHeWF1F7TkdTcq/fjcAoLhLTq2vLp7hm4EC0so+YzBvhDbW:Uq9yoHeA1F76T1/fFo5Tq8l7yTs2FbW 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\f6eDx z94Dzwz2K8sqE.pptx.RYK 93.13 KB MD5: 3694a101b73a5bdc021c84c6bebc53be
SHA1: 4c28d17557906b46ee47f77af73692eb85e6e68f
SHA256: 48bf6f84967a5ed5710110113ba7f855c291a02510d8a9607fe7dff1b8ff0738
SSDeep: 1536:iQz0NkaDb2yfAmJa5yWbpOCYdsBLegDJSU7JoeujUb7/Kh+nvlqXXgVJ7nxOM:eDb2LmJmXbpOCYdsBLJGob7OwqgVhxOM 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\gQXnrhLgWoJRH32GpKD.avi.RYK 70.97 KB MD5: d2ef10ad3fd9a191d651f9b865ff2832
SHA1: f5928044a32220dd90b1a97366a23eefcc96cb00
SHA256: 1402524c701fd9682db93003b818d181d56c437967fb8a63ea7bccdce62aa223
SSDeep: 1536:k6QWXBgBVj5ts1qe5LCz+xYMLSjkrZf7YLcu3tZ5lmNXCTKvA2h:FQWQtts1q+Lw+3Bf7W3bH7e9 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\History\History.IE5\index.dat.RYK 16.28 KB MD5: 07b9035099ab985fad74209f3be95a7f
SHA1: e40405841bf3f1bb4ed1fb8ed6583d3980fc1c38
SHA256: c589bef11e7df6394975b7972f961e2e807027c150e096d49c81d1307fad69b9
SSDeep: 384:MEl/oA9eV7YeTtyVD8a91iltS+8zFF5zxZRzifh4KdprAWCGOaboc:x/okc0maD8a9AX8zFFxsuQpEfab5 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\HSDnH8dTNYHVzPB_.doc.RYK 58.38 KB MD5: 056ba564ba48db52a89bad2d8c78f054
SHA1: 9ed9cf0eb161c9ed636e7591708d7b13ca420093
SHA256: 4a988140f3e8c3a5622999bca50e5e2bc8fac6c1028ded900fd621d49870dfb3
SSDeep: 1536:hGta2AtnzX4aPMCQgGyOefmvQHu67ufxW0AZxsECHuQMNtHJq:nxEaP0gGyZfmvVKIkCQNtHE 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\u9Pfn7XvaHQ8ByEI_piG.odp.RYK 42.41 KB MD5: a531f5b6c46105ae87b31663557b485c
SHA1: 24e32d07395fb8b738bd881a5ba862207a18c1ed
SHA256: ff1a77af4e67661a13cbaf503ef21ddf9726d54662bff36fd93e82d1fbe5b91e
SSDeep: 768:0VUCuichE78WVI3Lh9UUrhE2pAzOPgjkSUVXXDge/WwUQ2RxCFyygQtbCg:0BuVhS8AI3YUS2fgjDUpH0Q2nChxbH 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\uRfigoP5hgocNJCg6h.flvi.RYK.RYK 67.00 KB MD5: 2aca7ae2392b6bc9ca87be04d11b2837
SHA1: 3ec30e33aba5c37f126f629410755490e19b0cd6
SHA256: a294963f004bdd5c42c86231092a4d71d72a5e691eab53108ef49369254063ef
SSDeep: 1536:cdAOqdsE0q1KBAodDuPiqtJGjO4P5qPGqvRaWkFtsiPwXb:cdNqdadNliGO3eqmFteXb 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\MSIMGSIZ.DAT.RYK 16.28 KB MD5: 43cb36c968f832bbf43f0f1f2bb484fd
SHA1: 67fc256ebd542e19b96016ff0526d1724d0a2f18
SHA256: 0276b5fd8582c02a4eeb66986c6451e8887bf909ecb8fdda7c43a41cdf67154d
SSDeep: 384:rN2SkBqhxfuY0b/SYbwCcui2OwWon7QiRW61OQn:rjkBKfW9wCcuHn7QiA61OQn 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\MSHist012017071220170713\index.dat.RYK 32.28 KB MD5: bd5e17164397a4af58f3029138c27546
SHA1: b8c250d91f3de15531296a6483f9b8d18facf793
SHA256: a3797d9966a05d392df09122cd7973bb41015d726c91c9fb61d63a7bdd04fd35
SSDeep: 768:PGmrjpYBdFrLllpU3g/UvxMVvH2tjliGFeDdaWUkeWzBMxG:PurLlWg85MVvH2VeJrUrWyG 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.RYK 28.28 KB MD5: a699601512014e54c81fd898331ff09b
SHA1: 03229b8ee915e2ffffcf66f11fa16cf293f70961
SHA256: d2f0649487d325f54d7fdc5caba3e74af9c29d8e67b4f2c47dc620a52907a1d2
SSDeep: 384:A5pOgJ/XSZxSVVqYwiiEgV7eTCI4SW432hUxv1nnLuLVAi53IbJoQginLej:A5ggJP8EV8ti4eOYW/UxNnLIAi9OO+ij 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\index.dat.RYK 32.28 KB MD5: 22e4eae98a08587a34a468e7860a1757
SHA1: 16c8a71af834f97ebf8f299117888998c3658305
SHA256: 4b0026ae7c17dd556c3c1041e54ed3f2c9820e0678ffbe5e7aa807fbe9e736d4
SSDeep: 768:WyfwbCwZDkngXdJwDDESRajNZPA+vRYVWWEjqngXqKP4gz0:YfkgHwDDeHPAsGcW5eg 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\frameiconcache.dat.RYK 9.27 KB MD5: 243011db5f08c8add74d9011cc75c2f4
SHA1: b4a769fb4050e2c0cbbec7bc3f491e3d074277a3
SHA256: 203ff68079d4091767dfe0d671054b367e315d62d89ad8e813c2c90588d677cf
SSDeep: 192:2fXsxj9JtDNyhXKIW7Ku3UMOOk7KWM2VGhwHWfDHugpqdjZNeA1Z8e:KwtDNyhNukMJUKWkhOADORd9YA4e 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\CurrentDatabase_372.wmdb.RYK 1.02 MB MD5: e9f48686c99201660bfa3d7e447459d3
SHA1: 725517e32eea48e31ebff60340b81ba97493b96c
SHA256: efa601633aee17b7390e0e042dcf9031b9035f5aa8c46d2ad7d8f669eeab8477
SSDeep: 24576:iuMcV6oz8U7p/3NeF4gEFHGjIXesubPr0lWNhh9Uwb5999j:QCnFp/3NeugEFNebaWNhhKwFZj 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF.RYK 402 bytes MD5: 2f76041d552dd337c397bade73d56ac7
SHA1: 5da52e1c802383286f78fd2d1a75f3a35a59fa3b
SHA256: ff5f22b232e89385ce368f33bff7ecedbe7aabec9f017b1c45d4bbdb76ec1c40
SSDeep: 6:/k6ormLv12N1Y+BKKu2/otGnm5i/2L/ybx+edI37WA01nQm+g3ipUadEqNnQ6CxF:CmT12NK+BjwtGnI7l3a11+g3iqW4F 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD.RYK 128.28 KB MD5: 5ada192f8cac623abf58383c5d5bebed
SHA1: 7e5c6a99dbead27d867b63a7bad0e009d8afe01f
SHA256: ac17291a9198109c4408e6dafbe56cb2000401089595a8b01bc60009137ba0b8
SSDeep: 3072:B0+/iqYt4ecPJ7ddq+/9x5NEHnrURVz40MImQvwl7zzD:B0hoR7ddqQirK4QmyYz 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.htm.RYK 530 bytes MD5: 76572a0dbcb9caa267183041b5ca1967
SHA1: c0b1d066f9ac6b09374c8c07db98b5c6e439512b
SHA256: 8b331a22fb94f541886b90842fc7f081ff7502201a7e82c2e5329d2c98d8d0a8
SSDeep: 12:Dy/e9r8v6LqZ1/pkygMeStKiDtqaQOGcON1jOfA38J8ctt:Wm9S6W1KyHeeKiDtqVOwxOfA3m8cP 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\WindowsMail.pat.RYK 16.28 KB MD5: 6c3d0b250eecfe54b8e5dd02e92ff282
SHA1: 1dad178f15d9a0dea3ce98e0c33f5560085831fd
SHA256: 991b8a77dba075f2cc32997a7176763e93ad1a6bc18beb9c419b5e13cc1e263d
SSDeep: 384:2+IAGK6pjHtjVqJsyNcwOHSUNX1sugimV5ly7kEHggPpYJ4L:BIH5Z00yHimJ2LYyL 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\edb00001.log.RYK 2.00 MB MD5: 65b4900f57f601960ea0d8eb7b118a77
SHA1: da807ed4e53126ade2d136939856f5bcb1b2773a
SHA256: ef806c10b2f361794933246db05397d420f61adfe3cf4b8af326a684303280da
SSDeep: 49152:IkX4wrHgtSLIsZtjTZNSOD6epA/NSLDX70XI:IkXDrAsrNhD6WGwDr04 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Shades of Blue.htm.RYK 514 bytes MD5: a29756895c057c6aa929fca6b2417d4b
SHA1: 928e63b51389d24613e86d40159ddf7123824acc
SHA256: 0b0b25ea9b4f839b44deb399c95ab1ec85dbd8ddda61accc946f92f207fa7cc0
SSDeep: 12:WY2Sm2Msq0NwGBdzY9wR42jaVDKUr8odZjKF1WbiLaEUFr:Z79TbNwGBduw1i9rR9RnEQ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.RYK 4.89 KB MD5: 02e84fed587ed9ab0ab03b31c5d67596
SHA1: 5707b9d524e1601ed5698b8fc0e472ffd8b48d86
SHA256: 212794b1a9764821965c979853fd408e4733ede9643622416a4f478658340f22
SSDeep: 96:azDiCGkMXb34W3I/Aih3zq4e22agvNe0c1WxNlBzzXr1WomGc:azDi9b34slqDq4Qe0+GlBPXxWd 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.jpg.RYK 1.33 KB MD5: 19ec90f3be1e2a7b297f33ffaae1c844
SHA1: f23dcbbd43e3e3ce3a2be2b268a824aa76d39f8c
SHA256: 6b2aac1156e1d826c57c3345974479c2808b825937dedd1ddbc771228c7e627f
SSDeep: 24:+DDpBx/D+FdzsTH1o8QEZI4AP/u3+yVMwN4Bp93OUOC7DqtQqbLG/cMkB:6D+FIHWE24AXEPVMwN41OK7DqI2 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.RYK 6.50 KB MD5: 6ad7ee83a993a4cfe2efc69b5659f838
SHA1: a3f3a501741aaa4c012bc859ebb77ac89363f752
SHA256: eae3828ec2e4b6fd4b975c22bed6261fdf4bc4d3201a66610f98512468acffc3
SSDeep: 192:wprOlcCRjsiNUzVIbEEQVDV8abfnw3DX54bbRfsww4:wIlB0+bElhfsAbREwb 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\HandPrints.jpg.RYK 4.39 KB MD5: 92a49b0f0c9b38b4db591004598255ac
SHA1: cd789f7fcd28a3e45fa9b31cb83ff8da76510908
SHA256: 198f1973d8f29892baabbbf6281ed6a66aa9bccf0ab4ef431d08d22f317dc4fd
SSDeep: 96:1TtSb8CbD4FDVdM+xpNeJ6d5JVIXakxsg23T7Dhhp:1egtpN66dVIX+gqbhhp 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Hand Prints.htm.RYK 514 bytes MD5: 4f0e15e0a38a6a469cee8c8d185bb5af
SHA1: 5762df8e9248bd8e20fac64878387a1e8ee9d3a1
SHA256: f9d57040d129713b234f80303ff4c11c35202015711a6471b4ed20c0b7eeb73d
SSDeep: 12:u39TK5mvyHWLi145PmfUph9BRJeo/kcyiznoEWLZbDW:u3Q5NHW2OFmfs9Io/mid6i 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Green Bubbles.htm.RYK 514 bytes MD5: bf25e4e8a7732cd7d11228c09538d00e
SHA1: 6820d4248600632bf6aed99ccf963a02cacd769a
SHA256: 5f96d6d339917e14d7a8c0b0bfd6553dffb820aadb9441cd02da5a98d8f748a0
SSDeep: 12:wHcFDsnTxDVwK03/peOU/A3jDU6qrCgz27OGjgkyGTwkMAJIig:yMsnTxDVwKypeOU/ATPUy7OG8kyGIAJg 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.RYK 6.53 KB MD5: 81d370e0fe7aea28d957965f3d8368d2
SHA1: bd00b3a12d20cc48071d89ad587fce13aac77ade
SHA256: cb6589f1f6a79e78300b1b62425ae4e644e9df2c5057849e46c20904e5bbe890
SSDeep: 192:6K4zLJrcsHo7i8gmnusNl/oEiTfx1ODvbaqIPgaE1:6KYC2oxgmnL4LT7ODvJ1 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Garden.jpg.RYK 23.58 KB MD5: 08562584fd31fd4ccde389b3f98bc5ac
SHA1: a9700074199e1c39c7997781627d392b28f3a183
SHA256: 6d03b7c6c44a151e2d5630c7415e6e5d0821d7d40202451ad974a39cf8bf222b
SSDeep: 384:VeBRygptM6uci9/JQeZmWf3ZyRYwTgPGDyaRiPXWgWygjoIOcK8ue3QeSOb/jrgT:VyywtvMbPEqcHDya6mvy0oIY8d/bU 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Orange Circles.htm.RYK 514 bytes MD5: 9ba891c718b08c0089f18b99533dc807
SHA1: 60503a5c483de5debb9c3d044460922e9132bc98
SHA256: c703463627437ea8c4d8b23d25d44c740eb1515c7a4e3110fd4f2d900a707def
SSDeep: 12:OIgprXa2EM6KLwwiuiMrVoUZcPp6wlwc9W:Ox07MLhqUuwc9W 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Peacock.jpg.RYK 5.27 KB MD5: 9e56205e3d5e4a48534efba67ff7d0a4
SHA1: 20ab11aaf093b644f6dac46bb1e11d91f554bb53
SHA256: dea5248dc49dea5701231f7980c139355fb868ea4abf3c77cf5945e4c85736cf
SSDeep: 96:iHyVYqahW9lE8pm7czrQQkT8J03F3jhLc2Qxow4AR1nWBRrFW6rdqyuE8:FVW49lE8M7HwyThI2Qew4ZRrF2 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Peacock.htm.RYK 514 bytes MD5: d4700d671e713124e8a867cebe8ba5be
SHA1: 63cd678a074f1e9f03f9862c2a18709702fa96f1
SHA256: 7c391c6223da0e91098f8671ebe3e65574ddef1cbf03b393552000b536bd25ca
SSDeep: 12:6Os4h13I6v53RKx3uaKPW5HtoS7baEAO3X2C:6OsONIKCwW5HtRqRC 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.htm.RYK 514 bytes MD5: 418c8904e6867501e719bf8165c20561
SHA1: 4164b43af6b9d55f29bd66cb551c1dd21bbfb255
SHA256: 6db4701dd60802d7c43a5127f7bc41b966bb89f417ce6b53104029d2a862de93
SSDeep: 12:sljmfh9aYL1bM8nlf7PtjnvTCc1KbCnFQG4:EjAhwWyof7PtDvTgbA+ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.jpg.RYK 2.16 KB MD5: d1211ae970219aff1e2630e826a18aa8
SHA1: 9d6b797cb281a55f7b46416116cf21e5f0197e6c
SHA256: 60812e4bfb61b00ef45863d399ed7160d9c2d46eccf91f2d4011bc5f7e6b115f
SSDeep: 48:R/F+yTuF22z/014qswP++Oo1CgLghRkSk0XI8GAjRLEMoh0:u4i2kc1hB+G1CgLgYf048BLL 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.htm.RYK 514 bytes MD5: 53a80a4fc7a5583571f5a590ad76a523
SHA1: 2115d9355f37a53e1a1950ba9d9d7aa15627632c
SHA256: b884ee34c58dc3a0e0d462963668a99c37d849197946f437df5de51d388323e3
SSDeep: 12:M+YoUZOS0rLfyp8rYkfST5MDdZr4p05jU2rre4CNc7:bYhZOS0HfymffW5+/rMsU2rKlE 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.jpgF9B.ods.RYK.RYK 7.61 KB MD5: 2f4d92b64e467d938b7000d7e725f58a
SHA1: bb4f0028f7cc4dd7978375a09438daa3cb4d73a2
SHA256: 9d72d8beecbe607b9b5930b6657c7883c343e211070f2432715e30a1fc54180c
SSDeep: 192:bP1grOprArkCb2lHvmPMCXVICYssSjlKcUX:zlprRCb2hRC3nlKr 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.RYK 10.60 KB MD5: 7acb6abc25f863a6f7099529bf1e91c7
SHA1: 932b0b1c060717a203f0a3d14ea74adfa6974456
SHA256: e21b296eeff7d05dd461f5f5e20f932de127cf4dd873987233b461ae6b183cce
SSDeep: 192:+m4M9xfx/EcdEAdEVF7RB/8z+o5U24YN1eK9wBVgJwEDd96fk4rUWzG:Q9ca7RNU5R3jpKBVgOod92k4rjzG 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\WindowsMail.MSMessageStore.RYK 2.02 MB MD5: 649fb9018557646e48d7466fe0cc51e7
SHA1: 6842bf710d7e90d81ff6606785ef5d1e486c6207
SHA256: d1221c1a263f939fa3ef93ad2e4a7eb0b7c2697b325f22455ac893aae8504572
SSDeep: 49152:SwOBRf7rl2DNsS09IQfc6P2nuPihNhYNM+t79HV5PuFnY3vioHRtPUco:JOBRfUDNN4cmINWM+t7VVduFsHRw 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Soft Blue.htm.RYK 514 bytes MD5: f9fcd93f231cfeb5b90e75446e79eff8
SHA1: f63197ffebd31a4225f88b7b0194a58c7dd8ed8e
SHA256: d31840219a1860fc3f2dcf808442d1a43f88a37c1ae8cd6ea80d519d7ec1fc46
SSDeep: 12:MS/YIDKNLfCB4tAh6SRKXGkR0nvjognDUZ5RFJZebo:r7KNLqoSRCcs19g8 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Garden.htm.RYK 514 bytes MD5: 2dcc5a79092fa82a2519d8da046c1d7a
SHA1: c5a930eb513650a76aee8fef179113ba335f4ed7
SHA256: 77201c794bc3e99c8b8c892610bf1402e6d8bcaf85502ac6ba3aea70ebf200b8
SSDeep: 12:YlRU3HYjngzwda9xyAWeVnEze1PfyPYl8VgIWp6MH6:YYHYD0oa9PtnEzAKPhVGp6Ma 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Temporary Internet Files\Content.IE5\index.dat.RYK 32.28 KB MD5: 7c71b9a215ccfbf07c1d08d332813507
SHA1: e2af94f28bdb78955831f01a2c9a9c5f28cb3133
SHA256: 9b55094a9fb254ff7f4cf32ad861d197013d1ac8f8f1a82cf82c9615e4054c78
SSDeep: 768:PqbmdFby9yc+6Jlpnm8QwTJMU7VsFlnEgPz6:PPhy09GFpvCaVs7z6 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\js[1].RYK 1.22 KB MD5: a0ac39186cdeb02b2e726cf09939be62
SHA1: 501b6dbc2b1ea94ee3bafd54eeed919fcb7fa48c
SHA256: 0ed1421e5f40e450d9cdee3689d5bdf919b0124627fa8c502fcf01d4331970b3
SSDeep: 24:O4Z2QxiyuY8kPQeua+7xzLfFIJMuBRbSX9dV9gub9utQp9UOaHZSj6+i:hsANElLfwBRQV9gubCzZD 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[4].RYK 11.69 KB MD5: 2effcc6f2d6181cce561075f92d3a220
SHA1: afef1c4b958c94aba1ebc854e37e224b5bccc148
SHA256: 5394026c0b4041d10b2b9c4ed3cb345eecfba61b2db9061b78aad47bf87d821e
SSDeep: 192:pZxNqIynOCVHuqKt39IWGOGu8m7m8BArVl+S7Lv2AmAG25+8B66yHVV4OKRwSPTR:1c5k37Gm8mS9D+S/vlbG25+BRVVzfSFH 		True
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my\index[1].htm 45.97 KB MD5: d25ddb3e339a2afe80cf91f88a0d0760
SHA1: 94326843a0471f24fe53bf69130c928ccd6b5fcb
SHA256: 912e165213bb83a2a8c1b6fc8da04be0722bd5e1da46f1d8f7350b4898e6b138
SSDeep: 768:5/UnxqsbMaR/9NwgakjWbajOfeu1zU58AnMxNjQTNnB+B917+wDoerXlJf2:5/Un0sh/rwgVK+yTNjQTNB+BH7+wXLlQ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\f[1].txt.RYK 13.47 KB MD5: 7e585b7ef6e222db8e68c8750e4a514e
SHA1: f3c710de6ca288a5acd57a15385ab4bda8981c0b
SHA256: d661a6a1d89f0a23406ad3c74e30fb043655799bfca5017e1f0e77d732176dfc
SSDeep: 384:S4DkaFXq9iGIZT3wxGbUEpSEj9lrdrxtTHS:nkbMuAUEpSUfBS 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[3].RYK 12.19 KB MD5: ec078a1a45415597f7ebf5928f49f78c
SHA1: e953a41b102e4e916a880c9e02558e886aca8202
SHA256: e2e5c510f1101a6085fe2b55fc8ce8d4c411019a12fcecc99d1f9a1448d00910
SSDeep: 384:tjOcXi6uxSGDLkri6Rcro1wfsKtRvajwin:JvXi6ucGDLk1RcsYajN 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[2].RYK 11.56 KB MD5: 180e222f2ba1f0c66c17bef24f77e3b3
SHA1: 52825690daa4605a1a25fb29452f1fa92ce2ba63
SHA256: 552553b662d78c1f7910e99b01b42ae095f80d58d328703428fdc104cf39496a
SSDeep: 192:U3d2qfZxNnJVl8R6GhiJssIvg1aZ0LjP4jIOLoOTI2M+tDDbLnPFRG26JsUPzN:mfR/3t+o1g0vkIRqI7WDb7FRP6KULN 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\v2[1].RYK 11.74 KB MD5: 89b3dd27e20d2dffb858982bfb446c02
SHA1: 44ed8d8581a2de56e845f3726dd6b4e0e83b38f9
SHA256: 462de510835e316635ac9df28ee02e580835359954cac90c8806c32f8d6b0cdc
SSDeep: 192:kINH+8aol5dC0Rc9bvdG5OcoxQaCWA47uIZx6yjOTUYlXokmluVeZwAT+fOM9uiI:xefol5djROb10oi16/6RQYlXoRVaA/l1 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\ga[1].js.RYK 42.35 KB MD5: aedbfb62efc3c3a90eeba3ceced2963d
SHA1: 0ed017d4441adb85b02ba18e539a7ac6b4c21a2d
SHA256: 8c50de02ec32aeeaa14c63b428a34adf5a871a11431730eeb24f652e77675ec0
SSDeep: 768:OGWJ3HNpCdO+Re7g3sqvjMyi3TYcHQpeA66Y+SrhEShDN3fOIn+99p:mjCI+RepxHcDk6S73fq9p 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\js[1].RYK 1.47 KB MD5: d7e739f1f651a25283acb4e90011ba30
SHA1: 9a3f0a851b487c02334ff845dd0a0c3aeb0bf36c
SHA256: ea7f35b232d071b4960bd32e53b2572b05aad5bab6e792412a363c84bfc5668a
SSDeep: 24:LmwZQGRk9ZzgOm4XHGWc8hR/7n81fBb2DaBYgQqiepOCyY7EKJRFrIK:9ZQl2AXL7b/7n80KY9qie8C5EK 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\js[2].RYK 1.63 KB MD5: 77857f4ed612478722a85b6cb49e0cab
SHA1: 41797ba06efd8ba699b8f3364aaf4b0a62eb794e
SHA256: 3c279b3e68f0bdfaaf7550d705ae04382d5d210d1b5335c64dcde7aa298814a8
SSDeep: 48:5EPAwr6xqSJvbDuclyJYmTrNugTu52JYEEGz9TXHRly8:YB+N5KclgxTBuhUJYuFHjB 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\index.dat.RYK 336.28 KB MD5: 9a7d4f9782df852b5fabfa8ae31efafc
SHA1: fbda1951c825d16ce7ba710231be26e82eb7f7b4
SHA256: 134eb447e3c18ce43f863ce096588cb134b1e2a57d1b574b0eadb583699b4caf
SSDeep: 6144:puEeCMBUJEbGbJKEqfkfnPEVcfy78nUzfqWHlSAhhSX81wek9Zoi7RR/g82l1VMN:pZEbsKEffngcfS8naXFSA7IMDk9ZzN13 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\js[1].RYK 1.46 KB MD5: f22db2e3d292e98032d50c157f1a270f
SHA1: f943d6525d8a9ffe7280fbcfe477f54f7e0a5822
SHA256: fe8352b07fedae2ae7853c079df2b58ade4365c1020460ce9281bd02012c3206
SSDeep: 24:P7AXw0gQIMjvEhOsx8n+lCfaL1eqvrmeR8FRC7Qz/ztlbYl+QxJ/Ddf:Pcg0DIMbSOsx8cWqvvRb6tlb8+QLDp 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\js[2].RYK 1.22 KB MD5: f202ffa15f4d17e79ac6f13f961fd87d
SHA1: 7d1eadce7abd2dfdeeb68f9c2fa4f372fd0b4df3
SHA256: 4a9c4a4625f9471797b38013280ed9f0a6fb1d9b1a00aedf2bfc9bf695bbcb84
SSDeep: 24:BcEFNehPSBP/JDSCKxrmsoUmuMf0u6qDUzD3V0HsgDEVwU9KICC:BShqZ5J0rLoUSsKS3VmEfKvC 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\v2[1].RYK 13.06 KB MD5: 8c73bc5b37498209838cf139ef1ae5b0
SHA1: 17c5a8e57a16db9869d60472b6531251ba909fbf
SHA256: b7d17e0a7a998df49a7a1ce4aea3ad24767db0ab84531076ab13e8793681e2b7
SSDeep: 384:lNKqmXMjEJU5CjVYRRs47GF92p+VWmvN0ZRz:DKIjEJU5CGTs47EVFIx 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms.RYK 28.28 KB MD5: 43a5b0c69434bc58d865833f4748bc2c
SHA1: 673ddb9bbb09699a81ac6908fac3dc54e1b7fd3b
SHA256: 8734eb91c20f53f5e26771e98ea2c2d56b07e32ae6fff25518b0ab1507e794d4
SSDeep: 384:l/fxl4T6FI59APUXk6Qlq/u8LvIp3xUwJfh0v6Lj4PDy0JNTK9t7isQKlhfTvCls:lXDFKZQURLGxpyCn4Oo83iVOfTalVjhA 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms.RYK 28.28 KB MD5: 1f8490936ab5d30b1a03979a32c9268e
SHA1: 2ae1989c7367346d84440ed841748bf1d91e2657
SHA256: 544a2eaef79475e991fac18d181540cd3783504eb92eb0c332cdebafbb7f4756
SSDeep: 768:QJAWK187fA5Jrwwago3Z/wMyHN1e46JZYnc/UTz:JW3UItguFwMeePHR/UTz 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\11_All_Pictures.wpl.RYK 866 bytes MD5: 9e7adfa44282beb98ff295b99f211050
SHA1: 1a4c1fb8ae4c41954bfadf61ec99ede501d3f410
SHA256: 077f6b6d7ac165dbe811550cc871ac3dc61f953a78bfcb7895eecf378b7233d3
SSDeep: 12:80RNxi9sh7YCSEyar2fU2sXAIgBuSDBBc3j2U2CuW7jRJ6IMhq7ec8qrD5/ui:FR3hMC3yar128ggEcT52CLNlCa/ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\12_All_Video.wpl.RYK 1.33 KB MD5: f7ae6c87b56a97d751fc3c73df4cafaa
SHA1: fb9c0707bfc9a1e18fb672385e5eaca1eaf64f4c
SHA256: bec4c645eb2644c80667f903fe41781fc69760abfbe3b868d7a1ba41de58c572
SSDeep: 24:pxCDLqndsEQI9vPJHpAqIBY4/P+du1b99knG10WbGbhd8cSxGgVZD4iRM:LCDLqHpxmPeEb9anfhd8vwgZRM 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\10_All_Music.wpl.RYK 1.31 KB MD5: 829ebc2ad5a0b23150e6acf942203818
SHA1: daaf2755762b4ce39b8bf2946326addc292c8092
SHA256: 9ca069998d4eba3a140c66dbb77beade64f444cf99efe919f59c72ac779ca17d
SSDeep: 24:KNCCt7YpTXojVgqvatEE/yAHEyVWVTLuB1FhutpG5tnXUdLzLy7pN5M03ZjcoMrP:KMZtojVgq4hEJB618baOx67pI2woMrP 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\10_All_Music.wpl.RYK 1.31 KB MD5: 17d06e0b5ae3564bcc978334b600d7b8
SHA1: 5e392cb0c7e488344fff601c45c36cbbecbad35a
SHA256: 03b4cbe8fe0700d5ada684a0a54f661b89325ffe72b1d2994f5209b56f3ac6fc
SSDeep: 24:+bvcGLXJyrO0g7LIAceAZ3LLgV6imJuFpVKHG8Kcdoyzl7Aolko5pLprUlW:+bvRLKi7ELeQ3LLU65WOzlU4/LpL 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\WindowsMail.MSMessageStore.RYK 2.02 MB MD5: b31764ca68591958ddbcdae975dac95a
SHA1: a7f2cb622b05e0ec396d875cc2bc23fb41e5ccc2
SHA256: bbedec47fae87b87e5f23b31b61dbc2e59c0134deb6c875204da925819fb1ae2
SSDeep: 49152:HBiUOfwyk4/CdchZr8IP2WhTp0tAkVOzbj/bL9qPInOlXiLy:hwrk6CdEr8xqmAkVObjBelZ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.sig.RYK 418 bytes MD5: bde3be68e49e634d0f325821b4c23b07
SHA1: c6ec83faf8d7aa7bef19af832364a04861a9583d
SHA256: 11bbbcdcd0537ba709f45708432cd020e58ef6a8caf8abd2d0f8d47b3e636ae9
SSDeep: 12:xVc9XG9a6Llh/vI41PyFPvaJ8gl49zHa2vWHC2w:xV+WA6LU4RG3mvkDaBw 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.xml.RYK 2.25 KB MD5: 9356c4553274d6823ec8348893040f92
SHA1: 0255ae40e04fb992c4bff29a98de323116bf6dcd
SHA256: 453aa92e2d5e4bda2b1f1889001adab8dcf9266f08c942c9d5c67b7a6ce0e847
SSDeep: 48:l3mTLAqN2xPOhGTn/SI6khnzgIJysrlV5JeD49TIpUpHpDc6Y6kIJ:l3mTPcRtn/SI6kdc2ys7fTWOi6kIJ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\12_All_Video.wpl.RYK 1.33 KB MD5: d1cd1d919711f5e86d603830574afc3d
SHA1: a72508b04443c7ca71f2d784e22b3b20c282474a
SHA256: 3c4b929e29cfa1e2e0adad66a58fe7832ed75338333e102fb66438f8a4a8076e
SSDeep: 24:y/lwaGKhUnnPv93zubK08qjgra74A2YqtCVP1G3dmHkB+MCiRYZ+69GTmzUiGa4B:OHen93ybKmjgW8jYq8VPSkiRYUiG0pUB 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\11_All_Pictures.wpl.RYK 866 bytes MD5: 478177c326a4d93d0292fee8ea51567f
SHA1: 468c0dfcd8d8dbeb95a03df7d5aa4f1369d87ba5
SHA256: 12e3fc4b53692c180eaf4a5352db5a6c9a2a8fa8fe90b0ec6a148cdac4275470
SSDeep: 24:+CmKBwFZbEEec07DkzIfYEe+6YPZ4LG4JaIf2CyrZP:+oOZ9eH74cfN2SZ41JDOt 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\Passport[1].htm.RYK 610 bytes MD5: 0ed9f61fda4bf11011dd57daa3051399
SHA1: a5fb7bb48f50898a34155efcd93a889d0cdae77b
SHA256: eee12e1301f2762e27fefd50adeafd0bd1dbd167dbd8c017507b277ee7f10209
SSDeep: 12:p6J0zUpdLgQRvZ0ycTZP2swlTV0FBKAAf+t49UlgIaf6ma3QDUB9JfjNevbM:p6SUv7RvMFP2sm50WfS499IayPZLAo 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA54rQj[1].png.RYK 690 bytes MD5: 868ecda4506fab4d9bcadd17d3ff2b92
SHA1: 149168d515b2798032cdd5be93238237cd28716a
SHA256: f37b1fe0a9e0eedad35ce03b6af3f94fede6bb824986f4a0c835d4e78cad9a52
SSDeep: 12:7SnThzRsP9KNGecrkQzSrKvUIDxEV0Qt7zN4CQOVloarlR+rIgkr0jFjcQqPENrj:7QRsPosBkQzSuNDqV0mzN44VloYErIg9 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA42EP9[1].png.RYK 738 bytes MD5: 6617b1d8273915a4a1374511c13641f9
SHA1: 1e894a59fda7ac0c978408cd4e1f1b39bc99431e
SHA256: fd50e757bd6ff96c647e2de2fb008d5a514202df7622d3564bcf6e196c409886
SSDeep: 12:SdlszjFUKKN0UkKK7gG/hFLwLYFIduSU0i5jSU8cy2Qo15bEqQ31UbSUmm:MlszjAaUkNgAJDIdu3jSF93wlEqQlUbX 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA3e3XC[2].png.RYK 594 bytes MD5: 5d331549208536f4641541b157a37636
SHA1: 88847a1d4136e2c5ffcabf47030095ccc75758c4
SHA256: 1d65e4aff83fd9eafdd6a52e4545a14982c5b36b83a93d5a099ea7c9f95af255
SSDeep: 12:Ca0Ms7za5u3nzcffrfeSIy1MYppMAoCVydbz9v:QMs713zcHrfeeMAoC+z1 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\528d82a2[1].js.RYK 11.97 KB MD5: c513a5c7018684fbe25e887d8211aef1
SHA1: fb5b74d0c930e362611c4af73032fda27ad646c5
SHA256: fef5ee8ca895def8ec5a40e0b299470ec1e387e321b383ec67aaa89d4879d534
SSDeep: 192:wSdj+qcRSBAvGTiUyOgGqlIkvD8+lj1ex8K83bJzmA0DONXO/cbDsg1g3xfT:Ldj+qc0A4YaqW8RpeK3bQXDIXO8sBB7 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\async_usersync[3].RYK 1.58 KB MD5: 7fb3bb1d56f6de741f1bc5a9b31f7d31
SHA1: 5dd13b6ae1b342a37212665c65442da8495e859d
SHA256: c0f0a2468b13798043f34779ec5cbebc5448a77f49bd8c56b47c581ffbb561e6
SSDeep: 24:6d79LT8rTQ4cQJRF05JEf1J/kgW/1ahMXDWu1+9Hsl0RjHQMiyXDGNcVmAU+Pns:a938fUQJR6EdUtahiD9U9HsikMixAr0 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\adServer[1].htm.RYK 8.75 KB MD5: 51812c058c3a39b1a04bf83b8966a9d1
SHA1: 027351ab1f4d730809c6f4573faca4704de13341
SHA256: 566734488b216c74fe5e89589b80622eb94ff4abd283f4300248b87f45a1d40e
SSDeep: 192:T+FFhreoZmCO9+ePnvTsMi8Kfl0//a1cM42Dhr3a1xbqewEPF+wl:TW9ZH8+eodnlYauer2xuEtp 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA8uCo4[1].png.RYK 994 bytes MD5: 95c4587564aaf14bf8cf65e2aece3152
SHA1: f943352e902f0aac9255c1dec5725a992bff713a
SHA256: 71ebcbe9e08d661b6450485759970ce8b35aa71ad07d6686cf0272f583964f54
SSDeep: 24:tpb4wLJ6fdMt7u3D5N82q5N15vGDurd3qGIQ0H9I:X4J2E5NHqHQup3qrH9I 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AAdAVrM[1].png.RYK 1.10 KB MD5: 9e9e86f0029cd24de757b63e3e39b3d1
SHA1: b1ada86e7de851f6ea1242a1663b0117af00f4f5
SHA256: 36b396887f051bc8c014d1bd0c2ffbe476f5ef3bc953482446f4318041022c83
SSDeep: 24:GcZ8LWjNkqrxKQIxyCyoHVir9YXWsicET4wzGoR:mM/xK/ECDHVir9QWsFET4Q 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA61yi9[1].png.RYK 690 bytes MD5: d18f9f28df790c1bea76e75f794616dd
SHA1: 08186e431150aa62a67e02c6d993b5ad9e7c4d80
SHA256: 5f39a3d26fa7b681d037020b76a58fce8370c3eb3be731ecb0a560ecb9a21f67
SSDeep: 12:xfK9wzvXiVBsjreKKe2Yg+jMnP5nQ3nkF6OwihDsL13Fnl8NN0QBwpu3PP6nskUx:pK4vXizsXBX2sjCP5nkkF6OlhSr8NN0+ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\AA3vOVA[1].png.RYK 930 bytes MD5: c0d9bb6bf4dfde8b7d6f8fb5f835e675
SHA1: 3cca9da7927d2ddba901d23889a32eeb5e742c52
SHA256: a97709171949900f08816fbf6f2ffee6df5dd51a2036e17ad3f475b87dac192a
SSDeep: 24:AsN7bId4lmP2bOqhQRYtnAe1FYyZDDA2i:7KGmPihhtJYEDA/ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBPUFJ[1].jpg.RYK 8.00 KB MD5: 2bb215cbb66dc568227c79f1289561cf
SHA1: 17b91796cfd4bf27247d174c4a8797436b8f18db
SHA256: 49f93147cbd90db8e98abbe3dc3c84b2b0d5a093a157dfb5aea3a8678e40cc51
SSDeep: 192:dYm5LpAfOmD175T5ECe2SECrpc9MyPTzGGey:bKzx/Evk9zGU 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBOe7C[1].jpg.RYK 11.66 KB MD5: 7efa651fe160dfb47cc7796b288e4676
SHA1: 983efbcb4977aaa178ccf8b327ecf28e1a63a409
SHA256: 3ad7b3c898c1926efee84fc1688c098b206ab2e8728819617eeaaf144a527d07
SSDeep: 192:Mf1RsOuvbSkALWslPBwf1ay90itAiYpERaHGHMzw/B1SLZMET5bfd4VzqKCSf4H:b5vbSt1Bw95MiYpER3szwcO3VOD 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO3tl[1].jpg.RYK 24.80 KB MD5: c252e976f09d957ebbe0f048df99b8ff
SHA1: 5826b53ae7c020a0adb522c6d16fcf03654385ac
SHA256: c25f9a358f20d06f620ae3a37f7f9b6a5dbe0fe43e2d6350ced81b3a9509c6ee
SSDeep: 384:p8kXEGJKthhErYnzQLy+l0XZ5GN5N8hwJ9EOon8ynxD4EZrCdoEq2a:pfXEAKEoJ5IEwPEdXD4EwdU2a 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBNiEo[1].jpg.RYK 10.46 KB MD5: aa9404dc8956a911302793b779dce566
SHA1: 57641aa1c091380de54e2c1ac62e6af8fa78e55f
SHA256: cdcb90903603049336f0ab0a8e42a6ca6252e26a9171d54e1d2af697b0571c55
SSDeep: 192:iqcc+4F79wiLncZbqu1co4Oq7wW21YolSN+evgHyyXX/pklJiPUEXZyDXXc:iqcVm79CZ+o4O232CoaZvgHhXXAJiMEP 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB6Ma4a[1].png.RYK 674 bytes MD5: e918b48f55fd9dd52be5e9fa5f9f37d1
SHA1: 2101a2dbc3d2ba794a11f23f09fddf04c708233d
SHA256: 75ba8e8ddaab2ec12d7090e06d8342544934ced92428eb8b9f487c2de83269a0
SSDeep: 12:2UkLQPC3W+v6XzCMectNqAnyh1gGsnm5n0K9q7AYzs7rAG3fkhzzOt8n:VqQami6XzCmTqksg7nmJ9Kzs7rr3fkdz 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\28-8f3193-f30905ea[1].RYK 231.60 KB MD5: 40f4483117db744aa23ca8c521586439
SHA1: 6f866a62ff7dec46f2e24df2745591cecc10cd9e
SHA256: c1bb443c049a20ada386f0fc0c3e2f043bc02ca4933fda6960890394d27cdb38
SSDeep: 6144:RjRUBWEQwIUW5VRWr4hm9Yed0/YXf/f9XRYa1/X2XVZvfq:1RGi8bscKeLXf/fEaNKVlS 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBQxzx[1].jpg.RYK 2.56 KB MD5: c5f52ce7632b48444d73b989fc2fae3d
SHA1: 36e44a73f427cd47454bffe5c9c11b3de47185f8
SHA256: db74f02593f543acb96534d1c0898a2af9c4f67de043cb19939662a87a1edc3e
SSDeep: 48:/5+F1+6uRhDPh8G68vt0sl3dDR7EhjbBb8R8qrx1CZZaBsb7Ftig/NWVahn:6uvcQbEhj2R8qrqZzNWVan 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBPThN[1].jpg.RYK 7.83 KB MD5: 85259141f8aa9683af9a3ab5e108ccc6
SHA1: e702f65643d27a29027c0ab7c16d67f41e068751
SHA256: f991ea4d6b990bd960009f3e3916965ac04af7d4533a46e08b42457d020acf2b
SSDeep: 192:6S6bwGjKqmozle+tYanQuAjlhWNA3YQCqH4ZRy:69bc4esYODARsgYQCFZM 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO8dQ[1].jpg.RYK 2.11 KB MD5: 57aa2a877cd8ae8a3b777c51009dfcc3
SHA1: 0f593118a574c3b7b633c2dec3b5dd0224496aef
SHA256: cd15bc956d363c24a04cd17b5a61dde26ce1e61515b2b20e251d1e6c866e731c
SSDeep: 48:+4O3I7WqKPIuJrdlfnEZ+O9nWHOc9iOBQfD7+ERXHilDAlCHpwFhc6IdKCFe7bew:+o7WVB3xg9nwOiiO2XRXsDA4pwFhc6I2 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBO1mQ[1].jpg.RYK 6.13 KB MD5: fb07aa0d489758367fb079ea42b4821c
SHA1: 3ec2b781781a5937e5e3640d3f90bc9180e6fe5b
SHA256: 6b3b167e242e129d28ff861cd1fcba2aab58b7b04b5586a534fce1c2b364cc96
SSDeep: 192:VDD++2z9cBFD7YPIADkBGy+5AeSMlhrz1:VXgcKDkY5Aevvrz1 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBLhZX[1].jpg.RYK 2.67 KB MD5: f3c5448014c63a59021132710decb65d
SHA1: f8eaddf63a4d0216e41ca965d28c4780e3c65881
SHA256: ec97f011d723b3460f717252615b5d0b156b65bd12ddaac70c0f428e17acd6b0
SSDeep: 48:2XNb2PRo8R91N0T5LvI5EQ/3+O824+BtSlt2QV3ikDOl2UfmzH4L3P/W:uY2dL3Qvu21Btct2QwHfmEL3P/W 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBL0ij[1].jpg.RYK 2.53 KB MD5: 021ccf04c8d11594e38b767a43ddedc4
SHA1: 88416671c5006919ac477b287343f17339cf40d1
SHA256: f173022908b960dd464ed12c335c4e68ab3d1de53617791e46f4a81db6bc1d25
SSDeep: 48:8/OTgFZjuUXhaW2zLFnceOAlNjNC8Ou+KPG6ZcJqN+P0eclDE+nj6PU/V3OaFI2B:8A8j6jvpnvjjNC8zhPSJIw0BDEgmPU3D 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBIqq8[1].jpg.RYK 13.08 KB MD5: 76abf1829d8b758f40cd2d823ccc6fbe
SHA1: 5a671a1766b549d0425e939669ff196153d6665f
SHA256: c9474b68a068053dc230a4513b42bf99627da8e3d3e29ed935d5896db725774a
SSDeep: 384:nL/2qk81LcWojqtlclZNemGWJlTZonX6mjVIMbE39Be:TtMWMqtCBeBWJNOX6mjyMA39U 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB74fLs[1].png.RYK 642 bytes MD5: 66f13d03269e17f318d1f9466966b5fb
SHA1: 8ae56ff7165976d7e2b1dbf1574815512edc3dfa
SHA256: d8a1d67030d81ae08cc000146a4c4753007d7fda59657ed7035d750850c4d1e5
SSDeep: 12:5a58A1DJMlvduFR9B9xTX7depsPX//Y/VoqFmSmRCnd0EWQTS/lhHEn:jAhKlvd2HxTX7dZfnY93FgCdIQ0nHE 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB5kTiV[1].png.RYK 578 bytes MD5: 0f64217d5fb8a533b022eab025488c1e
SHA1: 324228981d264a652ae37415b7d6b11e892dac10
SHA256: c83d992795aa0d3cfc2de4b913b597a1a6aba488b3dfdde7aea60aebe8f52778
SSDeep: 12:ffQO3VVuAG3P1UqPwXUocbuhZk36LLIA401S0TQIEyWPeaHIj/Ztbvf:Z3up9UqPwXUocb4k3sIA7S0TjX/3jPvf 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB5kJAC[1].png.RYK 578 bytes MD5: 587beebebdbc09f5e8883505e508bb6a
SHA1: 7d092e6e2bf6ca728a425d60d972c47f0e1b2c43
SHA256: 58713df95ff0f5d628bd18023ce9e25fbec904731db33c62ad9b42cf71c5ca7d
SSDeep: 12:yuQjkzQ/2xdri8NZEgtt3pMku4ugktd0N/AiqkO2gzPRhuRY4T:vQIswRrF3pwh0N/AiPJg4T 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB46JmN[1].png.RYK 1.05 KB MD5: 4ad0e2a6ae04c4fe5d0026284458e4ee
SHA1: 8300364ea4baecbbc3e6490535812297bcd97de5
SHA256: 83d35136b1673403bef76cfde72339499c73604a0554d5773d60757c63ef8d49
SSDeep: 24:UXPGSQ6Bq5Ci14Ov5vN0GO71y88rQFSJG9MP/4LWA5qNK:jZ6Bqf1rNZso888Fv94cWWz 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBDZoZR[1].jpg.RYK 2.63 KB MD5: aa623872829c9c5f520789ba89c43f4f
SHA1: f6799202f60cb808541d22472918edac42c7e6d8
SHA256: 44c452ec51f9b47a13ca222a796ea9841ca266bb4535102aeb1967fb1b14ae4a
SSDeep: 48:BUdtywWSrL38CpS1AwttR1AQIs0iJH6V6vr7ksO2Yu2kFDVgL4jDnvBnmKZYLHjI:BUdtywjrLLWAir1JIs0c6QDxBD2kFDVj 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBDRbsH[1].jpg.RYK 2.33 KB MD5: de7bafcbb94f7f43640b73a9818a3f7d
SHA1: dc0fe81cae146f3419ccd3458f0c1476697b13f1
SHA256: e5ef8a9b884eaa30556961f2e067fe76c8caa206152b2360e7abc8180ecc1482
SSDeep: 48:fKmex5C+7VxP3pHItwKhWj5ISgXo8ysi8Plm4ynZB+LQlJzoat+g6tWII9BL4J:fv49do5SqSg4cPl+v6kO++XtWpo 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0rDa[2].jpg.RYK 2.27 KB MD5: 2a9c22800bad9b6b8fcc762742bbe182
SHA1: b93c344534348405d7d4c33ca8bd4e968f9c6ab1
SHA256: fbf97241dc25f8019fb683683c88e68ceeb0d9ea65292e92c2f864e4d57c7902
SSDeep: 48:XA/gyL32r1dwGi1INVbuGyp9fmhW/h5lCLkfkUw6p7IIw3mxPk8:Q/nLG5dhi1INVFyp9fgW/9CdB+7nwWxx 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0rDa[1].jpg.RYK 6.41 KB MD5: 07a03f662df69ba52d8357e86479c636
SHA1: 59518cdb784a5994653d9617a9abd70f5195db32
SHA256: 4108c4817d97a7b70d703fc666f71bd7bec97d3273eb45835e63cd87670d34cb
SSDeep: 192:zupLHg2X45APQBKm86+xW0GkVZb9RH3GX:zupLZo5AIBKm86+xWabvH3GX 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0mlu[1].jpg.RYK 1.56 KB MD5: a8c6e23612c6eacdcea6da1f4b8b17be
SHA1: 100bf0988d8ccf6eb94fd47e4d6716269b358f28
SHA256: 60d6f93376ca1966c26a3f5104225605db88ecb1c9ea4268f969d67303a7ba04
SSDeep: 48:gju2oZj1xShzysQS0lBmXM8aNsXsOKKm0IYEhP/:92wjrMysQrMJaNoxKKaY0/ 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC06Ub[1].jpg.RYK 13.19 KB MD5: 59501662851663e2b855a640e8d923d3
SHA1: 04d68eda70989a209433aae6f465743792316bae
SHA256: b57ffe307e7a7ddfb2448a9bfd58305b54c48b5cb63fd61bbefadca3c57ba253
SSDeep: 384:cTnp37rO19b03pp2lo0nSr77dMEcaUFyz3A4gyzlNth:cTn9fDZg7Sr7ZMEcdAAIX 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBzxW1[1].jpg.RYK 9.46 KB MD5: fd46a082a39dad2a348dc6d377248720
SHA1: 7bcee300b90ab9c005fe838e0ec28e527ef71892
SHA256: d67f15e9da784b40d1eb46063be9a23dea91d433502b6fe341281a290451e290
SSDeep: 192:7K80v1mgDMe+qAYis7byvq5tZw2gVnlyP98JJf25O2MmEumGTpn5sHV35:70ggIe+qGs7br/OFwP9YeFRxTaz 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBz9wz[1].jpg.RYK 2.49 KB MD5: c27646a5a84093b6492b6eb71a74ee2d
SHA1: 9aa983a6e5fbe34215b997de9f3cddb9913f0a15
SHA256: eaa5c3120ac49ec429805062a799f1e7870f67bece562673e36432e5082c90d9
SSDeep: 48:ou8XxdLy+D5HODNH/MZ8fiDxgxklrsujsfWUQ+jt/YKL2oI7BadDuQsV:ojdew5up/+UkZHsfz/JwKL25FKDDsV 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVxM8[1].jpg.RYK 2.24 KB MD5: 9e7f8581f0bf492bdb714b7e9192e663
SHA1: 28ba44022b70c2f7b02e18fe5593eff01fd2c7e1
SHA256: 4eee461453a18cea0e7d367c5c351c26e0e714500bcc4100e3aaecb9573478c4
SSDeep: 48:vG1XQoZIbQuQCXCmnevh6PJg5aDa/p0RfpXe:QXQoZ3u5Xsh6PeID4ORfpu 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVGsM[1].jpg.RYK 7.88 KB MD5: 2197aef1806f3d088b41a90e2566ad44
SHA1: 14108c403350c7c784890b6e7b0bb6db48340248
SHA256: 4b980499f0688a9e575ebd689e1093265aafe61aa22967c749b96d778ec17014
SSDeep: 192:rJK5LFYLEIuWoX5vVqLdh4SIXTrqi16J6OjNB5pN:tK7Iu/X5vVqhhpIDOi141 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBVEOW[1].jpg.RYK 2.64 KB MD5: aa2484804bd211ac6b2e4a9654e8d3f0
SHA1: 40a611f538ffbe7b7f6a91acb01d7669c879595d
SHA256: c0b0b1dcda0683aefc60d5396eae8167e918dcb4b650b20f5140ecbbb829ec91
SSDeep: 48:uJYCp4i/nMBLXIPhrp+R5OECIHzBEHbb6bfFvO8Pn5lTu449YuL41QTynfJ5awG7:kP4unMBGdmTCITQbbqvDP5ZvQIOTwzxy 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBTpvW[1].jpg.RYK 2.19 KB MD5: 2d7ce5789df45f39d6ca3a73cbb76b3b
SHA1: 0ddb27b813a29001f2f4522ca23d624bd3aafb22
SHA256: 4fe4fea988ef3c6a8d2acc79dfb8988465049e40d1c3d2c1e51e0d6fa92f6e8a
SSDeep: 48:cnF6/sDaSC0LFaIjX1Fxm8tFWQWAMXSOsA7Jn98G:nUfHBjsQWMOFT8G 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBBsqNL[1].jpg.RYK 5.99 KB MD5: 419091c862ae7953d05ae9b9da1b2e7a
SHA1: 98db33e13c214f3b12da292de899cd4c16b7770e
SHA256: 0ad61566a040beb3dd3a2197567de97e728db8570c3183f1a1a6699be7154d1e
SSDeep: 96:fG4Vij2J1sAU49edQoAJPogDsVwgD2YSUqZKKZc6OHCnJligpN1cAGgDh:fGUiC8AdedQHzZK//Cnm8Gmh 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BB1CcOi[1].png.RYK 754 bytes MD5: 93e9649a4380c9d4377cbfb25e8cbc49
SHA1: 3c51578deb4abaa784f964cb5cc06f6e19d320d2
SHA256: f3858d723089c8de9728d2de3b153a826dd335a29b8cd5b3278eb06c87974a27
SSDeep: 12:MSJCptfxVBRfJIP1CvlG61MjEAiMjYDIpL3haT6bNctIU0TM:zJYflJsCdG61sEhM0aTMT6mtI5TM 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEeP0k[1].jpg.RYK 9.47 KB MD5: c248571d8ba70089c2eb00d9c357eda8
SHA1: 0a4dec2bf6a6b8f9e7a21278bf795aca2c6985cb
SHA256: 3c61e724a93ee753b5111836a018579555872113c04555210e4786e800817970
SSDeep: 192:a2brY+UREd8/wNLab6AWy/0aPG34BL3sIPMu0HUnqUIhzT3/E5EJcf9:M+Bmwab6PXge4Z3sdHuy186OF 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdXJj[1].jpg.RYK 1.91 KB MD5: cef71e3a87c9803f1f51ea913728aa37
SHA1: 7716219d282cb0a16a0ce3cbdc8e015fed796965
SHA256: 31017321cb18b45445bb3e1f653a3ef39206f6701f5bcfd92dd66d56e5961d20
SSDeep: 48:BxRvrMShmTqAlTIs6n54LqGLeDHnXC/rhIgC+y4tDN:BxRvrMWmTqMxm6erS/PBDN 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdqEy[1].jpg.RYK 1.92 KB MD5: 462e2824fc548fad29e3fdc0239579b6
SHA1: a3c57a09a0d5b52e5edc96fb686eebc39bb2f6b9
SHA256: 87f3b619327b79a52f28fd6f5a0fed23bf65c13764f627f701bb315d04add865
SSDeep: 48:y6h/gxFshBnErjHM2Ec2IjU2pGJweonvfPTxmtQ9:54a4js0jU2pG+eonvZ9 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdtWw[1].jpg.RYK 1.99 KB MD5: 65288ed15e34a6284e7e221e2763d36c
SHA1: f57485cf101b64765f6a62b9cdf221aa28ccd398
SHA256: d199fac10f404ca08d135e0b3c1bf60ee52b9c43927fe8bad3b24cfafa60cf1d
SSDeep: 48:S/g70cdm3iie/aZToMyAScD0U3gVkssAudUFg53mD5i3zK:S/gnmcaaM/RlwVXP250 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdoQv[1].jpg.RYK 2.64 KB MD5: 92221557840f12cd2d351e6a2f74b99d
SHA1: 19f669534774ff785a7e274c5d7d1be561c75d93
SHA256: cea4318e04fa10cc400439d5203cd2934b1b23e8ed82cd2674e1b10c3d6e0df6
SSDeep: 48:Dd2tWEMFwKp28dgt8hokz/seeZivGz9HKXfclSXKamDseUQ2lBaYM/U0cQ5:Dd2t8OKDguhNSZhHW0SXKvseUXzoU0ce 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEdE0f[1].jpg.RYK 8.41 KB MD5: 6d3c5e2c660b40a2addee037f234cb37
SHA1: be81992e9db6be9e661d6e911d1fa151b7bf9025
SHA256: daa7e21614eabf0ee8468c9a5d2b7cdc999c26986e5a6789c741a278fed34dce
SSDeep: 192:nq6i8JtIjnJ3Do9F6LzRK1LQl+xqQB7hJTDRBl1gsnIhnojZvzbRk80:4YAOi3sLA5S7TDRBrVkoNvB2 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBEcHle[1].jpg.RYK 2.46 KB MD5: db6901a061ebb2e46ca7eb6c0db2a841
SHA1: 35b10f6ebd3b8c9131e52bfc9398bcf5b525a544
SHA256: a9abc6e3b6ff947b31860ef2c41464f6ab7647212e8fd927983db712e9527404
SSDeep: 48:TyQ/D3QjppuWUX531MbQjE4eipMbUIbarnir5ky37MLXWDlLjr5Dg1aoUkerTHQ5:TyQbgFoZNubt6MXWTULLLjr5s1lcjIbD 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBE9wSt[1].jpg.RYK 2.00 KB MD5: 083af4027fdf7b63358c44958a966d4b
SHA1: 2fcc403ac434b6838969878d40782e0491e23a36
SHA256: d301f929cc08356a97ef925ac3c029abaafdc69e301629ec1cc3ceb94df724de
SSDeep: 48:hn27BCoT1JwkIw8PqyeJk7hEMAMozQnhS3I:4749w8SjzYhS4 		True
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz\bbe97o8[1].jpg 2.49 KB MD5: 6fad4bdfb311fcdd86847a1aeed79069
SHA1: 0fac9c7375ba285c9a4b9a516dc0ef4415ed3dc2
SHA256: f3f75c7344fa81a6ea9a5cb2ec0f429c7f86710b2074446838e05e47f06027f7
SSDeep: 48:Sl7HGjZSM2IfdItw9hPtSgtsZdhSLifzHBN4DVckb76:mmYMh+w95zsZd4ibHz4D+66 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0tCi[1].jpg.RYK 12.78 KB MD5: d5bbacc3ad173e04d413afbe562d69c8
SHA1: ab4e18f1861a5fce3d1a3901d48634d3dacb7d3b
SHA256: a4aed5bc9e28ec18a904a541d4b8c3867c0dbc008d14e2fcd760b07805cfa93a
SSDeep: 192:Py+R5MvmOnh/CnV0Ph3Yj0zI9h1PYHBHol1t/pnp8blK74Sn:606QiJ3SiIPVBp8blKcc 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBDK7Yy[1].jpg.RYK 10.52 KB MD5: 7eff755575112524dd6255ae6bdaa451
SHA1: aabaa990c8fd13448ca9750a9401f6ba262ec6ba
SHA256: ba881da452a19860cecf3ccaa8f65910c0fb8f24a27b4da9fc8f97dd1cb2d93c
SSDeep: 192:l+4vD33dQqEWuHWtWFXQj/QzkbXLeQXVZ0ej2BW5ZLfAD5VrV:Xb33dQqPu2tWFXQz8kbLr/ZsD51V 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\BBC0lYn[1].jpg.RYK 10.06 KB MD5: 1112273202bb3b2b575e3351759778d6
SHA1: bbd47b20971dd8bfee18e730e09d9cc157437de1
SHA256: 191c58d8474eb0061a16cda6af82b424be9fbf5902fdc1f529f3d1967efef8d3
SSDeep: 192:qkwqCV9pWIQGRadEDQ6azURmSyB+lhxiROGsocRWwqI0RKGEJ1E:qkw3TppQvdEDQ6WfSy0BGsocgwSR+m 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\css[2].txt.RYK 466 bytes MD5: ce1e32dcd07ad83e08627d959ab44fd7
SHA1: 9cb22bcaf2e2d351dc8bb4d940b15f20711ca0b6
SHA256: ab83922462549e2ea46931c5761b0affe2bb5afbd5583bcba44dde7c9679ec1f
SSDeep: 12:wmbl6B97KJUomirV45rKdjrF7CTH48nuJJH:R6yxrwK2bu/H 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\ie8[1].txt.RYK 386 bytes MD5: f9624473131982b6a932596090466048
SHA1: 7c4df6174a369879eb4eb7944ef7358fce520fc4
SHA256: 5d70804b4bee29da856ba574947f847141e6e50f2634068d13a5f87a7bbe9f92
SSDeep: 12:dpsER2281OouYQgMosWtK8zblMkd8r230G9:zWOouLBfWA8z5TX9 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\meversion[1].RYK 4.66 KB MD5: 31f176c1899e61d533fab74b3038e11b
SHA1: 90b4944e18ef45af544b768bcf8a65d8a376a8de
SHA256: 1ec073168f1989f3eb323e67b1e6676f5c1632459963f513064ad398216eb9b7
SSDeep: 96:SmqfgWwMStkr3KFE1XtZ5BYuOIovFsb2jPXIcBN4zYPTviD9pG7X3moi:2xGFE15vFWXbNcYPT6D8X2oi 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\print[1].txt.RYK 450 bytes MD5: c99b419c4fc3d6992b23494576e5e2d4
SHA1: aa8108a618177dac46b8423d292f89b021f5b1ed
SHA256: 07332c5b49570c1e3bec5f2787df12404e8356d5709ad9095b4debea38368dc0
SSDeep: 12:eeuiaJVtbOHSYjNAaOX6gLlKYgr+umU6ujPn:eXiaJVtbOHSYjNAasTy7zn 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\Standard[1]RYK.RYK 85.31 KB MD5: 93eb579e0fe4d330ad3537a5879d5fe2
SHA1: 54f71ac1f22e66f4468c338444fbace73d985dcc
SHA256: 886a122182795f019b88880f4fab46c56df65f65f745daefa9487e9faf4a70d9
SSDeep: 1536:O7gAy8DCLS8mpUWj9SkcGWtAsLs6jk2PeuMjUuCQwFdIgSC5Cu6ygXX7pWP:O0AyKCLS8vc/Uk20CfXkuDgXX8 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\core[1].css.RYK 165.10 KB MD5: fc31d53a0582907f0455a061bc7f5e7b
SHA1: fd0acf14811eb1f13af12c4a0993841b0efc35e4
SHA256: a7f31f485e9e886b23ba08bf111bc7657f63d80f859a18e7c80b45af465bdece
SSDeep: 3072:hykWJmXwyIv1AleP3evvlXPsjnVdRrbRPKuOaJrAm7C6jIEZn/MP514PMs:8kKrv1AiKvlfsjVdRJhh1qEZnRMs 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\th[1].jpg.RYK 2.55 KB MD5: dd60a9d94869dc55a3098b5879e45dc9
SHA1: a29b0e9431f3f69a4b2c25ca636a91fb6b651531
SHA256: e3bd8341e046a266ab78870bf4161b2dd3ea98992f700c8817b8e78322c536d7
SSDeep: 48:BEEx+dAban4YUzYY1yIwbfi6SUEI0KMvaGdks00gkbaE/vKck/OU4lp8TKG0:NxHbbYUz3BwG8FGSsBuE/HO3g8TK 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\ast[2].js].jpg.RYK.RYK 70.33 KB MD5: d8db068c41c40ff835279b89bccc3a02
SHA1: 42e0d654182161b8507522061e5794c106df0056
SHA256: b6581150d4078d6a72c0df3769c8c75a7682bc9dfcf8b1e51d1001567feb3fd0
SSDeep: 1536:D/XWpYPdia89s7nkv/2iCzDhzlJuazmRqReJOCmPRcd9xAh8:bXtdDwv/zCzD7JuhqQoCUk/Ah8 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\adfscript[1]pg.RYK.RYK 10.39 KB MD5: f5f15c105566eec2be911ec3d27438b3
SHA1: 236a64d56ed992886a0a29a6eacc43e3d96e6d81
SHA256: f5e3930bde6025b37d9394959a918f4b8416e544ed64e3fb59456e20fcd676fe
SSDeep: 192:fF//L1A1DAB/LK9GD4K05vwAZpym05upMt/FWevZ:x16hMt0XZpo5JPR 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\adfserve[1]png.RYK.RYK 4.05 KB MD5: 7fcbbf8864845dc571457551fccd168a
SHA1: 93472cc3f1b6be0f1078ab189605999536493c4a
SHA256: 35b1d82d75f2250f43ccc0867c08380bdc5c170a8fd6f023e4a80f41c30901c0
SSDeep: 96:qUlhsmCTpMv+eBb887b2NEiGLhhrJtLdlYE0EluF:qKJPv++7SNENLp5ATEAF 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\player[1].jsm.RYK.RYK 27.13 KB MD5: 739e86ae57751285af003e766999fdfb
SHA1: 3c096b8e2c370c487c0fe91484ff116b81771b2c
SHA256: 2da8ccd13bff0061671dffb147e1a3224ccaabd8ffef43d0826e4cccb38db359
SSDeep: 768:bgxs1piPgj2ChXFf6kvMdzpBnK3B0B15TQ:Ux4Y4jxp96kvMhpQ1 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\player[2].js.RYK 24.10 KB MD5: f2adcccc33878600ffafe82ce02af2a4
SHA1: 8a4f83df109233ce9c175b3258d6b6086b438742
SHA256: 80894a91b329abb7e33e25e3376330187722ad84d565876e8f0b8ab0cd334300
SSDeep: 384:yr9XvFJ6RwTeXhrF22MeQ9Mm84yqmojcphp6p3fJQqLL82ZZY8Ip0SghR2XTUXTb:UJ65hp22Fm5xjqp83fJ3LDZY8tSUgYrD 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\26158[1].pngpg.RYK.RYK 48.36 KB MD5: 6588b75366732860445d40649dd9b918
SHA1: 1dd74d9d2a3740fea1a3b88f29427b2f09ef13a7
SHA256: a83dae7ebc9ec1b923961201be70765c966099bd3d136f4ee9f70ebd154b9f35
SSDeep: 768:c4CWHB5FhivAfs992q7EEtMOPeafyMz9tal5o6v1lX/A5qd7CjmSjp4RTd5TqZu9:L/HziRf75igect7C5xXY5m7FqiRiWOE 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\adex[1].js.jpg.RYK.RYK 36.74 KB MD5: b27f31a93269a09d9eb6aef13657b8a4
SHA1: 9f663e13862924d5c13c578baf791196b44d6174
SHA256: ef777a3a76e4a67942f12d00ebc4f982d5f479bd142235813421ceea1009dd0a
SSDeep: 768:ZYAv5iqi3OqtC0iduS01glS0wooOtCtTbLoIrS6qdlz5Q:ZFvQHtfidV3lS0vgTbsI26qd0 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\adfscript[1]pg.RYK.RYK 10.39 KB MD5: 518628ab561e76710dd1864076039a1b
SHA1: bf62412844309e79abda941483588c688b35b214
SHA256: b0b697e7b35cc73486c6855e1483be7b72e084f9a13636064f3586a8821104eb
SSDeep: 192:+jGTtcFKieGhqtFYsULRg+4ewToZ97ZtvZidJ0pAWREwylS38:+jG6IQE1I3w0tJpWwylS38 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\ast[1].js].jpg.RYK.RYK 70.33 KB MD5: a1f4f43389c5026eafe976db73e19f4e
SHA1: 168df350c61036e2db513f10f6c0c80738bb4a4c
SHA256: eadfb54c58d9cd018a2f6b6abcf9de6f97a919ee410ecbf7016a3d16bdf88238
SSDeep: 1536:RJ+QH80AJfVlpHLKLHoAJdb/hHBNyCC65iPjG0Q3mtFwmBkG1Sd7/zFZ63oFeLDD:ZxwTZgHosFPNFiPj9pBkG1Y76oFeLDD 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\css[1].txt.RYK 154.71 KB MD5: 7259d98ff01daa18ddefbf19c19d7cad
SHA1: 29ecd9552ab39a849aad3ed95b5cc7042f17d7b3
SHA256: de4fe8ecf44617e325fef65160fd33ca62a4dcc97f056507142afd7dd8054753
SSDeep: 3072:+ha9CSEHahBZciaj6aqaKoe6cZjA5L33BwP8w4CRrTw4K:M6J7aEY3Rcuur8z 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\msn[1].htm.RYK 2.56 KB MD5: a0c5db4781d8eae1278c6a65b87f6b39
SHA1: e4a14192510f156f71572ad1908354b2bcf132ac
SHA256: 4828bc395752a83bc8abec4727b654a3989de7587deba75363aeed063eee9720
SSDeep: 48:cZjLTaHP5gU+SMDQzEivRjVU+L0zf5CRwLmjSh3fL4xJ6j4ITPhS9vgQnUpjkKR/:SjLTaGU08Qi5je+LsfERwyjEcj6MWh4m 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\uid[1].htm.png.RYK.RYK 2.83 KB MD5: aaaba6ce5f1743490882216b805b2165
SHA1: 45ba6bb912f20aed2034dbc11e5e761cd30f3f34
SHA256: 4950232fcd72845c7fcbf8bba44b4608650f0e491860074a82058a1781539d26
SSDeep: 48:YBs6aYkz5TRtFUlcpkqAfOGHbxiPXzr87u19IgSjDtR4axfMP5jkMBy4s7wrqWoQ:YiNYksSaRbxinkXDtOax0K4HhWWeYL7V 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccountwpl.RYK.RYK 1.97 KB MD5: 44f76189341de80572df1947e8956240
SHA1: 8ced369cb16c3a45a9ea80d4e0ec337670ef0af4
SHA256: 9693f57870870cbd92ba9405808a187da4272349e521437ce88d5e6ee5258998
SSDeep: 48:IDxs046+vP1o8QXk9Q2gbCxWTbyjcEfDRKWmQ:IDM14X12WA1fDX 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccountstars.wpl.RYK.RYK 1.75 KB MD5: c4ccb41fa4e244a66f22b856d9c183bc
SHA1: ef96f78a44fe03f7c27b746f0fc7a53e91e76282
SHA256: 11632dcc023a9af47dd9307379b424dd030a534b793fdade2aa8d99ebe6bbb4c
SSDeep: 48:bZGEAI9AIIGwYMOSqAwA/EpdiX0LcKwWv+flm:tNkhYrqwhbKAv+4 		True
...
C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccountt_week.wpl.RYK.RYK 962 bytes MD5: a6a0ccfa29a027450e19ae9d236565d5
SHA1: 12fa7031d129d5c15982c52db2f729b64cf748db
SHA256: 75b4734229878353eea3f6a3fcc10ab672d2eab13806dad1c8805997d233bb28
SSDeep: 24:Ep7f9/IR37YprTiCbPfyt351KqjsyGU14r:C71IHiP2tqt 		True
...
c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\lpdj9b.pdf 38.35 KB MD5: 5669a1b11a946c65155a558c41109679
SHA1: dd57e6b79bc61e0a35bf37b40184bb66703d034d
SHA256: 001794740723ef8251b7cf5e45268c3b9873db2ea7f285d04886ec853f48d01d
SSDeep: 768:LJUo1zOusFlmZgxgH/J9UU1MJBjO9I59Rbzy8mJ1AVC9sJS6yTmU:LFpPsFlmOxgLx1+ZO9C9pWhJ14iN7j 		False
...
Host Behavior
File (6623)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\5P5NRG~1\AppData\Local\Temp\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\cs-CZ\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 23
Fn
Create C:\Boot\da-DK\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\de-DE\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\el-GR\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\en-US\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\es-ES\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\fi-FI\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\Fonts\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\fr-FR\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\hu-HU\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\it-IT\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\ja-JP\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\ko-KR\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\nb-NO\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\nl-NL\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\pl-PL\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\pt-BR\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\pt-PT\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\ru-RU\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\sv-SE\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\tr-TR\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\zh-CN\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\zh-HK\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\zh-TW\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Config.Msi\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Acrobat\10.0\Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Color\Profiles\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\Color\Profiles\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\Color\Profiles\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\BCD desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 4
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\BCD.LOG1 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\BCD.LOG2 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\BOOTSTAT.DAT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Boot\Fonts\chs_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Boot\Fonts\cht_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Boot\Fonts\kor_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Boot\Fonts\jpn_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Boot\Fonts\wgl4_boot.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\bootmgr desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeSysFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\BOOTSECT.BAK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wsRGB.icc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Acrobat\10.0\AdobeSysFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Acrobat\10.0\SharedDataEvents desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Acrobat\10.0\UserCache.bin desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Color\ACECache11.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Color\Profiles\wscRGB.icc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Adobe\Color\Profiles\wsRGB.icc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeSysFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\Acrobat\10.0\SharedDataEvents desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\Acrobat\10.0\UserCache.bin desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\Color\ACECache11.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\Color\Profiles\wscRGB.icc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Adobe\Color\Profiles\wsRGB.icc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeSysFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\SharedDataEvents desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\UserCache.bin desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\Color\ACECache11.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wscRGB.icc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wsRGB.icc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeSysFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\SharedDataEvents desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\UserCache.bin desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Color\ACECache11.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wscRGB.icc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wsRGB.icc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeSysFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\SharedDataEvents desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\UserCache.bin desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\ACECache11.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wscRGB.icc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wsRGB.icc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Boot\BCD.LOG desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeSysFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\SharedDataEvents desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\UserCache.bin desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\ACECache11.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wscRGB.icc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wsRGB.icc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeSysFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\SharedDataEvents desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\UserCache.bin desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\ACECache11.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wscRGB.icc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wsRGB.icc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeSysFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\SharedDataEvents desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 4
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\SharedDataEvents desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\UserCache.bin desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\ACECache11.lst.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wscRGB.icc.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wsRGB.icc.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeSysFnt10.lst.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\SharedDataEvents.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\UserCache.bin.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\ACECache11.lst.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 4
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 12
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Deployment\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wscRGB.icc.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wsRGB.icc.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\AdobeSysFnt10.lst.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\Cache\AcroFnt10.lst.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\SharedDataEvents.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Acrobat\10.0\UserCache.bin.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\ACECache11.lst.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wscRGB.icc.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Color\Profiles\wsRGB.icc.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\GDIPFONTCACHEV1.DAT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\CrashReports\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft Help\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 5
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Cookies\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2iI83Xqu-SUm9ZsQ.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5Kvc aIyBu.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7LC7h3NKBPeoe.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8DDixiNZtZLaWeCmu7e.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\A54yMyJIBKZ4.ots desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AdobeARM.log desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AhKC9lHcLc.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\aP3qnxm9od.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\BtC5B7IXSKDZSJgLAe3.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\efFx4Divca0tc4.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\EmLJY8wk7H.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\f6eDx z94Dzwz2K8sqE.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\fdb1k.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\FXSAPIDebugLogFile.txt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\gQXnrhLgWoJRH32GpKD.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\HSDnH8dTNYHVzPB_.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\hViKCLPrU.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\j4n6VZ.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\kmb QJZmXmJi_.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ldLFid8fGd2Cz6.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\lpDj9b.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\MpOa-.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\mS8eZ6n.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\omts.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Qg9FUzDvMpex.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\qgBA8xP0yPHpG.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Temporary Internet Files\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WPDNSE\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\Data\CJW3O3KP.BX7\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Deployment\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\CrashReports\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Sd82F9B.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\U8XmBQFiP7PLq9.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\u9Pfn7XvaHQ8ByEI_piG.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\uRfigoP5hgocNJCg6h.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\w5mAGJ1Y.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WTSuSWDiNChTS.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\x850.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ZpuiP.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\GDIPFONTCACHEV1.DAT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\MSHist012019070920190710\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\MSHist012017071220170713\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 5
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 19
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Event Viewer\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 5
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\1NBUR4HR\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\6ASVN7J7\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\D68G7BIJ\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\KQMHSVKD\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FORMS\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IME12\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IMJP12\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FORMS\FRMCACHE.DAT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IMJP8_1\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IMJP9_0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Transcoded Files Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 4
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\System\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\User\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\RoamCache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Publisher\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\TaskSchedulerConfig\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\CurrentDatabase_372.wmdb desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\mapisvc.inf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\Outlook.sharing.xml.obi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\content14.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 12
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\thumbs.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\1024\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\1033\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 4
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn1\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn2\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\GameExplorer\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Themes\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ERC\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportArchive\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.chk desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.log desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft Help\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb00001.log desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00001.jrs desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00002.jrs desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\oeold.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\WindowsMail.MSMessageStore desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\WindowsMail.pat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2iI83Xqu-SUm9ZsQ.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5Kvc aIyBu.odt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7LC7h3NKBPeoe.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8DDixiNZtZLaWeCmu7e.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Cookies\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\History\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\A54yMyJIBKZ4.ots desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AdobeARM.log desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\f6eDx z94Dzwz2K8sqE.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\History\History.IE5\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Temporary Internet Files\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Cookies\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\u9Pfn7XvaHQ8ByEI_piG.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\aP3qnxm9od.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\BtC5B7IXSKDZSJgLAe3.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\efFx4Divca0tc4.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\EmLJY8wk7H.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\fdb1k.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\FXSAPIDebugLogFile.txt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\gQXnrhLgWoJRH32GpKD.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\HSDnH8dTNYHVzPB_.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\hViKCLPrU.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\j4n6VZ.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\kmb QJZmXmJi_.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ldLFid8fGd2Cz6.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\lpDj9b.pdf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\MpOa-.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\mS8eZ6n.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\omts.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Qg9FUzDvMpex.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\qgBA8xP0yPHpG.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Sd82F9B.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AhKC9lHcLc.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\U8XmBQFiP7PLq9.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\uRfigoP5hgocNJCg6h.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\w5mAGJ1Y.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WPDNSE\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 6
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.MSO\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.Word\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Virtualized\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\Data\CJW3O3KP.BX7\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\Data\CJW3O3KP.BX7\6NG60CXZ.9GJ\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\Data\CJW3O3KP.BX7\6NG60CXZ.9GJ\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\Data\CJW3O3KP.BX7\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 4
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Deployment\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WTSuSWDiNChTS.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\x850.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ZpuiP.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\CrashReports\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\MSHist012019070920190710\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\MSHist012017071220170713\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 5
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 16
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Event Viewer\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\GDIPFONTCACHEV1.DAT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\1NBUR4HR\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\6ASVN7J7\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\D68G7BIJ\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\KQMHSVKD\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FORMS\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IME12\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IMJP12\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IMJP8_1\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IMJP9_0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\KQMHSVKD\ieonline.microsoft[1] desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FORMS\FRMCACHE.DAT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\1NBUR4HR\fwlink[1] desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\6ASVN7J7\fwlink[1] desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\D68G7BIJ\fwlink[1] desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\KQMHSVKD\fwlink[1] desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 5
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\3LKBQZJ3\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\8NES5H33\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\FKLUIDU0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\OWLVMZRC\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Recovery\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Recovery\Active\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Recovery\Last Active\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Transcoded Files Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.bak desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\frameiconcache.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\CurrentDatabase_372.wmdb desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\System\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\User\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\RoamCache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Publisher\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\TaskSchedulerConfig\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.sig desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\mapisvc.inf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\Outlook.sharing.xml.obi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\content14.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 4
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 8
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\1024\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\1033\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn1\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn2\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\GameExplorer\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\MSHist012019070920190710\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\Low\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\Low\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\Low\History.IE5\MSHist012017071220170713\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\Low\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\thumbs.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Themes\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ERC\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportArchive\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\edb00001.log desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\WindowsMail.MSMessageStore desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\WindowsMail.pat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.chk desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.log desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb00001.log desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00001.jrs desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Green Bubbles.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Hand Prints.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\HandPrints.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Orange Circles.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00002.jrs desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\oeold.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Shades of Blue.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Soft Blue.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\SoftBlue.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Peacock.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft Help\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\WindowsMail.MSMessageStore desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Garden.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Garden.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Peacock.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\2iI83Xqu-SUm9ZsQ.docx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\5Kvc aIyBu.odt.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\7LC7h3NKBPeoe.m4a.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\8DDixiNZtZLaWeCmu7e.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\A54yMyJIBKZ4.ots.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AdobeARM.log.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Cookies\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\History\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\WindowsMail.pat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\WMSDKNS.DTD desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\WMSDKNS.XML desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\AhKC9lHcLc.m4a.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\aP3qnxm9od.flv.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\BtC5B7IXSKDZSJgLAe3.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Cookies\index.dat.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\efFx4Divca0tc4.flv.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\EmLJY8wk7H.png.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\f6eDx z94Dzwz2K8sqE.pptx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\fdb1k.ppt.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\FXSAPIDebugLogFile.txt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\gQXnrhLgWoJRH32GpKD.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\History\History.IE5\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\HSDnH8dTNYHVzPB_.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Temporary Internet Files\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Sd82F9B.ods.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Temporary Internet Files\Content.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 5
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Temporary Internet Files\Content.IE5\03J4UQW0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Temporary Internet Files\Content.IE5\KETAJP6D\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Temporary Internet Files\Content.IE5\VB18B0KB\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Temporary Internet Files\Content.IE5\XT1RPYG9\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Temporary Internet Files\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WPDNSE\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\hViKCLPrU.gif.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\j4n6VZ.png.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\kmb QJZmXmJi_.m4a.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ldLFid8fGd2Cz6.bmp.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\lpDj9b.pdf.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\MpOa-.m4a.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\mS8eZ6n.docx.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\omts.bmp.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Qg9FUzDvMpex.docx.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\qgBA8xP0yPHpG.wav.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Temporary Internet Files\Content.IE5\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\U8XmBQFiP7PLq9.wav.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\u9Pfn7XvaHQ8ByEI_piG.odp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\uRfigoP5hgocNJCg6h.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\w5mAGJ1Y.bmp.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 5
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 5
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\MM5O9XQS\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\PMMR5K9K\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RIJUQL1C\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\X9OHK109\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.MSO\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.Word\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\AntiPhishing\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 5
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\WTSuSWDiNChTS.ppt.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\x850.png.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\ZpuiP.xls.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\Content.IE5\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Low\MSIMGSIZ.DAT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Virtualized\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Virtualized\C\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Virtualized\C\Users\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\VirtualStore\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\Data\CJW3O3KP.BX7\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\Data\CJW3O3KP.BX7\6NG60CXZ.9GJ\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\Data\CJW3O3KP.BX7\6NG60CXZ.9GJ\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\Data\CJW3O3KP.BX7\6NG60CXZ.9GJ\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\Data\CJW3O3KP.BX7\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Deployment\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\CrashReports\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\MSHist012019070920190710\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\MSHist012017071220170713\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 20
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Event Viewer\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\GDIPFONTCACHEV1.DAT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\MSHist012019070920190710\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\index.dat.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\History.IE5\MSHist012017071220170713\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\IconCache.db desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\1NBUR4HR\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\6ASVN7J7\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\D68G7BIJ\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\KQMHSVKD\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FORMS\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IME12\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IMJP12\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IMJP8_1\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IMJP9_0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\1NBUR4HR\fwlink[1].RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\6ASVN7J7\fwlink[1].RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\D68G7BIJ\fwlink[1].RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\index.dat.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\KQMHSVKD\fwlink[1].RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\KQMHSVKD\ieonline.microsoft[1] desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FORMS\FRMCACHE.DAT.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\3LKBQZJ3\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\8NES5H33\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\FKLUIDU0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\OWLVMZRC\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Recovery\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Recovery\Active\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.bak.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\8NES5H33\get.adobe[1].xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\DOMStore\index.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Recovery\Last Active\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Recovery\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\frameiconcache.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Recovery\Last Active\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\Recovery\Last Active\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\CurrentDatabase_372.wmdb desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\LocalMLS_3.wmdb.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\01_Music_auto_rated_at_5_stars.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\02_Music_added_in_the_last_month.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\03_Music_rated_at_4_or_5_stars.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\04_Music_played_in_the_last_month.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\05_Pictures_taken_in_the_last_month.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\06_Pictures_rated_4_or_5_stars.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\07_TV_recorded_in_the_last_week.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\08_Video_rated_at_4_or_5_stars.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\09_Music_played_the_most.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\10_All_Music.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\11_All_Pictures.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\0000E713\12_All_Video.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Transcoded Files Cache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\01_Music_auto_rated_at_5_stars.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\02_Music_added_in_the_last_month.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\03_Music_rated_at_4_or_5_stars.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\04_Music_played_in_the_last_month.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\05_Pictures_taken_in_the_last_month.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\06_Pictures_rated_4_or_5_stars.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\07_TV_recorded_in_the_last_week.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\08_Video_rated_at_4_or_5_stars.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\09_Music_played_the_most.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\10_All_Music.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\11_All_Pictures.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\Sync Playlists\en-US\00010C6E\12_All_Video.wpl desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\System\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\User\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Groove\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\RoamCache\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.sig desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ONetConfig\350db95df4cbd94b2a1c300510e12e11.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\mapisvc.inf.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\Outlook.sharing.xml.obi.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Outlook\RoamCache\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Publisher\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\TaskSchedulerConfig\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 11
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\1024\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\1033\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn1\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\Burn2\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Burn\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\GameExplorer\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\MSHist012019070920190710\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\Low\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\Low\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\Low\History.IE5\MSHist012017071220170713\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\Low\History.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\Low\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\History\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Ringtones\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 5
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 5
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\MM5O9XQS\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\PMMR5K9K\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\RIJUQL1C\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.IE5\X9OHK109\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\content14.dat.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Visio\thumbs.dat.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.MSO\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Content.Word\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 5
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9QH4S0GZ\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ABV8L7MY\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Low\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Virtualized\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Virtualized\C\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Temporary Internet Files\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Themes\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ERC\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\ReportArchive\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\edb00001.log desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\WindowsMail.MSMessageStore desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.chk.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb.log.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edb00001.log.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00001.jrs.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\edbres00002.jrs.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\oeold.xml.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Bears.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Backup\old\WindowsMail.pat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Garden.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Garden.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Stars.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Roses.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Peacock.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Peacock.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Shades of Blue.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\Gadgets\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Sidebar\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft Help\RyukReadMe.html desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\HandPrints.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Hand Prints.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Green Bubbles.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Orange Circles.htm desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\WindowsMail.MSMessageStore desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\WindowsMail.pat.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\WMSDKNS.DTD.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Media\12.0\WMSDKNS.XML.RYK desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Write C:\Documents and Settings\5p5NrGJn0jS HALPmcxz\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\HandPrints.jpg size = 4224 True 1
Fn
Data
For performance reasons, the remaining 4003 entries are omitted.
The remaining entries can be found in glog.xml.
Process (534)
»
Operation Process Additional Information Success Count Logfile
Create taskkill show_window = SW_HIDE True 1
Fn
Create net show_window = SW_HIDE True 1
Fn
Create net show_window = SW_HIDE True 10
Fn
Enumerate Processes - - True 512
Fn
Enumerate Processes - - False 10
Fn
Module (101)
»
Operation Module Additional Information Success Count Logfile
Load api-ms-win-core-synch-l1-2-0 base_address = 0x0 False 2
Fn
Load api-ms-win-core-synch-l1-2-0 base_address = 0x74650000 True 2
Fn
Load api-ms-win-core-fibers-l1-1-1 base_address = 0x0 False 4
Fn
Load kernel32 base_address = 0x0 False 2
Fn
Load kernel32 base_address = 0x76c20000 True 2
Fn
Load api-ms-win-core-localization-l1-2-1 base_address = 0x0 False 2
Fn
Load kernel32.dll base_address = 0x76c20000 True 1
Fn
Load mpr.dll base_address = 0x74b20000 True 1
Fn
Load advapi32.dll base_address = 0x74d40000 True 1
Fn
Load ole32.dll base_address = 0x755e0000 True 1
Fn
Load Shell32.dll base_address = 0x75fd0000 True 1
Fn
Load Iphlpapi.dll base_address = 0x74b50000 True 1
Fn
Get Filename api-ms-win-core-localization-l1-2-1 process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\r1.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\R1.exe, size = 260 True 1
Fn
Get Address c:\windows\syswow64\api-ms-win-core-synch-l1-2-0.dll function = InitializeCriticalSectionEx, address_out = 0x0 False 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsAlloc, address_out = 0x76c34f2b True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsSetValue, address_out = 0x76c34208 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FlsGetValue, address_out = 0x76c31252 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LCMapStringEx, address_out = 0x76cb47f1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = LoadLibraryA, address_out = 0x76c349d7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLastError, address_out = 0x76c311c0 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualFree, address_out = 0x76c3186e True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptExportKey, address_out = 0x74d491ea True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = DeleteFileW, address_out = 0x76c389b3 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDriveTypeW, address_out = 0x76c3418b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCommandLineW, address_out = 0x76c35223 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetStartupInfoW, address_out = 0x76c34d40 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindNextFileW, address_out = 0x76c354ee True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = VirtualAlloc, address_out = 0x76c31856 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetUserNameA, address_out = 0x74d6a4b4 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ExitProcess, address_out = 0x76c37a10 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Wow64RevertWow64FsRedirection, address_out = 0x76c4d668 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessA, address_out = 0x76c31072 True 1
Fn
Get Address c:\windows\syswow64\iphlpapi.dll function = GetIpNetTable, address_out = 0x74b5e52a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetVersionExW, address_out = 0x76c31ae5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Wow64DisableWow64FsRedirection, address_out = 0x76c4d650 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetSystemDefaultLangID, address_out = 0x76c5d346 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = GetUserNameW, address_out = 0x74d5157a True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = ReadFile, address_out = 0x76c33ed3 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegQueryValueExA, address_out = 0x74d548ef True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CloseHandle, address_out = 0x76c31410 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegSetValueExW, address_out = 0x74d514d6 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegCloseKey, address_out = 0x74d5469d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileA, address_out = 0x76c558e5 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesW, address_out = 0x76c4d4f7 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WinExec, address_out = 0x76cb2c21 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDeriveKey, address_out = 0x74d83188 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptGenKey, address_out = 0x74d48ee9 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = Sleep, address_out = 0x76c310ff True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetCurrentProcess, address_out = 0x76c31809 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteW, address_out = 0x75fe3c71 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSize, address_out = 0x76c3196e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GlobalAlloc, address_out = 0x76c3588e True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindClose, address_out = 0x76c34442 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WaitForMultipleObjects, address_out = 0x76c34220 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameA, address_out = 0x76c314b1 True 1
Fn
Get Address c:\windows\syswow64\shell32.dll function = ShellExecuteA, address_out = 0x76217078 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleHandleA, address_out = 0x76c31245 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetModuleFileNameW, address_out = 0x76c34950 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileA, address_out = 0x76c353c6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileSizeEx, address_out = 0x76c359e2 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = WriteFile, address_out = 0x76c31282 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetLogicalDrives, address_out = 0x76c35371 True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetEnumResourceW, address_out = 0x74b23058 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExW, address_out = 0x74d5468d True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetCloseEnum, address_out = 0x74b22dd6 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetWindowsDirectoryW, address_out = 0x76c343e2 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFileAttributesA, address_out = 0x76c4ecd3 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegOpenKeyExA, address_out = 0x74d54907 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointer, address_out = 0x76c317d1 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetTickCount, address_out = 0x76c3110c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileAttributesW, address_out = 0x76c31b18 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FindFirstFileW, address_out = 0x76c34435 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptAcquireContextW, address_out = 0x74d4df14 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = MoveFileExW, address_out = 0x76c49b2d True 1
Fn
Get Address c:\windows\syswow64\mpr.dll function = WNetOpenEnumW, address_out = 0x74b22f06 True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoInitialize, address_out = 0x755fb636 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDecrypt, address_out = 0x74d83178 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptImportKey, address_out = 0x74d4c532 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetFilePointerEx, address_out = 0x76c4c807 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileW, address_out = 0x76c5830d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = FreeLibrary, address_out = 0x76c334c8 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateProcessW, address_out = 0x76c3103d True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateDirectoryW, address_out = 0x76c34259 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateThread, address_out = 0x76c334d5 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptDestroyKey, address_out = 0x74d4c51a True 1
Fn
Get Address c:\windows\syswow64\ole32.dll function = CoCreateInstance, address_out = 0x75629d0b True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CreateFileW, address_out = 0x76c33f5c True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetFileAttributesA, address_out = 0x76c35414 True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = CryptEncrypt, address_out = 0x74d6779b True 1
Fn
Get Address c:\windows\syswow64\advapi32.dll function = RegDeleteValueW, address_out = 0x74d4cf31 True 1
Fn
Service (30)
»
Operation Additional Information Success Count Logfile
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Enumerate database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
User (1)
»
Operation Additional Information Success Count Logfile
Lookup Privilege privilege = SeBackupPrivilege, luid = 17 True 1
Fn
System (30)
»
Operation Additional Information Success Count Logfile
Sleep duration = 1000 milliseconds (1.000 seconds) True 1
Fn
Sleep duration = 150 milliseconds (0.150 seconds) True 14
Fn
Sleep duration = 50000 milliseconds (50.000 seconds) True 10
Fn
Get Time type = System Time, time = 2019-07-08 14:39:40 (UTC) True 1
Fn
Get Time type = Performance Ctr, time = 14935343333 True 1
Fn
Get Info type = Operating System True 1
Fn
Get Info type = Windows Directory, result_out = C:\Windows True 2
Fn
Environment (1)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 1
Fn
Data
Process #2: taskkill.exe
0 0
»
Information Value
ID #2
File Name c:\windows\syswow64\taskkill.exe
Command Line "C:\Windows\System32\taskkill.exe" /IM destroyed_words.exe /F
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:34, Reason: Child Process
Unmonitor End Time: 00:00:44, Reason: Self Terminated
Monitor Duration 00:00:09
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x810
Parent PID 0x9c8 (c:\users\5p5nrgjn0js halpmcxz\desktop\r1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 4F0
0x 94C
0x 978
0x C6C
0x C70
Process #3: net.exe
0 0
»
Information Value
ID #3
File Name c:\windows\syswow64\net.exe
Command Line "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:34, Reason: Child Process
Unmonitor End Time: 00:00:46, Reason: Self Terminated
Monitor Duration 00:00:11
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x56c
Parent PID 0x9c8 (c:\users\5p5nrgjn0js halpmcxz\desktop\r1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 570
Process #4: net.exe
0 0
»
Information Value
ID #4
File Name c:\windows\syswow64\net.exe
Command Line "C:\Windows\System32\net.exe" stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:35, Reason: Child Process
Unmonitor End Time: 00:00:37, Reason: Self Terminated
Monitor Duration 00:00:02
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x80c
Parent PID 0x9c8 (c:\users\5p5nrgjn0js halpmcxz\desktop\r1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 7A0
Process #5: net1.exe
50 0
»
Information Value
ID #5
File Name c:\windows\syswow64\net1.exe
Command Line C:\Windows\system32\net1 stop "audioendpointbuilder" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:35, Reason: Child Process
Unmonitor End Time: 00:00:45, Reason: Self Terminated
Monitor Duration 00:00:09
OS Process Information
»
Information Value
PID 0x9a4
Parent PID 0x56c (c:\windows\syswow64\net.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 944
Host Behavior
File (32)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_OUTPUT_HANDLE type = file_type True 15
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Write STD_OUTPUT_HANDLE size = 169 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 2 True 7
Fn
Data
Write STD_OUTPUT_HANDLE size = 16 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 37 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 1 True 2
Fn
Data
Write STD_OUTPUT_HANDLE size = 53 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 54 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 70 True 1
Fn
Data
Module (3)
»
Operation Module Additional Information Success Count Logfile
Load NETMSG base_address = 0x74300000 True 1
Fn
Get Handle c:\windows\syswow64\net1.exe base_address = 0x2b0000 True 1
Fn
Get Filename - process_name = c:\windows\syswow64\net1.exe, file_name_orig = C:\Windows\SysWOW64\net1.exe, size = 260 True 1
Fn
Service (10)
»
Operation Additional Information Success Count Logfile
Get Display Name database_name = SERVICES_ACTIVE_DATABASE True 3
Fn
Get Display Name database_name = SERVICES_ACTIVE_DATABASE True 2
Fn
Get Info service_name = AUDIOENDPOINTBUILDER True 1
Fn
Get Info service_name = AUDIOENDPOINTBUILDER True 1
Fn
Get Service Name database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (5)
»
Operation Additional Information Success Count Logfile
Sleep duration = 2500 milliseconds (2.500 seconds) True 2
Fn
Get Time type = System Time, time = 2019-07-08 14:39:46 (UTC) True 1
Fn
Get Time type = Ticks, time = 104739 True 1
Fn
Get Time type = Performance Ctr, time = 15713635982 True 1
Fn
Process #6: net1.exe
20 0
»
Information Value
ID #6
File Name c:\windows\syswow64\net1.exe
Command Line C:\Windows\system32\net1 stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:36, Reason: Child Process
Unmonitor End Time: 00:00:40, Reason: Self Terminated
Monitor Duration 00:00:04
OS Process Information
»
Information Value
PID 0x918
Parent PID 0x80c (c:\windows\syswow64\net.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 3D0
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_ERROR_HANDLE type = file_type True 4
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Write STD_ERROR_HANDLE size = 71 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 2 True 2
Fn
Data
Write STD_ERROR_HANDLE size = 52 True 1
Fn
Data
Module (3)
»
Operation Module Additional Information Success Count Logfile
Load NETMSG base_address = 0x74300000 True 1
Fn
Get Handle c:\windows\syswow64\net1.exe base_address = 0x2b0000 True 1
Fn
Get Filename - process_name = c:\windows\syswow64\net1.exe, file_name_orig = C:\Windows\SysWOW64\net1.exe, size = 260 True 1
Fn
Service (4)
»
Operation Additional Information Success Count Logfile
Get Info service_name = SAMSS True 1
Fn
Get Service Name database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-08 14:39:46 (UTC) True 1
Fn
Get Time type = Ticks, time = 104707 True 1
Fn
Get Time type = Performance Ctr, time = 15710944863 True 1
Fn
Process #8: net.exe
0 0
»
Information Value
ID #8
File Name c:\windows\syswow64\net.exe
Command Line "C:\Windows\System32\net.exe" stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:49, Reason: Child Process
Unmonitor End Time: 00:00:50, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x1b74
Parent PID 0x9c8 (c:\users\5p5nrgjn0js halpmcxz\desktop\r1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 1B78
Process #9: net1.exe
20 0
»
Information Value
ID #9
File Name c:\windows\syswow64\net1.exe
Command Line C:\Windows\system32\net1 stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:00:49, Reason: Child Process
Unmonitor End Time: 00:00:50, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x1c80
Parent PID 0x1b74 (c:\windows\syswow64\net.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 1C84
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_ERROR_HANDLE type = file_type True 4
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Write STD_ERROR_HANDLE size = 71 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 2 True 2
Fn
Data
Write STD_ERROR_HANDLE size = 52 True 1
Fn
Data
Module (3)
»
Operation Module Additional Information Success Count Logfile
Load NETMSG base_address = 0x74500000 True 1
Fn
Get Handle c:\windows\syswow64\net1.exe base_address = 0x940000 True 1
Fn
Get Filename - process_name = c:\windows\syswow64\net1.exe, file_name_orig = C:\Windows\SysWOW64\net1.exe, size = 260 True 1
Fn
Service (4)
»
Operation Additional Information Success Count Logfile
Get Info service_name = SAMSS True 1
Fn
Get Service Name database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 1627-02-27 17:25:04 (UTC) True 1
Fn
Get Time type = Ticks, time = 114691 True 1
Fn
Get Time type = Performance Ctr, time = 17000158149 True 1
Fn
Process #10: net.exe
0 0
»
Information Value
ID #10
File Name c:\windows\syswow64\net.exe
Command Line "C:\Windows\System32\net.exe" stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:00, Reason: Child Process
Unmonitor End Time: 00:01:01, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x3744
Parent PID 0x9c8 (c:\users\5p5nrgjn0js halpmcxz\desktop\r1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 3748
Process #11: net1.exe
20 0
»
Information Value
ID #11
File Name c:\windows\syswow64\net1.exe
Command Line C:\Windows\system32\net1 stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:00, Reason: Child Process
Unmonitor End Time: 00:01:01, Reason: Self Terminated
Monitor Duration 00:00:00
OS Process Information
»
Information Value
PID 0x3914
Parent PID 0x3744 (c:\windows\syswow64\net.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 3918
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_ERROR_HANDLE type = file_type True 4
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Write STD_ERROR_HANDLE size = 71 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 2 True 2
Fn
Data
Write STD_ERROR_HANDLE size = 52 True 1
Fn
Data
Module (3)
»
Operation Module Additional Information Success Count Logfile
Load NETMSG base_address = 0x74710000 True 1
Fn
Get Handle c:\windows\syswow64\net1.exe base_address = 0xa80000 True 1
Fn
Get Filename - process_name = c:\windows\syswow64\net1.exe, file_name_orig = C:\Windows\SysWOW64\net1.exe, size = 260 True 1
Fn
Service (4)
»
Operation Additional Information Success Count Logfile
Get Info service_name = SAMSS True 1
Fn
Get Service Name database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 1627-02-27 17:25:15 (UTC) True 1
Fn
Get Time type = Ticks, time = 125877 True 1
Fn
Get Time type = Performance Ctr, time = 18118987316 True 1
Fn
Process #12: net.exe
0 0
»
Information Value
ID #12
File Name c:\windows\syswow64\net.exe
Command Line "C:\Windows\System32\net.exe" stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:10, Reason: Child Process
Unmonitor End Time: 00:01:13, Reason: Self Terminated
Monitor Duration 00:00:02
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x5150
Parent PID 0x9c8 (c:\users\5p5nrgjn0js halpmcxz\desktop\r1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 5154
Process #13: net1.exe
20 0
»
Information Value
ID #13
File Name c:\windows\syswow64\net1.exe
Command Line C:\Windows\system32\net1 stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:11, Reason: Child Process
Unmonitor End Time: 00:01:13, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x5314
Parent PID 0x5150 (c:\windows\syswow64\net.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 5318
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_ERROR_HANDLE type = file_type True 4
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Write STD_ERROR_HANDLE size = 71 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 2 True 2
Fn
Data
Write STD_ERROR_HANDLE size = 52 True 1
Fn
Data
Module (3)
»
Operation Module Additional Information Success Count Logfile
Load NETMSG base_address = 0x74500000 True 1
Fn
Get Handle c:\windows\syswow64\net1.exe base_address = 0x320000 True 1
Fn
Get Filename - process_name = c:\windows\syswow64\net1.exe, file_name_orig = C:\Windows\SysWOW64\net1.exe, size = 260 True 1
Fn
Service (4)
»
Operation Additional Information Success Count Logfile
Get Info service_name = SAMSS True 1
Fn
Get Service Name database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-08 14:40:18 (UTC) True 1
Fn
Get Time type = Ticks, time = 136859 True 1
Fn
Get Time type = Performance Ctr, time = 19218738761 True 1
Fn
Process #14: net.exe
0 0
»
Information Value
ID #14
File Name c:\windows\syswow64\net.exe
Command Line "C:\Windows\System32\net.exe" stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:22, Reason: Child Process
Unmonitor End Time: 00:01:23, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x61fc
Parent PID 0x9c8 (c:\users\5p5nrgjn0js halpmcxz\desktop\r1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 6200
Process #15: net1.exe
20 0
»
Information Value
ID #15
File Name c:\windows\syswow64\net1.exe
Command Line C:\Windows\system32\net1 stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:22, Reason: Child Process
Unmonitor End Time: 00:01:23, Reason: Self Terminated
Monitor Duration 00:00:00
OS Process Information
»
Information Value
PID 0x6260
Parent PID 0x61fc (c:\windows\syswow64\net.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 6264
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_ERROR_HANDLE type = file_type True 4
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Write STD_ERROR_HANDLE size = 71 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 2 True 2
Fn
Data
Write STD_ERROR_HANDLE size = 52 True 1
Fn
Data
Module (3)
»
Operation Module Additional Information Success Count Logfile
Load NETMSG base_address = 0x74710000 True 1
Fn
Get Handle c:\windows\syswow64\net1.exe base_address = 0x100000 True 1
Fn
Get Filename - process_name = c:\windows\syswow64\net1.exe, file_name_orig = C:\Windows\SysWOW64\net1.exe, size = 260 True 1
Fn
Service (4)
»
Operation Additional Information Success Count Logfile
Get Info service_name = SAMSS True 1
Fn
Get Service Name database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-08 14:40:29 (UTC) True 1
Fn
Get Time type = Ticks, time = 147904 True 1
Fn
Get Time type = Performance Ctr, time = 20324173279 True 1
Fn
Process #16: net.exe
0 0
»
Information Value
ID #16
File Name c:\windows\syswow64\net.exe
Command Line "C:\Windows\System32\net.exe" stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:33, Reason: Child Process
Unmonitor End Time: 00:01:36, Reason: Self Terminated
Monitor Duration 00:00:02
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x75b0
Parent PID 0x9c8 (c:\users\5p5nrgjn0js halpmcxz\desktop\r1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 75B4
Process #17: net1.exe
20 0
»
Information Value
ID #17
File Name c:\windows\syswow64\net1.exe
Command Line C:\Windows\system32\net1 stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:34, Reason: Child Process
Unmonitor End Time: 00:01:36, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0x7718
Parent PID 0x75b0 (c:\windows\syswow64\net.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 771C
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_ERROR_HANDLE type = file_type True 4
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Write STD_ERROR_HANDLE size = 71 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 2 True 2
Fn
Data
Write STD_ERROR_HANDLE size = 52 True 1
Fn
Data
Module (3)
»
Operation Module Additional Information Success Count Logfile
Load NETMSG base_address = 0x74500000 True 1
Fn
Get Handle c:\windows\syswow64\net1.exe base_address = 0x260000 True 1
Fn
Get Filename - process_name = c:\windows\syswow64\net1.exe, file_name_orig = C:\Windows\SysWOW64\net1.exe, size = 260 True 1
Fn
Service (4)
»
Operation Additional Information Success Count Logfile
Get Info service_name = SAMSS True 1
Fn
Get Service Name database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-08 14:40:41 (UTC) True 1
Fn
Get Time type = Ticks, time = 159776 True 1
Fn
Get Time type = Performance Ctr, time = 21511459477 True 1
Fn
Process #18: net.exe
0 0
»
Information Value
ID #18
File Name c:\windows\syswow64\net.exe
Command Line "C:\Windows\System32\net.exe" stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:44, Reason: Child Process
Unmonitor End Time: 00:01:46, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0x8ab4
Parent PID 0x9c8 (c:\users\5p5nrgjn0js halpmcxz\desktop\r1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 8AB8
Process #19: net1.exe
20 0
»
Information Value
ID #19
File Name c:\windows\syswow64\net1.exe
Command Line C:\Windows\system32\net1 stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:45, Reason: Child Process
Unmonitor End Time: 00:01:46, Reason: Self Terminated
Monitor Duration 00:00:00
OS Process Information
»
Information Value
PID 0x8be0
Parent PID 0x8ab4 (c:\windows\syswow64\net.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 8BE4
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_ERROR_HANDLE type = file_type True 4
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Write STD_ERROR_HANDLE size = 71 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 2 True 2
Fn
Data
Write STD_ERROR_HANDLE size = 52 True 1
Fn
Data
Module (3)
»
Operation Module Additional Information Success Count Logfile
Load NETMSG base_address = 0x74710000 True 1
Fn
Get Handle c:\windows\syswow64\net1.exe base_address = 0xc30000 True 1
Fn
Get Filename - process_name = c:\windows\syswow64\net1.exe, file_name_orig = C:\Windows\SysWOW64\net1.exe, size = 260 True 1
Fn
Service (4)
»
Operation Additional Information Success Count Logfile
Get Info service_name = SAMSS True 1
Fn
Get Service Name database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-08 14:40:51 (UTC) True 1
Fn
Get Time type = Ticks, time = 170493 True 1
Fn
Get Time type = Performance Ctr, time = 22584145692 True 1
Fn
Process #20: net.exe
0 0
»
Information Value
ID #20
File Name c:\windows\syswow64\net.exe
Command Line "C:\Windows\System32\net.exe" stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:55, Reason: Child Process
Unmonitor End Time: 00:01:58, Reason: Self Terminated
Monitor Duration 00:00:03
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xa1dc
Parent PID 0x9c8 (c:\users\5p5nrgjn0js halpmcxz\desktop\r1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A1E0
Process #21: net1.exe
20 0
»
Information Value
ID #21
File Name c:\windows\syswow64\net1.exe
Command Line C:\Windows\system32\net1 stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:01:57, Reason: Child Process
Unmonitor End Time: 00:01:58, Reason: Self Terminated
Monitor Duration 00:00:01
OS Process Information
»
Information Value
PID 0xa4ec
Parent PID 0xa1dc (c:\windows\syswow64\net.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x A4F0
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_ERROR_HANDLE type = file_type True 4
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Write STD_ERROR_HANDLE size = 71 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 2 True 2
Fn
Data
Write STD_ERROR_HANDLE size = 52 True 1
Fn
Data
Module (3)
»
Operation Module Additional Information Success Count Logfile
Load NETMSG base_address = 0x74500000 True 1
Fn
Get Handle c:\windows\syswow64\net1.exe base_address = 0xce0000 True 1
Fn
Get Filename - process_name = c:\windows\syswow64\net1.exe, file_name_orig = C:\Windows\SysWOW64\net1.exe, size = 260 True 1
Fn
Service (4)
»
Operation Additional Information Success Count Logfile
Get Info service_name = SAMSS True 1
Fn
Get Service Name database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-08 14:41:04 (UTC) True 1
Fn
Get Time type = Ticks, time = 183425 True 1
Fn
Get Time type = Performance Ctr, time = 23881230517 True 1
Fn
Process #22: net.exe
0 0
»
Information Value
ID #22
File Name c:\windows\syswow64\net.exe
Command Line "C:\Windows\System32\net.exe" stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:02:06, Reason: Child Process
Unmonitor End Time: 00:02:08, Reason: Self Terminated
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xb6a4
Parent PID 0x9c8 (c:\users\5p5nrgjn0js halpmcxz\desktop\r1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B6A8
Process #23: net1.exe
20 0
»
Information Value
ID #23
File Name c:\windows\syswow64\net1.exe
Command Line C:\Windows\system32\net1 stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:02:07, Reason: Child Process
Unmonitor End Time: 00:02:08, Reason: Self Terminated
Monitor Duration 00:00:00
OS Process Information
»
Information Value
PID 0xb888
Parent PID 0xb6a4 (c:\windows\syswow64\net.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x B88C
Host Behavior
File (10)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_ERROR_HANDLE type = file_type True 4
Fn
Open STD_OUTPUT_HANDLE - True 1
Fn
Open STD_ERROR_HANDLE - True 1
Fn
Write STD_ERROR_HANDLE size = 71 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 2 True 2
Fn
Data
Write STD_ERROR_HANDLE size = 52 True 1
Fn
Data
Module (3)
»
Operation Module Additional Information Success Count Logfile
Load NETMSG base_address = 0x74720000 True 1
Fn
Get Handle c:\windows\syswow64\net1.exe base_address = 0xc60000 True 1
Fn
Get Filename - process_name = c:\windows\syswow64\net1.exe, file_name_orig = C:\Windows\SysWOW64\net1.exe, size = 260 True 1
Fn
Service (4)
»
Operation Additional Information Success Count Logfile
Get Info service_name = SAMSS True 1
Fn
Get Service Name database_name = SERVICES_ACTIVE_DATABASE False 1
Fn
Open database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
Open Manager database_name = SERVICES_ACTIVE_DATABASE True 1
Fn
System (3)
»
Operation Additional Information Success Count Logfile
Get Time type = System Time, time = 2019-07-08 14:41:14 (UTC) True 1
Fn
Get Time type = Ticks, time = 192630 True 1
Fn
Get Time type = Performance Ctr, time = 24801722053 True 1
Fn
Process #24: net.exe
0 0
»
Information Value
ID #24
File Name c:\windows\syswow64\net.exe
Command Line "C:\Windows\System32\net.exe" stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:02:17, Reason: Child Process
Unmonitor End Time: 00:02:18, Reason: Terminated by Timeout
Monitor Duration 00:00:01
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xc3a4
Parent PID 0x9c8 (c:\users\5p5nrgjn0js halpmcxz\desktop\r1.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x C3A8
Process #25: net1.exe
0 0
»
Information Value
ID #25
File Name c:\windows\syswow64\net1.exe
Command Line C:\Windows\system32\net1 stop "samss" /y
Initial Working Directory C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\
Monitor Start Time: 00:02:17, Reason: Child Process
Unmonitor End Time: 00:02:18, Reason: Terminated by Timeout
Monitor Duration 00:00:00
Remark No high level activity detected in monitored regions
OS Process Information
»
Information Value
PID 0xc47c
Parent PID 0xc3a4 (c:\windows\syswow64\net.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username XDUWTFONO\5p5NrGJn0jS HALPmcxz
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x C480
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image