rlrgwq.exe
Windows Exe (x86-32)
Created at 2019-05-29T00:45:00
Monitored Processes
Behavior Information - Sequential View
Process #1: rlrgwq.exe
11033
0
| Information | Value |
|---|---|
| ID | #1 |
| File Name | c:\users\5p5nrgjn0js halpmcxz\desktop\rlrgwq.exe |
| Command Line | "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rlrgwq.exe" |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:35, Reason: Analysis Target |
| Unmonitor | End Time: 00:01:02, Reason: Self Terminated |
| Monitor Duration | 00:00:27 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xa68 |
| Parent PID | 0x45c (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
A6C
0x
A78
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| rlrgwq.exe | 0x00400000 | 0x0040DFFF | Content Changed | - | 32-bit | 0x004070A6, 0x00406C91, ... |
|
|
|
| rlrgwq.exe | 0x00400000 | 0x0040DFFF | Relevant Image | - | 32-bit | - |
|
|
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rlrgwq.exe | 53.00 KB |
MD5:
6d92f32b6611ba982fd122c1f0af68a8
SHA1: 06eead569c68a759ede51f4dfc6cafbdbec770e5 SHA256: b40b147728289e7d7216008c66a7c94ea9adf5a3d37b3dac1099d4524391f3b4 SSDeep: 768:mvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B52MM1XRT:8eytM3alnawrRIwxVSHMweio3jM15 |
|
|
| C:\Users\desktop.ini | 1.09 KB |
MD5:
c8d89a09a77523f9c1a1d8c6f0c79e10
SHA1: c57188102e2ad07a85f7b22ab6c87bd36c77ede9 SHA256: 5a6257d94bf3b4d126a79d7074641349642e1e9f8ee2f2c65efb4190a6a6ad7c SSDeep: 24:ziyf0uM42+W7gz2JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdy0T:ziaVQQzIfi4eshyIK+HMBk3K6tzJf3T |
|
|
| C:\Users\Public\Recorded TV\Sample Media\desktop.ini | 1.09 KB |
MD5:
42aa40c4462dab34b09a21da141df7ff
SHA1: 9fba1a2923b39268bf99bf22620a3478a00d8e26 SHA256: 6431c215eb2132d5a15df67585bbaef4930074ddfcedf90bef5da7d59f090d46 SSDeep: 24:ejpaNh62Iwb+XJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdgo:ejpaeFfi4eshyIK+HMBk3K6tzJfeo |
|
|
| C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg | 859.71 KB |
MD5:
afd3ef12e6e6e3bccab2d02c883f7a5c
SHA1: a887eac4d84a278e4fc00572486943713c6a1777 SHA256: 1fe039e6a6ae4aea78936fd1bf01a2264fe768926df0886814c7c845f9f8b8a0 SSDeep: 24576:YF+MO4pgomr2LW2cAXRb35yCft67mIEjP02s7:Yc9vr2463ECFmm3jP02s7 |
|
|
| C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg | 760.53 KB |
MD5:
e4a6ad330d0f34af2194cd4ba11c7a5f
SHA1: d6434889a924fe45efd2e74adb3aeaba409a5104 SHA256: cd09c6c4dd0165654cdf5beb4f2e9a2ef38b1c7f1ad9b7e6b416a9ba0b5e2e69 SSDeep: 12288:CjclL4UL90ErwpYCRL2gEUwTjHvkJT4R7fsSHsorLZMnoBiF8/xt8Pv1IPR1hn9u:8clsgCEORL2gE9kJTo7tPJMoBiF8/xto |
|
|
| C:\Users\Public\Libraries\RecordedTV.library-ms | 1.78 KB |
MD5:
57c7f1faaad012ab126e17de98955a33
SHA1: 86611eb8facf9970382afde19fc306562baf744f SHA256: 5e8adf327bc3e4f58598376c3b3fdf0ffd4417c8c2bf42f216364dd8a71de8bf SSDeep: 48:pK9zUQwIp4CmQn0Xfi4eshyIK+HMBk3K6tzJf8XI:4bfmQn0/LHMnczN |
|
|
| C:\Users\Default\NTUSER.DAT.LOG | 1.92 KB |
MD5:
1bdc5f624f881f8cf00edfde433e5c18
SHA1: a9cf52c7413e82427356d33a0dc44f70c7c537df SHA256: 1357ddfe8515f22e842b3a5ca4193d35aba21a5738fcedd9c7a6557147df8963 SSDeep: 48:mOq0B7NotGvlnOmBmYJhzmJKBzfPfi4eshyIK+HMBk3K6tzJffQG:mOJ7St2OqJhiJobLHMnczpQG |
|
|
| C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms | 512.92 KB |
MD5:
9d1bbde940a4d438c6c332b57f9eace9
SHA1: 5d1f0d13888686a8d21c77172c39534620fce200 SHA256: 95b3da5ec1d6535a9c675ee83b28b2194099c489547887b1500f12d7efda4b20 SSDeep: 6144:jpMy6IGjNl8pJBq39ljbc6MHwJd9KGvXl8LY6+j/Tu9C/Xq4:jqNjNCk3j46979D6Y9/TB/b |
|
|
| C:\Users\Default\Pictures\desktop.ini | 1.42 KB |
MD5:
a9b1a854640003c1b01608a53504b852
SHA1: bcd8e7d74151de18dcc09b847434d1f52e3373d8 SHA256: 86bc3e2cc39b565fb1c0a5bdc3449e9aed707c2d55716d9a4574d8a4341b07ed SSDeep: 24:KVmw942x5ro3yK0Yf30ZNwCRn+KwtyJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJZ:1Cf7rob0u0ACRn+Sfi4eshyIK+HMBk3H |
|
|
| C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\cab1.cab.[new_wave@tuta.io].LotR | 4.71 MB |
MD5:
59b12f295d908bc21664d25e49291eaf
SHA1: cc36ce9a188af5fed7911d31ed79c9644288b435 SHA256: 89a9563611facda0e7b6c8d2e37254ec830be0ae758a219efdf06c3e6e2d077a SSDeep: 98304:hZrriN1hqvEGckVWABO88onvNEKCtnck5m68AdHn+o4gJeB+Xyqi+81Wn:jrre1hqvEGcIO8RvNItck5mjAdyuKsy4 |
|
|
| C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\state.rsm.[new_wave@tuta.io].LotR | 1.67 KB |
MD5:
a359bf5f8ec3a3ff47cd6174fa38301c
SHA1: d453f1a215892e56687cd86a199aaa82d1cb88a1 SHA256: bec78e938cd51f8f016358b9241e436f35ad35c818409e99e313b63ad9687095 SSDeep: 48:tUda/HhicRdHm1t3gcE6cJImjTJfi4eshyIK+HMBk3K6tzJfZNfw:ywPh1GPwcKJb5LHMncztfw |
|
|
| C:\#NEW_WAVE.html | 4.39 KB |
MD5:
58ad195e9d0095a431a264750c2da5ce
SHA1: 36694cb4e6c9a7258961769e19f29b0e41c03057 SHA256: 9f65b685b71917ea3347a705bcaefd9be15f5e99a27d1519c3f2e8beef618e2a SSDeep: 96:WfGTAYLZ6LxJQKvQXT6W7Ufh4LHMnczJBVF3cRJk:WfG7ovQuAUJrn+p+ |
|
|
| C:\Users\Public\FE3523FAA45D11A890B51B95FAFBCEE159EA84E416AE3EBE497EE9F0BF90B688 | 1.00 KB |
MD5:
5f69c5b88893e09ed4905ed5db8a2c8d
SHA1: ef376e7d88c2feabd2cc2c11b3e2a2b962587a70 SHA256: f76056c3f738bbea95f6eb05731103bef2f9dcb643b91c145f447481d498b822 SSDeep: 24:M0phrqlJdq8JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdn:KJAKfi4eshyIK+HMBk3K6tzJfd |
|
|
| C:\BOOTSECT.BAK | 8.92 KB |
MD5:
f8af30243ac7e9add5221964bc22b0c4
SHA1: 42331b36d0d02d8f68a13bbecd33bfdd00d4786e SHA256: 5e214d87188b582831d61de4b42521741d881e9daf7df126411489609e6f3b35 SSDeep: 192:YsTsXdmDXptJ0y+fhnkKA0sR0v83rEKjnqz:MKh6/AbRfYKjm |
|
|
| C:\Users\Public\desktop.ini | 1.09 KB |
MD5:
fb149115f9f506b1fa1516e23c49c61c
SHA1: e80a49aba0ea10a73d79dfe6352cfd0f24630078 SHA256: d8a5170e1a50c42bb0d13765af59ba7eba04e35423406099f6efe33c0247149d SSDeep: 24:Ph328FYdKNBahRZJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdJ4V:Ph32rK3abfi4eshyIK+HMBk3K6tzJfve |
|
|
| C:\Users\Public\Videos\desktop.ini | 1.30 KB |
MD5:
dd28d7c8c3a535d9d2a19e36995b7ce9
SHA1: 1fbaca54ba301940d9573f45f655ea2ef409da09 SHA256: d792dfa879c3e72e2a2f825fcd25d0fa9e83b4bdc6d6746d35a1889f752fb7d4 SSDeep: 24:9cH//r5K9k+26aYPzD0JJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd84:mH//l2u6aYP38fi4eshyIK+HMBk3K6tx |
|
|
| C:\Users\Public\Videos\Sample Videos\desktop.ini | 1.25 KB |
MD5:
9e1944825576bb5b5ca0e83e5d7a0e28
SHA1: 4b976f152134324463d06f7f461fe4a37a440bc5 SHA256: 7ffb5e61bacc268b763b205f2c71111d2063144fa64f2f2f8971606e886d8ca4 SSDeep: 24:2Q/miXHZwo95tMvgJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd/A:2S1JB1fi4eshyIK+HMBk3K6tzJfy |
|
|
| C:\Users\Public\Videos\Sample Videos\Wildlife.wmv | 25.03 MB |
MD5:
b49d0287ce65a4a6a7e97c30dd618128
SHA1: 80e365ab990fbda522b82c093d32de41160a1bad SHA256: e5d2454eec54321f2c3a35bc543d44617b09a2ac889908d75c7a272af0b0d06a SSDeep: 196608:JKNUU7bSyPuTAkjtHXo+5/9xM+Z2i0SOIeFlfZ8lPQGvwGj5Yza:K3Onjf/zMw0SZeFZwPQGj |
|
|
| C:\Users\Public\Recorded TV\desktop.ini | 1.00 KB |
MD5:
5d6f5027bf28017c86f3aed425a82dd3
SHA1: 6af758f31fc7e58b929199bfd0d103c9aac9aae3 SHA256: 048656eaf1586dc7b82a5ac8bc218166b08fbe657115824a1143896540dae36a SSDeep: 24:xYg0VKKe3iJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfddTj:SVKCfi4eshyIK+HMBk3K6tzJfvTj |
|
|
| C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv | 9.25 MB |
MD5:
01ff8110e375f2ab7fd734b2032c585c
SHA1: 782368ec1344d0368b63e4ecf5083f32843c70c6 SHA256: abdfc1753097757d34292a51d88345a5a38a6ee6509372c86fd093bb408929c6 SSDeep: 196608:/TFQYZWZ516PpuVzsmmQ7tbq6jZCzZTlkcEEnluDbBHsz8LDa61oTe2uo4i98cxW:/JbZ8iPWZmQ7djSgIluug/acTo98rZ5 |
|
|
| C:\Users\Public\Pictures\desktop.ini | 1.30 KB |
MD5:
f35ea737ef6c748a68e1a6265739d714
SHA1: 96160d23946a7cf8c02417fecbe3d77a2710586a SHA256: ec3f17e36fe1c568a097e79d2bdd21d7644df6a4fa87662bd0ec1f775b3397f4 SSDeep: 24:rAE5UDCIYZeFHGFJ818W2JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdtLno4f4:rtU+PeFHg81lIfi4eshyIK+HMBk3K6tc |
|
|
| C:\Users\Public\Pictures\Sample Pictures\Desert.jpg | 827.04 KB |
MD5:
8da46be5eca0bb829a7c1952fd197d9a
SHA1: 6b6796b1eca16b818443265f6e684a5d9d6e1605 SHA256: 7185b6ffef0aaac1f427c0b78737951b22394663964318b1258b527c60e28058 SSDeep: 12288:ROgyAlTN7hHwUqtqYaHM5ocmN7cYlZpdNvXSioNHAo7sGpWtlwzueBuxdw5225AF:U8TN7fqBOM5ocackxNvXSFK1tmCeuxgk |
|
|
| C:\Users\Public\Pictures\Sample Pictures\desktop.ini | 2.02 KB |
MD5:
5f65413c3cee2239239fbc7ac64f40fc
SHA1: bbd2efdc3dab40fb90b85403998aa4558935ccc6 SHA256: 810fb368274cd5b323c0e26e6e6d8cb95d8f95e2e758c854310e5d56b6472845 SSDeep: 48:MifcbJvIP+bZvU/3Stg31uC+nZOqZfi4eshyIK+HMBk3K6tzJf6:MifMJvG+bdUitgFlEOqJLHMnczI |
|
|
| C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg | 582.27 KB |
MD5:
2a6370cbbbdbc61691749a79d0ee439d
SHA1: ecd29590d9d797555915233f09f0c1434cb23e15 SHA256: 90f925d03829c7050d84b237654e987a212b288ad4497f21eba2e4fe8e8b39af SSDeep: 12288:FgkcwRoMuAFSH0jmC7PL2QP8W+JP3HGmVnu6L8TqlBr9OW:eOOAFSH4z7PL2CWPlnu6SMBROW |
|
|
| C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg | 758.45 KB |
MD5:
e3cad6a0ea1169362a181c59bfc6ae2f
SHA1: c466337e477e7c31d4d943d7ede71545643b82a1 SHA256: e766d726f5a8e1125be0479735b2032ecf78bdfed6048767676ed8834c8df7b7 SSDeep: 12288:6jWw4wgfvnnqRHVONF6IMqr9rWznD2qRDuz2tEWtCRLpnRzgwBeBus9OeFkxteuQ:u4wIqR108I0zDnEW0ZpnRn0BV9cteaM |
|
|
| C:\Users\Public\Pictures\Sample Pictures\Koala.jpg | 763.45 KB |
MD5:
444c66dc758090a495fbca5193c76af0
SHA1: fecc4461b5576e711df4722a47ef6729da4e4f4e SHA256: d72786ba0a543de92b6e184b80a819d54dd5ecea583fabcbd8353ecaecd50317 SSDeep: 12288:tu3uk7AUYYGsVymRg2x036LsLNKqm4zVEbx0RrS9l1Dc8Gjz:Guk8UYYqm+bKLs59m4pEbxyro1Lwz |
|
|
| C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg | 549.05 KB |
MD5:
39242446dd019c82f0582dfd128d4b47
SHA1: 3c0f62ae3df11aa252071daec7178b89b062fdc5 SHA256: 2dc8528f15eb2834e84b94b62c9dc4068707f62f1217bde71b254382334135d6 SSDeep: 12288:2+34XLWur3ZNnnVD0ZHi489yTMvS0vNtOg17JusCkJ5Ye3AEtI9BW3I8mVEvPtco:D4aur3Lnl+C4/Mtd355YqrM8Mk3 |
|
|
| C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg | 607.26 KB |
MD5:
26fcaf302d43ebeb78700d7040278b85
SHA1: 751b83c655828f42fd1e3b33b41e0992af5857ab SHA256: 896da5fc2fdb3c4e60d6b65a701b525d5acab559ceb8afee4a42bd8c6ec319bb SSDeep: 12288:wEuufF1/dZY1botRDvhqz1GORbsIcGWcCQgYiiCr3aJ2:vZfH/dZ33Dkz1GORbsIcMLjCr3aJ2 |
|
|
| C:\Users\Public\Music\desktop.ini | 1.30 KB |
MD5:
a30214d80a70904778a034283c040f90
SHA1: d7f7c4533f8eea6b0f47e888142c5449979dd1dc SHA256: b94613dca5ef3b5f2d13cb40953767b3d204f8be3b3884d974e91f8973880de2 SSDeep: 24:CtGMQHLhcsrjDrJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdW7p:CYLrieVfi4eshyIK+HMBk3K6tzJfwN |
|
|
| C:\Users\Public\Music\Sample Music\desktop.ini | 1.50 KB |
MD5:
8bcdd581dea9f59df6a3a4760227be22
SHA1: 17722f2eec50f4a5fcd1498f0d77147c8276c1eb SHA256: cf97b95530342a9655bb5449bfe74ea785ff07ff5d601494fbdb716001e7dba9 SSDeep: 24:hj+pXJ9CHDN3YGmkGOD7BjZSCGCzV0JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJc:h+1J9wB/mkV3SHYyfi4eshyIK+HMBk3q |
|
|
| C:\Users\Public\Music\Sample Music\Kalimba.mp3 | 8.03 MB |
MD5:
2aea6cb8dc666471363e84d840a33b15
SHA1: b1afd36367c713b5ad4c5542e4f476fc7da87447 SHA256: f444862a005a653cd8b9628046424c051b2f525c277205d0ae44f59e2fc98bcf SSDeep: 196608:K4f7/wwbIf1Dmx/6ue4Y24qE46IV2qpOosFHGqqYF99ktHxvsp:d/9AQ5NY2HE302qpOHGqygp |
|
|
| C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3 | 3.92 MB |
MD5:
5581fce0e61d6cc96e3915324006b5e0
SHA1: 0bdfcc110bd7f633281a36efc1b90c7c554c4e8d SHA256: 97f30516aad5c6529bc64d95ad9845fb87867f04da4c47ae949ce197f0a640c3 SSDeep: 98304:EZ0ZvOfk8GUhhoAZOzcr8Qb6fNSMWIAmY1:60ZvmMUhhoMOQ8nodIhg |
|
|
| C:\Users\Public\Music\Sample Music\Sleep Away.mp3 | 4.62 MB |
MD5:
e39d9d70359fd6dcbe3657ae5a071fb5
SHA1: af28b967d3c81b2334b9c5726b6cbd2414684cf0 SHA256: 42f4e96fdd1e0af07c1c3a148bcc878f53a9e176422aa2c3fd36a13022e7b090 SSDeep: 98304:rUJqVp+GTEaHaAo/rR2aJvD4215EPt1gKd4MUFJ43sqLf5B:rSygVvhInyMI6B |
|
|
| C:\Users\Public\Libraries\desktop.ini | 1.02 KB |
MD5:
f9c060c736104162464a5ecbd4189701
SHA1: bd7cb25abb30e3e26038205c85f5b0d70aa9a704 SHA256: 8ec1cbd870e5c124b7d3020e041882396d6f2acb2b92fdb5f881b76bf1d66684 SSDeep: 24:Z+024y2BsjXfUWJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdUKH:Z64nBsUofi4eshyIK+HMBk3K6tzJfB |
|
|
| C:\Users\Public\Downloads\desktop.ini | 1.09 KB |
MD5:
9b23cce9f1b8d6a858dcc9a3a03fa648
SHA1: c27773d6781897971bc1363d9f4d44f79baf0856 SHA256: a997f31a69221b8cfa4b9cc266d245d7a5270646892f90bba3bffa310743d459 SSDeep: 24:JFwDOFx9t3v1GJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdN:JFOOFt94fi4eshyIK+HMBk3K6tzJf7 |
|
|
| C:\Users\Public\Documents\desktop.ini | 1.20 KB |
MD5:
70231421b7637a1b98748acccd916b18
SHA1: 69e934752165599bb75351b520662bd89d3adcd2 SHA256: 0d97fb023f189989112db36123f850babf74296093db18d24a5ede76f0b9f6c5 SSDeep: 24:Nmo1aCXd23NzJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdXADpj:nN23Xfi4eshyIK+HMBk3K6tzJfNq |
|
|
| C:\Users\Public\Desktop\Adobe Reader X.lnk | 2.91 KB |
MD5:
77a462c8b29617b6d1aed0275a287260
SHA1: 1322c7cdffee20a68b48cfc0b60f668333d41db0 SHA256: 7144c8d092bf3be9d763289f2e493b7a323b180298e7e7e98a54c4d4593bdbfc SSDeep: 48:muBJM8gejbamQZJ2vm3ojBz2eBz2zG7XH2EVqafi4eshyIK+HMBk3K6tzJffbq:lgWbamXRtB7tRLHMnczFbq |
|
|
| C:\Users\Public\Desktop\desktop.ini | 1.09 KB |
MD5:
fd346f36bf14b5ac5bf7961ebd44961e
SHA1: 9545649be80356e3659019a80e70d27c8fed08d3 SHA256: 44c25f88fce6900102f38d701710ceadd7121d8266bce3a695dfb0bc3477b36f SSDeep: 24:r5+XwkJ9KpYB5uzG/CoJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd6mqv+ow:dCJ9yq4zyfi4eshyIK+HMBk3K6tzJfiY |
|
|
| C:\Users\Public\Desktop\Google Chrome.lnk | 3.14 KB |
MD5:
cdd452cf451b11b3301643d68b06014e
SHA1: 34d9aabda2684d9c766ad4bb97052943bc8007aa SHA256: c3cebcc86136117c47b7ad88f4fb4bea803255253233db0dba855d4a9dde332e SSDeep: 96:z/MHwYs7U0ayaFYl2WHxcdFzd6LHMnczAf:oHQiyiddfnv |
|
|
| C:\Users\Public\Desktop\Mozilla Firefox.lnk | 2.06 KB |
MD5:
a67a06fafd134134e74ce62aa9b64686
SHA1: d1aabebdebb997607cfcba9c399bc4eb939edc83 SHA256: 512d5f62b36bbd937139b1d1dc97692a5343bc5c90e7db976aa39c592a2502d3 SSDeep: 48:TAQuFKLT3LWkSxwxWsmVPybZddQCofbdWIPfi4eshyIK+HMBk3K6tzJfC:HuFKLT3LhSKwV+ddGfbfXLHMnczE |
|
|
| C:\Users\Default\NTUSER.DAT | 768.92 KB |
MD5:
eccfd87a47784a7164475b57239d11a7
SHA1: 5940852ef3378abaa2246ad574630cd407c6e4c5 SHA256: 9c9075bedad29dc1126b880a46c835450213b9765cb4f344474f4aa1e052eac4 SSDeep: 12288:BRkcEo/XEbFEk8lKKidRpBhm907wlxF0U:/kXo/XEbndKi7p8kU |
|
|
| C:\Users\Default\NTUSER.DAT.LOG1 | 185.92 KB |
MD5:
2f94be6ccd8dc0efc45d7958b7912533
SHA1: 165c22c075d89f96893ab7ef2bcaf08f8351b56e SHA256: dc0b1a803e7e545b6713502871a95342a57ef4228f756a31a8418679dce7840e SSDeep: 3072:yCHl2YYNeTHzLzQQq5YE7yGTBTCUlFNJV41kPVFXnGI1rxjTKQFxJ:dHl2Y/Lfq5t7yGTUUHTrv3GI15uQ7J |
|
|
| C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf | 64.92 KB |
MD5:
7fde559cdb9781b1cfa17b1e48315ac3
SHA1: f77cf718ff05435b344c06749ad29a43e45489bb SHA256: 255448db4be1ff0b11d177e7ec124cd18b5a7173d3a9c54167484e36631735a8 SSDeep: 768:2BiY6cTet1Fjb8zC806SSh8srY9Hvdm1LCsBNAv1Ub:2qMet1ZwzXh8s8lqCsBy1A |
|
|
| C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms | 512.92 KB |
MD5:
cfbfc972b3093b058bdb0cea175c1065
SHA1: fb08eb46096b09eaa9bfb4213840d51c311beb84 SHA256: 41038cb98f0edcaea8b3f19213b6d7ea2be06fc39fea91a50a9bc0697c66cbb5 SSDeep: 6144:I+WxC/6nEnFj0rt3v1eUStV/JhtxIt7GLtlAL4BUcTZ+oQfCte74:HUC/O0+rBLQFE7Gj5xgOti4 |
|
|
| C:\Users\Default\ntuser.ini | 976 bytes |
MD5:
0ec14627703ffafa957b193103ffec77
SHA1: 47446de4cecdc89f9b5ad80ee85a5c2dd6cfd513 SHA256: 6676ee09babe57077a4ba673bd88088d5d2a9857e0a47bbbf4593e7aa4f7878c SSDeep: 24:HnoBlugLgiGJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd8nS:HrgLifi4eshyIK+HMBk3K6tzJfd |
|
|
| C:\Users\Default\Videos\desktop.ini | 1.42 KB |
MD5:
994bdfb6b33dcce13f772291861d959d
SHA1: fdf149b4f60561176287a40ca4cd5488447d0785 SHA256: dd0d487ee7273f33b8cf5c0f3803f4b3484726a856d74495f2d751ad0b7889bd SSDeep: 24:opW8Xt9F+cFuIex/NyCHxWp+hrJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd8tS:opHJ+cFq9cGXfi4eshyIK+HMBk3K6tzV |
|
|
| C:\Users\Default\Searches\desktop.ini | 1.44 KB |
MD5:
4bacaa907f73406858e83c402006cdef
SHA1: 202b28d91fa156d62a4f03c939ba3d4021584aa1 SHA256: e24d317747652f404d34667822f59d3c7fabe739ad19c58f9499c36628276314 SSDeep: 24:9Yupj2WQIiIiFqBX547r3Q8zPM+JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdex:+yiIiFU547rAu0gfi4eshyIK+HMBk3Kl |
|
|
| C:\Users\Default\Searches\Everywhere.search-ms | 1.17 KB |
MD5:
c59bece63f19dd2ff4552c184e54550b
SHA1: a449886f3a8398d7cc3f0147a25490f7224360bf SHA256: e45552afe08829903b62734768adc07689e99df7ddd6b6d17e39b46524d14655 SSDeep: 24:Ln8RDgM+M7M/WBKOIioJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdR2:L89g6ZI5fi4eshyIK+HMBk3K6tzJf+ |
|
|
| C:\Users\Default\Searches\Indexed Locations.search-ms | 1.17 KB |
MD5:
4bddb460011591f65407fe3f37988173
SHA1: beeabb0d637c2b8acd70e337c8c22d179a0058fa SHA256: 93ca43ef59a0df0bf83a135830c1f5d9bd14c735cb8f6668807a1798428058f2 SSDeep: 24:iF/7swFd4VcpJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdY/:iF/5d4yfi4eshyIK+HMBk3K6tzJf6/ |
|
|
| C:\Users\Default\Saved Games\desktop.ini | 1.20 KB |
MD5:
92244b71c014fa1a3b0ff70dfba88e2a
SHA1: 4281f7bbbe5ee6084850f6582762b7a698250790 SHA256: 0085a9298cf7233af166cf34305f02e5f860f0202ee602315a0f98bc64104d4c SSDeep: 24:1dHw8HZ3uVXNqvlblpjljBrJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd4E:nLEqrBlVVfi4eshyIK+HMBk3K6tzJf/ |
|
|
| C:\Users\Default\Music\desktop.ini | 1.42 KB |
MD5:
70f739a09441471b487e4841eef1f435
SHA1: 509b47979750c55e219fc47d7e839fbd2f425288 SHA256: 3066fd1c89289a202d8c813af032bb31024e0740b3b2b194fbc88e6f2277efab SSDeep: 24:NHi1H7Ys0xme7Gb1oVK2Ui0JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdfn:NC58sOz7HRyfi4eshyIK+HMBk3K6tzJJ |
|
|
| C:\Users\Default\Links\desktop.ini | 1.50 KB |
MD5:
edd02df776b55a409d19b37b46f463a7
SHA1: 4aa3acf84f211099890e5be15b1ce2eeb661b65c SHA256: df81ba456b116e51568ce1c5c06c40cf7188ec0bacfb4675be440e3acaf64ee2 SSDeep: 24:48us+XH/a9LKiObhMnErJCJW3DXpJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd0:48p+XH4AhXVCJcD3fi4eshyIK+HMBk3s |
|
|
| C:\Users\Default\Links\Desktop.lnk | 1.39 KB |
MD5:
ef05ae1e17ef5146745bd7990f6a4c3f
SHA1: ee0b72b10c4a66b08341d83c4829cd5bcc89ba38 SHA256: 2613bea42f590771be9e0a92cd0e081b8009a3a866772b036dbe0c6363444843 SSDeep: 24:FHi+r7X5+8eLakh0qMYhxJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdArX2:YSqakh0qMYh/fi4eshyIK+HMBk3K6tzJ |
|
|
| C:\Users\Default\Links\Downloads.lnk | 1.80 KB |
MD5:
d5a12dc7bd757f4713c3913b3aa74f4a
SHA1: 491ef991ea0225b75e48766cffe74383255d2127 SHA256: dc607901cc2856650a8158359bf7c51bcb23b9a6ab9379507b2ca37c4f847777 SSDeep: 48:Vj1rmUfAzzqrUdBDHromCCfi4eshyIK+HMBk3K6tzJfyRW:DfovqugiLHMnczn |
|
|
| C:\Users\Default\Links\RecentPlaces.lnk | 1.28 KB |
MD5:
af8e324a4f85d5245417a43d571a3041
SHA1: 4c75ef9e38e59d11ed5cff3e3c512dd292363d51 SHA256: e8b11427e22597b387c5ba13ef7b7850ac637d8f2379d064314fc4ab6d61cd52 SSDeep: 24:i7ywRUYi8Ra6GSmV3/qYJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdGP:afRRJazVJzfi4eshyIK+HMBk3K6tzJf2 |
|
|
| C:\Users\Default\Favorites\desktop.ini | 1.33 KB |
MD5:
411a60211af54be3acba984d22d04267
SHA1: 452772ca0d101deed2c954dc27b28a2cf3ecb7f8 SHA256: cc32b356f0863636796e75425bc2d0f02578f322a3d5015b1beec204af6e2635 SSDeep: 24:tPb9dI0vzBzAa9NJqbUxJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdybxlE:N92UzB7r0Cfi4eshyIK+HMBk3K6tzJfJ |
|
|
| C:\Users\Default\Favorites\Windows Live\Get Windows Live.url | 1.06 KB |
MD5:
d419c5ad58c59def2546890e349a1295
SHA1: 5b6e02af64bf241fac05136e3a9bacd8362e5eb4 SHA256: 2e58e48cb1d7131ebbdcfc548d01f72576fb763e0e3790e13a1330f851173b13 SSDeep: 24:gjnV3pR2LfJJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdI:gbVZRwffi4eshyIK+HMBk3K6tzJfK |
|
|
| C:\Users\Default\Favorites\Windows Live\Windows Live Gallery.url | 1.06 KB |
MD5:
9cb07b1378ab98c3ccbeef1484e4db25
SHA1: 42c16a41bff2c9d5c6ccee8f23a958c4f0207c8a SHA256: 34427db74deb6704c917b9dce826120f3a3ec46c48e74e5f35530a345beb887d SSDeep: 24:TGOTCvdqinoJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdi1:T5XTfi4eshyIK+HMBk3K6tzJfK |
|
|
| C:\Users\Default\Favorites\Windows Live\Windows Live Mail.url | 1.06 KB |
MD5:
9187236c69bbfa1f8b4a388a915946e4
SHA1: e34402029df3abe364625cb82c642d0196aa7dd2 SHA256: 8566a0894a1c3c4aef81a11e52baf3f30161124775d8d5eacfc59f224c030259 SSDeep: 24:igzZKYBW7JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdMUX:FhBkfi4eshyIK+HMBk3K6tzJfy2 |
|
|
| C:\Users\Default\Favorites\Windows Live\Windows Live Spaces.url | 1.06 KB |
MD5:
d31812c598d9527fc9e42f09104a3f1f
SHA1: a2cb825e96f16e49f18ab99648292fac41505031 SHA256: 6009e760e8c51626ba209c6593bf8011d4e34a8d78e73c6c1a124f20cc65b664 SSDeep: 24:TaxCISURSFOFz2JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdVH:TaxCISqSFsIfi4eshyIK+HMBk3K6tzJr |
|
|
| C:\Users\Default\Favorites\MSN Websites\MSN Autos.url | 1.06 KB |
MD5:
c81feabf2b22913ed6725a721829006e
SHA1: 1158215882f70867111447719e9f08eaa3112147 SHA256: c7bc38d766ce765e810c3b5c756fb0f1405d2fee00e149270a646b940935f329 SSDeep: 24:O+xSTRaDdYBYJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdDv45Yvk:OcSTRaawfi4eshyIK+HMBk3K6tzJfBvc |
|
|
| C:\Users\Default\Favorites\MSN Websites\MSN Entertainment.url | 1.06 KB |
MD5:
b3d3202abba56d8befe53ec44cb570e8
SHA1: 76c7b66a462e039bc3cb42a9d3aa4a8677c96e27 SHA256: 4ea1f490aa7fba5cdb88f2ec85252f3ba782d3d8ee6b728db0ad50d03382f51c SSDeep: 24:KnPJ8fCGuJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdK0u3v:NfCGwfi4eshyIK+HMBk3K6tzJfMv |
|
|
| C:\Users\Default\Favorites\MSN Websites\MSN Money.url | 1.06 KB |
MD5:
8c8ef64a17ba51dfbd8cb058f5ef710b
SHA1: e5f4c977047f3a49a29b1526a70b9e2e77df5fa4 SHA256: 7711f869841965df2682796663b1155a93a5fa968ef74c09d44da05aba64fdc6 SSDeep: 24:yn4r/izSLDVjJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdf4Vmvk:yn4WOfVdfi4eshyIK+HMBk3K6tzJfd4B |
|
|
| C:\Users\Default\Favorites\MSN Websites\MSN Sports.url | 1.06 KB |
MD5:
e3575fcc2ac8d195e91ce57352bfb6a0
SHA1: efaf06932fa6a9b6545f1094d8764255547ec41c SHA256: cf15c2826bada69ad7b26d07936b983d0fdccf7a0bb3a012f5856dd0610d64ce SSDeep: 24:CIjFjSEWCvz7NJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdbpZLC:CCFj/FvDfi4eshyIK+HMBk3K6tzJfnNC |
|
|
| C:\Users\Default\Favorites\MSN Websites\MSN.url | 1.06 KB |
MD5:
9635e5924953cb595f825238f0b6ba8c
SHA1: bcb5ea8192977c7b5fa9a267a5bcf68be0b605c7 SHA256: 921fde0538b15b296bb83302712177a417ef69a727ef3d5e5e3a4e299b16cf1d SSDeep: 24:4mmz+7EkoHRRwJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdsz:4mmz+7Bo6fi4eshyIK+HMBk3K6tzJf2z |
|
|
| C:\Users\Default\Favorites\MSN Websites\MSNBC News.url | 1.06 KB |
MD5:
77628518a479a0a379c7ca1952ebfc84
SHA1: 61d3e1b9189420fed8ea491a8a45d4707236b882 SHA256: fc9b69c9aaaa70daf11abc84af435961f0f6a8169ca5dce58d7e0ecbda53a016 SSDeep: 24:AFflhemvrRAzpgJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdtbC:ofnTRAF2fi4eshyIK+HMBk3K6tzJfzC |
|
|
| C:\Users\Default\Favorites\Microsoft Websites\IE Add-on site.url | 1.06 KB |
MD5:
0261d41d09a16c66b3e42b5c683c4663
SHA1: 518e186f88c93911db63e90017aba25cc1cb2220 SHA256: 5426732e1ec1989f7ac5bf38b7234966d7b31ad16b2d4ecebd5831af1c42c65c SSDeep: 24:PK/izScbM8toJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd63g:PIOSkM8wfi4eshyIK+HMBk3K6tzJf+g |
|
|
| C:\Users\Default\Favorites\Microsoft Websites\IE site on Microsoft.com.url | 1.06 KB |
MD5:
f758b91f6233f9ef95482a2615b84015
SHA1: 143aa23d1475b9e92fc5edae24530807cf4d3683 SHA256: 210e3a93b997f12825a77d5624f800c4924ae49ac33406318c4c19f41d8ab052 SSDeep: 24:DLz8XCNqCWdJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdRS:3z+UlCfi4eshyIK+HMBk3K6tzJfu |
|
|
| C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Home.url | 1.06 KB |
MD5:
6fd71a487cc29c077c18d14d792e6ba9
SHA1: 6b80331e2b54566a89b2aa34b1be1ee363580531 SHA256: 0622191ec54480a40128777949f45067a5820b18712ef73d19d7ced29e997167 SSDeep: 24:VzQ+dsC2JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd4lJ:p/Ifi4eshyIK+HMBk3K6tzJf+lJ |
|
|
| C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Work.url | 1.06 KB |
MD5:
7bcce36f892ebe31302ad4fbc0f091d8
SHA1: e80d69ae0d1001f85f428abdb9d00849cad29410 SHA256: bade5d7ccffa0e0093970dd71d4c0f32297826363d9cc25d2976e35bd763f641 SSDeep: 24:JUI1G0jH8eyltKb2fJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd6Hg:+s8eopxfi4eshyIK+HMBk3K6tzJfZ |
|
|
| C:\Users\Default\Favorites\Microsoft Websites\Microsoft Store.url | 1.06 KB |
MD5:
afef473d0ed4c6d1d4f2da28ab4637af
SHA1: 0be1882957515922202f8281a345b6514265e7c5 SHA256: b23b5400a2ca7ae8c321564c617f1bdd386e961a66fc7354da02092beaa27798 SSDeep: 24:FB8/PNS2OJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdg:M/U2Qfi4eshyIK+HMBk3K6tzJfW |
|
|
| C:\Users\Default\Favorites\Links\desktop.ini | 1.00 KB |
MD5:
1e6629278facd5335a03e1e375e11734
SHA1: 952411b07ca587b64350726dd5f6c25322532aa4 SHA256: 17de82e2f326446c145c5c94853c5ce52367fb9243384f012c79fdb45c542ad9 SSDeep: 24:gFTjbBGvwJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdimM:gRjbWmfi4eshyIK+HMBk3K6tzJfAT |
|
|
| C:\Users\Default\Favorites\Links\Web Slice Gallery.url | 1.16 KB |
MD5:
d142b25d013b1f57351845f9b0208924
SHA1: dbc37e24006321fb82eeed8cd09f006ac916b4a5 SHA256: cd81ffe169d52ca7a985657e8dd48b916f7496d92e36f25f4e758aed8da2a473 SSDeep: 24:8lD4o47tZDnj62YhJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdjaWk8n:iaDnj62afi4eshyIK+HMBk3K6tzJfRa8 |
|
|
| C:\Users\Default\Downloads\desktop.ini | 1.20 KB |
MD5:
63bc3992633e1c255e5c2b0ac75ff62b
SHA1: 6c76ee0291583745e571f2fc696fece6e673bf20 SHA256: 8a0a93ef2f23f89fc206b4914b5d30a73c8915d689447171c46997fe2b58429e SSDeep: 24:ZvwbtXw7KEwWraL7aTJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd3i:iJAXF67atfi4eshyIK+HMBk3K6tzJf1i |
|
|
| C:\Users\Default\Documents\desktop.ini | 1.33 KB |
MD5:
ff0f737db3f1340f41eb996c4a358677
SHA1: 9ae4fb7af2ab2b021277d6d3a40c10d270326b7f SHA256: 8802dd13827c96ba0b7c6a3d28a19dd84b31d8608ba460a96b592458e1164189 SSDeep: 24:AMywstlZiMxn451PaNklKJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdiEK:AMRKJxnqV0fi4eshyIK+HMBk3K6tzJf2 |
|
|
| C:\Users\Default\Desktop\desktop.ini | 1.20 KB |
MD5:
62ef8142c7fc6cb2fe6b28fa361345e6
SHA1: 1da7a67656407b6bbeacf0434d02ecafcb3d9cf0 SHA256: dc498c78993470780592042c8e36a9822aba445d75b7605ec6d04725d88340ae SSDeep: 24:n40RwlMiEYjqylKnJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd67N:9wlwYQfi4eshyIK+HMBk3K6tzJfmN |
|
|
| C:\Users\Default\Contacts\Administrator.contact | 67.70 KB |
MD5:
d05458e4e4dd82e662a704b70e797f07
SHA1: 95b33d1a21345f663425f29eb69081da0554f962 SHA256: 5e4fd7392337c4025a567d011c344141ec96a18a5355cf35153ee429209413c0 SSDeep: 768:Uv1/UG5grPQ1QVMzOCh8DKAx/mu18J6/f8lrEbK16AslM7DlL5q5xUTAngSilCfQ:OUG4Q6VMKh3N126n8xoFU6g50SEtT1S |
|
|
| C:\Users\Default\Contacts\desktop.ini | 1.33 KB |
MD5:
117609f6ca070958d95a6458e4319b50
SHA1: 6c3fd6d2a746814ff7febce8e50bbf13f7d4852c SHA256: 0dd931fb39ad293ff7f477c3cddfa310486c19e7d173929b5794d12036bf0065 SSDeep: 24:xDoGssbXx08OpdfuLJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdAHc:xD3ssbO8oYfi4eshyIK+HMBk3K6tzJfj |
|
|
| C:\Users\Default\AppData\Local\IconCache.db | 758.91 KB |
MD5:
db5992fc2373e21e05cfc611d9b67486
SHA1: 830987b222707e3797c531d6de7490bebd5da624 SHA256: e5795dacf3a399064958e01d5bbb47d57bc6f5fd842f58ac60acd57c517e86b3 SSDeep: 12288:0X0UGefB/T5VCP8CBeadHHRVXdRtN4kU01KhVR+0Yewh:0TGqT53CbPU0+VxYx |
|
|
| C:\Users\All Users\Sun\Java\Java Update\jaureglist.xml.[new_wave@tuta.io].LotR | 1.05 KB |
MD5:
8438df1b6275e4ee745810e2d9c39c52
SHA1: 2621c6d2830ca30016e25d5ed2e3216eb31f8b8b SHA256: 46ee4d5fe378ecd8424f01c81f6c2bd191449531aa784b74c5ddbf9d08671eca SSDeep: 24:9poHSOOhK2JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdqc6:kHOUIfi4eshyIK+HMBk3K6tzJfc |
|
|
| C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.[new_wave@tuta.io].LotR | 140.92 KB |
MD5:
7b75f0ecea444306b104add520d489e7
SHA1: 4ad58bb3d67cae2d9e8585c0b6748d439f067769 SHA256: 4a4be0ccdee0edbaa6603c6d8d775f9f6425cdd79f1e51eb8e5fb3f29958b064 SSDeep: 3072:XpIBk+jkmGJvic5IGEx4lv7i1BCsCIngIuKQCb1eCVdo9:X6BDj1o0Oi1BTJTQ/F |
|
|
| C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\state.rsm.[new_wave@tuta.io].LotR | 1.67 KB |
MD5:
280e00e64f529f7529ab775475e64d5c
SHA1: da21feb2c29711b42c6063a3ad5f271fe5081678 SHA256: 8f4440401c7394fcebc279856a458f659801057c2b0c47469941488c707bb649 SSDeep: 48:8z1YfiITr6VEYUFXD4vIfi4eshyIK+HMBk3K6tzJfYM:0IfHRFT4vILHMncz9 |
|
|
| C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\VC_redist.x86.exe.[new_wave@tuta.io].LotR | 764.47 KB |
MD5:
dc16a669596bace36caf9e7645b14378
SHA1: 24dce4f7892e55527bd47187e8b4b9469a72fbb0 SHA256: 23a6a293c0b869c9284234e350258f0358c568236098d391109afb60537d48ac SSDeep: 12288:1XQ+dBZTstQWI2Q6EGL5hyuqPR/Y/oOa4Z7PinoKQvZBLifgFOJDm:1XZTsSW1EGL5hNg6at87iYKDm |
|
|
| C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\state.rsm.[new_wave@tuta.io].LotR | 1.58 KB |
MD5:
9a8f83c943b37d1b26e4ee5093dd2786
SHA1: 66fd7affdc46c2d91a81b90c316b8fc4f593d293 SHA256: 261a15b32a36cbd02be7e546446d6b51d4a493adce446258862ea9c2f4f72c22 SSDeep: 48:yIoCwh64SfI5H/H8fi4eshyIK+HMBk3K6tzJfw:yISh6VfaHULHMnczy |
|
|
| C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\vcredist_x86.exe.[new_wave@tuta.io].LotR | 453.05 KB |
MD5:
211cbbe799dc9c8bf7de8e0f304b82b6
SHA1: cedd287f79d8ca5e8fc0b9944602c30c5ecf478d SHA256: c4ce4e6ad9005739d3ea73aa9f9fcc30bfa0a66a3e36395e97e01d14d85546d0 SSDeep: 12288:gnlVkpVDw3LmDOvdFKEw00rtMxeLlQfwxYUz:Uaw3LmCjKrGBAz |
|
|
| C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\VC_redist.x64.exe.[new_wave@tuta.io].LotR | 764.48 KB |
MD5:
91daf09825189aa1fb46622868cfe3da
SHA1: b4d0c6404f0340031ad8db1977c4f508df8881f8 SHA256: adda1e94d6999c01e47805238913ce8151c829a6f9439b6500838929b06e6282 SSDeep: 12288:ZsSnq6659LoymzG34wEBf8GA2vel6Z96y+tAAG1MLCBPcaija2wZEL:Zxq3Lo96Sf8GA2vek9KtA51MTaijF |
|
|
| C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\cab1.cab.[new_wave@tuta.io].LotR | 5.61 MB |
MD5:
d879260728ca59a6fd190db365611027
SHA1: 23c3fc454d2ca08cac402eeed5f5e99ac16131c2 SHA256: 93aecbe6729dfc21e57d9f3c93b941895beda979f500a2312b2c1fea8a896d59 SSDeep: 98304:r0xeZbpcvY1zJEAUNAiB+8d0a416JbGuKexicoegqfQUDpijbcQvm7:tbmA1zJE3+I216JSuhxopqzDsjIQve |
|
|
| C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi.[new_wave@tuta.io].LotR | 140.92 KB |
MD5:
7099c5f7fbf8b6cf8c5bb50b2e652587
SHA1: 3f421dfa0f316589398118835c54cffbf0210ab7 SHA256: 94dae1e4af6dd6186cf19277eabe8d31d7e10c014ff6f04eff557b42b880894d SSDeep: 3072:LNVGeHwHoczizQCIng8TrIUXMZ+K90tjNvFTp:p7IizQFTPi981p |
|
|
| C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab.[new_wave@tuta.io].LotR | 791.72 KB |
MD5:
f8a9f99c6a34b79e2de3a850741c48aa
SHA1: 17930980e9f6862f61040a9a023591a06b1f1e25 SHA256: 845e0bae121dbb0047e6343e4e557c489fd55ad73e9a8e6adb45ab8de708691b SSDeep: 24576:DXX1mSuGcV19Ko7S/mf4ss3JuXL8wRo41FiBYkJh:T1mSur9KoKI4souXto2dkP |
|
|
| C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.[new_wave@tuta.io].LotR | 148.92 KB |
MD5:
8c3fd4ea3f23c431167fe25be58468d1
SHA1: ce398a836ee9e469e5eb5dd58e0fcc1a5d1c461e SHA256: 6ed2d2aee59320617dee45818ef453df721f576baa548b7554d61fb89c37cb95 SSDeep: 3072:Z8nUeLTWPGQr09Q0Ivcw3D+V7ZkQN1gERs4ui2F22QmJs80UF:Z8RLrqqXquN1RRNuiWdiQ |
|
|
Modified Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| C:\Users\desktop.ini | 1.09 KB |
MD5:
c8d89a09a77523f9c1a1d8c6f0c79e10
SHA1: c57188102e2ad07a85f7b22ab6c87bd36c77ede9 SHA256: 5a6257d94bf3b4d126a79d7074641349642e1e9f8ee2f2c65efb4190a6a6ad7c SSDeep: 24:ziyf0uM42+W7gz2JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdy0T:ziaVQQzIfi4eshyIK+HMBk3K6tzJf3T |
|
|
| C:\Users\Public\Recorded TV\Sample Media\desktop.ini | 1.09 KB |
MD5:
42aa40c4462dab34b09a21da141df7ff
SHA1: 9fba1a2923b39268bf99bf22620a3478a00d8e26 SHA256: 6431c215eb2132d5a15df67585bbaef4930074ddfcedf90bef5da7d59f090d46 SSDeep: 24:ejpaNh62Iwb+XJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdgo:ejpaeFfi4eshyIK+HMBk3K6tzJfeo |
|
|
| C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg | 859.71 KB |
MD5:
afd3ef12e6e6e3bccab2d02c883f7a5c
SHA1: a887eac4d84a278e4fc00572486943713c6a1777 SHA256: 1fe039e6a6ae4aea78936fd1bf01a2264fe768926df0886814c7c845f9f8b8a0 SSDeep: 24576:YF+MO4pgomr2LW2cAXRb35yCft67mIEjP02s7:Yc9vr2463ECFmm3jP02s7 |
|
|
| C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg | 760.53 KB |
MD5:
e4a6ad330d0f34af2194cd4ba11c7a5f
SHA1: d6434889a924fe45efd2e74adb3aeaba409a5104 SHA256: cd09c6c4dd0165654cdf5beb4f2e9a2ef38b1c7f1ad9b7e6b416a9ba0b5e2e69 SSDeep: 12288:CjclL4UL90ErwpYCRL2gEUwTjHvkJT4R7fsSHsorLZMnoBiF8/xt8Pv1IPR1hn9u:8clsgCEORL2gE9kJTo7tPJMoBiF8/xto |
|
|
| C:\Users\Public\Libraries\RecordedTV.library-ms | 1.78 KB |
MD5:
57c7f1faaad012ab126e17de98955a33
SHA1: 86611eb8facf9970382afde19fc306562baf744f SHA256: 5e8adf327bc3e4f58598376c3b3fdf0ffd4417c8c2bf42f216364dd8a71de8bf SSDeep: 48:pK9zUQwIp4CmQn0Xfi4eshyIK+HMBk3K6tzJf8XI:4bfmQn0/LHMnczN |
|
|
| C:\Users\Default\NTUSER.DAT.LOG | 1.92 KB |
MD5:
1bdc5f624f881f8cf00edfde433e5c18
SHA1: a9cf52c7413e82427356d33a0dc44f70c7c537df SHA256: 1357ddfe8515f22e842b3a5ca4193d35aba21a5738fcedd9c7a6557147df8963 SSDeep: 48:mOq0B7NotGvlnOmBmYJhzmJKBzfPfi4eshyIK+HMBk3K6tzJffQG:mOJ7St2OqJhiJobLHMnczpQG |
|
|
| C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms | 512.92 KB |
MD5:
9d1bbde940a4d438c6c332b57f9eace9
SHA1: 5d1f0d13888686a8d21c77172c39534620fce200 SHA256: 95b3da5ec1d6535a9c675ee83b28b2194099c489547887b1500f12d7efda4b20 SSDeep: 6144:jpMy6IGjNl8pJBq39ljbc6MHwJd9KGvXl8LY6+j/Tu9C/Xq4:jqNjNCk3j46979D6Y9/TB/b |
|
|
| C:\Users\Default\Pictures\desktop.ini | 1.42 KB |
MD5:
a9b1a854640003c1b01608a53504b852
SHA1: bcd8e7d74151de18dcc09b847434d1f52e3373d8 SHA256: 86bc3e2cc39b565fb1c0a5bdc3449e9aed707c2d55716d9a4574d8a4341b07ed SSDeep: 24:KVmw942x5ro3yK0Yf30ZNwCRn+KwtyJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJZ:1Cf7rob0u0ACRn+Sfi4eshyIK+HMBk3H |
|
|
| C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\cab1.cab.[new_wave@tuta.io].LotR | 4.71 MB |
MD5:
59b12f295d908bc21664d25e49291eaf
SHA1: cc36ce9a188af5fed7911d31ed79c9644288b435 SHA256: 89a9563611facda0e7b6c8d2e37254ec830be0ae758a219efdf06c3e6e2d077a SSDeep: 98304:hZrriN1hqvEGckVWABO88onvNEKCtnck5m68AdHn+o4gJeB+Xyqi+81Wn:jrre1hqvEGcIO8RvNItck5mjAdyuKsy4 |
|
|
| C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\state.rsm.[new_wave@tuta.io].LotR | 1.67 KB |
MD5:
a359bf5f8ec3a3ff47cd6174fa38301c
SHA1: d453f1a215892e56687cd86a199aaa82d1cb88a1 SHA256: bec78e938cd51f8f016358b9241e436f35ad35c818409e99e313b63ad9687095 SSDeep: 48:tUda/HhicRdHm1t3gcE6cJImjTJfi4eshyIK+HMBk3K6tzJfZNfw:ywPh1GPwcKJb5LHMncztfw |
|
|
| C:\BOOTSECT.BAK | 8.92 KB |
MD5:
f8af30243ac7e9add5221964bc22b0c4
SHA1: 42331b36d0d02d8f68a13bbecd33bfdd00d4786e SHA256: 5e214d87188b582831d61de4b42521741d881e9daf7df126411489609e6f3b35 SSDeep: 192:YsTsXdmDXptJ0y+fhnkKA0sR0v83rEKjnqz:MKh6/AbRfYKjm |
|
|
| C:\Users\Public\desktop.ini | 1.09 KB |
MD5:
fb149115f9f506b1fa1516e23c49c61c
SHA1: e80a49aba0ea10a73d79dfe6352cfd0f24630078 SHA256: d8a5170e1a50c42bb0d13765af59ba7eba04e35423406099f6efe33c0247149d SSDeep: 24:Ph328FYdKNBahRZJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdJ4V:Ph32rK3abfi4eshyIK+HMBk3K6tzJfve |
|
|
| C:\Users\Public\Videos\desktop.ini | 1.30 KB |
MD5:
dd28d7c8c3a535d9d2a19e36995b7ce9
SHA1: 1fbaca54ba301940d9573f45f655ea2ef409da09 SHA256: d792dfa879c3e72e2a2f825fcd25d0fa9e83b4bdc6d6746d35a1889f752fb7d4 SSDeep: 24:9cH//r5K9k+26aYPzD0JJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd84:mH//l2u6aYP38fi4eshyIK+HMBk3K6tx |
|
|
| C:\Users\Public\Videos\Sample Videos\desktop.ini | 1.25 KB |
MD5:
9e1944825576bb5b5ca0e83e5d7a0e28
SHA1: 4b976f152134324463d06f7f461fe4a37a440bc5 SHA256: 7ffb5e61bacc268b763b205f2c71111d2063144fa64f2f2f8971606e886d8ca4 SSDeep: 24:2Q/miXHZwo95tMvgJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd/A:2S1JB1fi4eshyIK+HMBk3K6tzJfy |
|
|
| C:\Users\Public\Videos\Sample Videos\Wildlife.wmv | 25.03 MB |
MD5:
b49d0287ce65a4a6a7e97c30dd618128
SHA1: 80e365ab990fbda522b82c093d32de41160a1bad SHA256: e5d2454eec54321f2c3a35bc543d44617b09a2ac889908d75c7a272af0b0d06a SSDeep: 196608:JKNUU7bSyPuTAkjtHXo+5/9xM+Z2i0SOIeFlfZ8lPQGvwGj5Yza:K3Onjf/zMw0SZeFZwPQGj |
|
|
| C:\Users\Public\Recorded TV\desktop.ini | 1.00 KB |
MD5:
5d6f5027bf28017c86f3aed425a82dd3
SHA1: 6af758f31fc7e58b929199bfd0d103c9aac9aae3 SHA256: 048656eaf1586dc7b82a5ac8bc218166b08fbe657115824a1143896540dae36a SSDeep: 24:xYg0VKKe3iJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfddTj:SVKCfi4eshyIK+HMBk3K6tzJfvTj |
|
|
| C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv | 9.25 MB |
MD5:
01ff8110e375f2ab7fd734b2032c585c
SHA1: 782368ec1344d0368b63e4ecf5083f32843c70c6 SHA256: abdfc1753097757d34292a51d88345a5a38a6ee6509372c86fd093bb408929c6 SSDeep: 196608:/TFQYZWZ516PpuVzsmmQ7tbq6jZCzZTlkcEEnluDbBHsz8LDa61oTe2uo4i98cxW:/JbZ8iPWZmQ7djSgIluug/acTo98rZ5 |
|
|
| C:\Users\Public\Pictures\desktop.ini | 1.30 KB |
MD5:
f35ea737ef6c748a68e1a6265739d714
SHA1: 96160d23946a7cf8c02417fecbe3d77a2710586a SHA256: ec3f17e36fe1c568a097e79d2bdd21d7644df6a4fa87662bd0ec1f775b3397f4 SSDeep: 24:rAE5UDCIYZeFHGFJ818W2JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdtLno4f4:rtU+PeFHg81lIfi4eshyIK+HMBk3K6tc |
|
|
| C:\Users\Public\Pictures\Sample Pictures\Desert.jpg | 827.04 KB |
MD5:
8da46be5eca0bb829a7c1952fd197d9a
SHA1: 6b6796b1eca16b818443265f6e684a5d9d6e1605 SHA256: 7185b6ffef0aaac1f427c0b78737951b22394663964318b1258b527c60e28058 SSDeep: 12288:ROgyAlTN7hHwUqtqYaHM5ocmN7cYlZpdNvXSioNHAo7sGpWtlwzueBuxdw5225AF:U8TN7fqBOM5ocackxNvXSFK1tmCeuxgk |
|
|
| C:\Users\Public\Pictures\Sample Pictures\desktop.ini | 2.02 KB |
MD5:
5f65413c3cee2239239fbc7ac64f40fc
SHA1: bbd2efdc3dab40fb90b85403998aa4558935ccc6 SHA256: 810fb368274cd5b323c0e26e6e6d8cb95d8f95e2e758c854310e5d56b6472845 SSDeep: 48:MifcbJvIP+bZvU/3Stg31uC+nZOqZfi4eshyIK+HMBk3K6tzJf6:MifMJvG+bdUitgFlEOqJLHMnczI |
|
|
| C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg | 582.27 KB |
MD5:
2a6370cbbbdbc61691749a79d0ee439d
SHA1: ecd29590d9d797555915233f09f0c1434cb23e15 SHA256: 90f925d03829c7050d84b237654e987a212b288ad4497f21eba2e4fe8e8b39af SSDeep: 12288:FgkcwRoMuAFSH0jmC7PL2QP8W+JP3HGmVnu6L8TqlBr9OW:eOOAFSH4z7PL2CWPlnu6SMBROW |
|
|
| C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg | 758.45 KB |
MD5:
e3cad6a0ea1169362a181c59bfc6ae2f
SHA1: c466337e477e7c31d4d943d7ede71545643b82a1 SHA256: e766d726f5a8e1125be0479735b2032ecf78bdfed6048767676ed8834c8df7b7 SSDeep: 12288:6jWw4wgfvnnqRHVONF6IMqr9rWznD2qRDuz2tEWtCRLpnRzgwBeBus9OeFkxteuQ:u4wIqR108I0zDnEW0ZpnRn0BV9cteaM |
|
|
| C:\Users\Public\Pictures\Sample Pictures\Koala.jpg | 763.45 KB |
MD5:
444c66dc758090a495fbca5193c76af0
SHA1: fecc4461b5576e711df4722a47ef6729da4e4f4e SHA256: d72786ba0a543de92b6e184b80a819d54dd5ecea583fabcbd8353ecaecd50317 SSDeep: 12288:tu3uk7AUYYGsVymRg2x036LsLNKqm4zVEbx0RrS9l1Dc8Gjz:Guk8UYYqm+bKLs59m4pEbxyro1Lwz |
|
|
| C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg | 549.05 KB |
MD5:
39242446dd019c82f0582dfd128d4b47
SHA1: 3c0f62ae3df11aa252071daec7178b89b062fdc5 SHA256: 2dc8528f15eb2834e84b94b62c9dc4068707f62f1217bde71b254382334135d6 SSDeep: 12288:2+34XLWur3ZNnnVD0ZHi489yTMvS0vNtOg17JusCkJ5Ye3AEtI9BW3I8mVEvPtco:D4aur3Lnl+C4/Mtd355YqrM8Mk3 |
|
|
| C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg | 607.26 KB |
MD5:
26fcaf302d43ebeb78700d7040278b85
SHA1: 751b83c655828f42fd1e3b33b41e0992af5857ab SHA256: 896da5fc2fdb3c4e60d6b65a701b525d5acab559ceb8afee4a42bd8c6ec319bb SSDeep: 12288:wEuufF1/dZY1botRDvhqz1GORbsIcGWcCQgYiiCr3aJ2:vZfH/dZ33Dkz1GORbsIcMLjCr3aJ2 |
|
|
| C:\Users\Public\Music\desktop.ini | 1.30 KB |
MD5:
a30214d80a70904778a034283c040f90
SHA1: d7f7c4533f8eea6b0f47e888142c5449979dd1dc SHA256: b94613dca5ef3b5f2d13cb40953767b3d204f8be3b3884d974e91f8973880de2 SSDeep: 24:CtGMQHLhcsrjDrJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdW7p:CYLrieVfi4eshyIK+HMBk3K6tzJfwN |
|
|
| C:\Users\Public\Music\Sample Music\desktop.ini | 1.50 KB |
MD5:
8bcdd581dea9f59df6a3a4760227be22
SHA1: 17722f2eec50f4a5fcd1498f0d77147c8276c1eb SHA256: cf97b95530342a9655bb5449bfe74ea785ff07ff5d601494fbdb716001e7dba9 SSDeep: 24:hj+pXJ9CHDN3YGmkGOD7BjZSCGCzV0JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJc:h+1J9wB/mkV3SHYyfi4eshyIK+HMBk3q |
|
|
| C:\Users\Public\Music\Sample Music\Kalimba.mp3 | 8.03 MB |
MD5:
2aea6cb8dc666471363e84d840a33b15
SHA1: b1afd36367c713b5ad4c5542e4f476fc7da87447 SHA256: f444862a005a653cd8b9628046424c051b2f525c277205d0ae44f59e2fc98bcf SSDeep: 196608:K4f7/wwbIf1Dmx/6ue4Y24qE46IV2qpOosFHGqqYF99ktHxvsp:d/9AQ5NY2HE302qpOHGqygp |
|
|
| C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3 | 3.92 MB |
MD5:
5581fce0e61d6cc96e3915324006b5e0
SHA1: 0bdfcc110bd7f633281a36efc1b90c7c554c4e8d SHA256: 97f30516aad5c6529bc64d95ad9845fb87867f04da4c47ae949ce197f0a640c3 SSDeep: 98304:EZ0ZvOfk8GUhhoAZOzcr8Qb6fNSMWIAmY1:60ZvmMUhhoMOQ8nodIhg |
|
|
| C:\Users\Public\Music\Sample Music\Sleep Away.mp3 | 4.62 MB |
MD5:
e39d9d70359fd6dcbe3657ae5a071fb5
SHA1: af28b967d3c81b2334b9c5726b6cbd2414684cf0 SHA256: 42f4e96fdd1e0af07c1c3a148bcc878f53a9e176422aa2c3fd36a13022e7b090 SSDeep: 98304:rUJqVp+GTEaHaAo/rR2aJvD4215EPt1gKd4MUFJ43sqLf5B:rSygVvhInyMI6B |
|
|
| C:\Users\Public\Libraries\desktop.ini | 1.02 KB |
MD5:
f9c060c736104162464a5ecbd4189701
SHA1: bd7cb25abb30e3e26038205c85f5b0d70aa9a704 SHA256: 8ec1cbd870e5c124b7d3020e041882396d6f2acb2b92fdb5f881b76bf1d66684 SSDeep: 24:Z+024y2BsjXfUWJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdUKH:Z64nBsUofi4eshyIK+HMBk3K6tzJfB |
|
|
| C:\Users\Public\Downloads\desktop.ini | 1.09 KB |
MD5:
9b23cce9f1b8d6a858dcc9a3a03fa648
SHA1: c27773d6781897971bc1363d9f4d44f79baf0856 SHA256: a997f31a69221b8cfa4b9cc266d245d7a5270646892f90bba3bffa310743d459 SSDeep: 24:JFwDOFx9t3v1GJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdN:JFOOFt94fi4eshyIK+HMBk3K6tzJf7 |
|
|
| C:\Users\Public\Documents\desktop.ini | 1.20 KB |
MD5:
70231421b7637a1b98748acccd916b18
SHA1: 69e934752165599bb75351b520662bd89d3adcd2 SHA256: 0d97fb023f189989112db36123f850babf74296093db18d24a5ede76f0b9f6c5 SSDeep: 24:Nmo1aCXd23NzJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdXADpj:nN23Xfi4eshyIK+HMBk3K6tzJfNq |
|
|
| C:\Users\Public\Desktop\Adobe Reader X.lnk | 2.91 KB |
MD5:
77a462c8b29617b6d1aed0275a287260
SHA1: 1322c7cdffee20a68b48cfc0b60f668333d41db0 SHA256: 7144c8d092bf3be9d763289f2e493b7a323b180298e7e7e98a54c4d4593bdbfc SSDeep: 48:muBJM8gejbamQZJ2vm3ojBz2eBz2zG7XH2EVqafi4eshyIK+HMBk3K6tzJffbq:lgWbamXRtB7tRLHMnczFbq |
|
|
| C:\Users\Public\Desktop\desktop.ini | 1.09 KB |
MD5:
fd346f36bf14b5ac5bf7961ebd44961e
SHA1: 9545649be80356e3659019a80e70d27c8fed08d3 SHA256: 44c25f88fce6900102f38d701710ceadd7121d8266bce3a695dfb0bc3477b36f SSDeep: 24:r5+XwkJ9KpYB5uzG/CoJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd6mqv+ow:dCJ9yq4zyfi4eshyIK+HMBk3K6tzJfiY |
|
|
| C:\Users\Public\Desktop\Google Chrome.lnk | 3.14 KB |
MD5:
cdd452cf451b11b3301643d68b06014e
SHA1: 34d9aabda2684d9c766ad4bb97052943bc8007aa SHA256: c3cebcc86136117c47b7ad88f4fb4bea803255253233db0dba855d4a9dde332e SSDeep: 96:z/MHwYs7U0ayaFYl2WHxcdFzd6LHMnczAf:oHQiyiddfnv |
|
|
| C:\Users\Public\Desktop\Mozilla Firefox.lnk | 2.06 KB |
MD5:
a67a06fafd134134e74ce62aa9b64686
SHA1: d1aabebdebb997607cfcba9c399bc4eb939edc83 SHA256: 512d5f62b36bbd937139b1d1dc97692a5343bc5c90e7db976aa39c592a2502d3 SSDeep: 48:TAQuFKLT3LWkSxwxWsmVPybZddQCofbdWIPfi4eshyIK+HMBk3K6tzJfC:HuFKLT3LhSKwV+ddGfbfXLHMnczE |
|
|
| C:\Users\Default\NTUSER.DAT | 768.92 KB |
MD5:
eccfd87a47784a7164475b57239d11a7
SHA1: 5940852ef3378abaa2246ad574630cd407c6e4c5 SHA256: 9c9075bedad29dc1126b880a46c835450213b9765cb4f344474f4aa1e052eac4 SSDeep: 12288:BRkcEo/XEbFEk8lKKidRpBhm907wlxF0U:/kXo/XEbndKi7p8kU |
|
|
| C:\Users\Default\NTUSER.DAT.LOG1 | 185.92 KB |
MD5:
2f94be6ccd8dc0efc45d7958b7912533
SHA1: 165c22c075d89f96893ab7ef2bcaf08f8351b56e SHA256: dc0b1a803e7e545b6713502871a95342a57ef4228f756a31a8418679dce7840e SSDeep: 3072:yCHl2YYNeTHzLzQQq5YE7yGTBTCUlFNJV41kPVFXnGI1rxjTKQFxJ:dHl2Y/Lfq5t7yGTUUHTrv3GI15uQ7J |
|
|
| C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf | 64.92 KB |
MD5:
7fde559cdb9781b1cfa17b1e48315ac3
SHA1: f77cf718ff05435b344c06749ad29a43e45489bb SHA256: 255448db4be1ff0b11d177e7ec124cd18b5a7173d3a9c54167484e36631735a8 SSDeep: 768:2BiY6cTet1Fjb8zC806SSh8srY9Hvdm1LCsBNAv1Ub:2qMet1ZwzXh8s8lqCsBy1A |
|
|
| C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms | 512.92 KB |
MD5:
cfbfc972b3093b058bdb0cea175c1065
SHA1: fb08eb46096b09eaa9bfb4213840d51c311beb84 SHA256: 41038cb98f0edcaea8b3f19213b6d7ea2be06fc39fea91a50a9bc0697c66cbb5 SSDeep: 6144:I+WxC/6nEnFj0rt3v1eUStV/JhtxIt7GLtlAL4BUcTZ+oQfCte74:HUC/O0+rBLQFE7Gj5xgOti4 |
|
|
| C:\Users\Default\ntuser.ini | 976 bytes |
MD5:
0ec14627703ffafa957b193103ffec77
SHA1: 47446de4cecdc89f9b5ad80ee85a5c2dd6cfd513 SHA256: 6676ee09babe57077a4ba673bd88088d5d2a9857e0a47bbbf4593e7aa4f7878c SSDeep: 24:HnoBlugLgiGJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd8nS:HrgLifi4eshyIK+HMBk3K6tzJfd |
|
|
| C:\Users\Default\Videos\desktop.ini | 1.42 KB |
MD5:
994bdfb6b33dcce13f772291861d959d
SHA1: fdf149b4f60561176287a40ca4cd5488447d0785 SHA256: dd0d487ee7273f33b8cf5c0f3803f4b3484726a856d74495f2d751ad0b7889bd SSDeep: 24:opW8Xt9F+cFuIex/NyCHxWp+hrJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd8tS:opHJ+cFq9cGXfi4eshyIK+HMBk3K6tzV |
|
|
| C:\Users\Default\Searches\desktop.ini | 1.44 KB |
MD5:
4bacaa907f73406858e83c402006cdef
SHA1: 202b28d91fa156d62a4f03c939ba3d4021584aa1 SHA256: e24d317747652f404d34667822f59d3c7fabe739ad19c58f9499c36628276314 SSDeep: 24:9Yupj2WQIiIiFqBX547r3Q8zPM+JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdex:+yiIiFU547rAu0gfi4eshyIK+HMBk3Kl |
|
|
| C:\Users\Default\Searches\Everywhere.search-ms | 1.17 KB |
MD5:
c59bece63f19dd2ff4552c184e54550b
SHA1: a449886f3a8398d7cc3f0147a25490f7224360bf SHA256: e45552afe08829903b62734768adc07689e99df7ddd6b6d17e39b46524d14655 SSDeep: 24:Ln8RDgM+M7M/WBKOIioJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdR2:L89g6ZI5fi4eshyIK+HMBk3K6tzJf+ |
|
|
| C:\Users\Default\Searches\Indexed Locations.search-ms | 1.17 KB |
MD5:
4bddb460011591f65407fe3f37988173
SHA1: beeabb0d637c2b8acd70e337c8c22d179a0058fa SHA256: 93ca43ef59a0df0bf83a135830c1f5d9bd14c735cb8f6668807a1798428058f2 SSDeep: 24:iF/7swFd4VcpJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdY/:iF/5d4yfi4eshyIK+HMBk3K6tzJf6/ |
|
|
| C:\Users\Default\Saved Games\desktop.ini | 1.20 KB |
MD5:
92244b71c014fa1a3b0ff70dfba88e2a
SHA1: 4281f7bbbe5ee6084850f6582762b7a698250790 SHA256: 0085a9298cf7233af166cf34305f02e5f860f0202ee602315a0f98bc64104d4c SSDeep: 24:1dHw8HZ3uVXNqvlblpjljBrJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd4E:nLEqrBlVVfi4eshyIK+HMBk3K6tzJf/ |
|
|
| C:\Users\Default\Music\desktop.ini | 1.42 KB |
MD5:
70f739a09441471b487e4841eef1f435
SHA1: 509b47979750c55e219fc47d7e839fbd2f425288 SHA256: 3066fd1c89289a202d8c813af032bb31024e0740b3b2b194fbc88e6f2277efab SSDeep: 24:NHi1H7Ys0xme7Gb1oVK2Ui0JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdfn:NC58sOz7HRyfi4eshyIK+HMBk3K6tzJJ |
|
|
| C:\Users\Default\Links\desktop.ini | 1.50 KB |
MD5:
edd02df776b55a409d19b37b46f463a7
SHA1: 4aa3acf84f211099890e5be15b1ce2eeb661b65c SHA256: df81ba456b116e51568ce1c5c06c40cf7188ec0bacfb4675be440e3acaf64ee2 SSDeep: 24:48us+XH/a9LKiObhMnErJCJW3DXpJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd0:48p+XH4AhXVCJcD3fi4eshyIK+HMBk3s |
|
|
| C:\Users\Default\Links\Desktop.lnk | 1.39 KB |
MD5:
ef05ae1e17ef5146745bd7990f6a4c3f
SHA1: ee0b72b10c4a66b08341d83c4829cd5bcc89ba38 SHA256: 2613bea42f590771be9e0a92cd0e081b8009a3a866772b036dbe0c6363444843 SSDeep: 24:FHi+r7X5+8eLakh0qMYhxJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdArX2:YSqakh0qMYh/fi4eshyIK+HMBk3K6tzJ |
|
|
| C:\Users\Default\Links\Downloads.lnk | 1.80 KB |
MD5:
d5a12dc7bd757f4713c3913b3aa74f4a
SHA1: 491ef991ea0225b75e48766cffe74383255d2127 SHA256: dc607901cc2856650a8158359bf7c51bcb23b9a6ab9379507b2ca37c4f847777 SSDeep: 48:Vj1rmUfAzzqrUdBDHromCCfi4eshyIK+HMBk3K6tzJfyRW:DfovqugiLHMnczn |
|
|
| C:\Users\Default\Links\RecentPlaces.lnk | 1.28 KB |
MD5:
af8e324a4f85d5245417a43d571a3041
SHA1: 4c75ef9e38e59d11ed5cff3e3c512dd292363d51 SHA256: e8b11427e22597b387c5ba13ef7b7850ac637d8f2379d064314fc4ab6d61cd52 SSDeep: 24:i7ywRUYi8Ra6GSmV3/qYJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdGP:afRRJazVJzfi4eshyIK+HMBk3K6tzJf2 |
|
|
| C:\Users\Default\Favorites\desktop.ini | 1.33 KB |
MD5:
411a60211af54be3acba984d22d04267
SHA1: 452772ca0d101deed2c954dc27b28a2cf3ecb7f8 SHA256: cc32b356f0863636796e75425bc2d0f02578f322a3d5015b1beec204af6e2635 SSDeep: 24:tPb9dI0vzBzAa9NJqbUxJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdybxlE:N92UzB7r0Cfi4eshyIK+HMBk3K6tzJfJ |
|
|
| C:\Users\Default\Favorites\Windows Live\Get Windows Live.url | 1.06 KB |
MD5:
d419c5ad58c59def2546890e349a1295
SHA1: 5b6e02af64bf241fac05136e3a9bacd8362e5eb4 SHA256: 2e58e48cb1d7131ebbdcfc548d01f72576fb763e0e3790e13a1330f851173b13 SSDeep: 24:gjnV3pR2LfJJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdI:gbVZRwffi4eshyIK+HMBk3K6tzJfK |
|
|
| C:\Users\Default\Favorites\Windows Live\Windows Live Gallery.url | 1.06 KB |
MD5:
9cb07b1378ab98c3ccbeef1484e4db25
SHA1: 42c16a41bff2c9d5c6ccee8f23a958c4f0207c8a SHA256: 34427db74deb6704c917b9dce826120f3a3ec46c48e74e5f35530a345beb887d SSDeep: 24:TGOTCvdqinoJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdi1:T5XTfi4eshyIK+HMBk3K6tzJfK |
|
|
| C:\Users\Default\Favorites\Windows Live\Windows Live Mail.url | 1.06 KB |
MD5:
9187236c69bbfa1f8b4a388a915946e4
SHA1: e34402029df3abe364625cb82c642d0196aa7dd2 SHA256: 8566a0894a1c3c4aef81a11e52baf3f30161124775d8d5eacfc59f224c030259 SSDeep: 24:igzZKYBW7JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdMUX:FhBkfi4eshyIK+HMBk3K6tzJfy2 |
|
|
| C:\Users\Default\Favorites\Windows Live\Windows Live Spaces.url | 1.06 KB |
MD5:
d31812c598d9527fc9e42f09104a3f1f
SHA1: a2cb825e96f16e49f18ab99648292fac41505031 SHA256: 6009e760e8c51626ba209c6593bf8011d4e34a8d78e73c6c1a124f20cc65b664 SSDeep: 24:TaxCISURSFOFz2JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdVH:TaxCISqSFsIfi4eshyIK+HMBk3K6tzJr |
|
|
| C:\Users\Default\Favorites\MSN Websites\MSN Autos.url | 1.06 KB |
MD5:
c81feabf2b22913ed6725a721829006e
SHA1: 1158215882f70867111447719e9f08eaa3112147 SHA256: c7bc38d766ce765e810c3b5c756fb0f1405d2fee00e149270a646b940935f329 SSDeep: 24:O+xSTRaDdYBYJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdDv45Yvk:OcSTRaawfi4eshyIK+HMBk3K6tzJfBvc |
|
|
| C:\Users\Default\Favorites\MSN Websites\MSN Entertainment.url | 1.06 KB |
MD5:
b3d3202abba56d8befe53ec44cb570e8
SHA1: 76c7b66a462e039bc3cb42a9d3aa4a8677c96e27 SHA256: 4ea1f490aa7fba5cdb88f2ec85252f3ba782d3d8ee6b728db0ad50d03382f51c SSDeep: 24:KnPJ8fCGuJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdK0u3v:NfCGwfi4eshyIK+HMBk3K6tzJfMv |
|
|
| C:\Users\Default\Favorites\MSN Websites\MSN Money.url | 1.06 KB |
MD5:
8c8ef64a17ba51dfbd8cb058f5ef710b
SHA1: e5f4c977047f3a49a29b1526a70b9e2e77df5fa4 SHA256: 7711f869841965df2682796663b1155a93a5fa968ef74c09d44da05aba64fdc6 SSDeep: 24:yn4r/izSLDVjJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdf4Vmvk:yn4WOfVdfi4eshyIK+HMBk3K6tzJfd4B |
|
|
| C:\Users\Default\Favorites\MSN Websites\MSN Sports.url | 1.06 KB |
MD5:
e3575fcc2ac8d195e91ce57352bfb6a0
SHA1: efaf06932fa6a9b6545f1094d8764255547ec41c SHA256: cf15c2826bada69ad7b26d07936b983d0fdccf7a0bb3a012f5856dd0610d64ce SSDeep: 24:CIjFjSEWCvz7NJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdbpZLC:CCFj/FvDfi4eshyIK+HMBk3K6tzJfnNC |
|
|
| C:\Users\Default\Favorites\MSN Websites\MSN.url | 1.06 KB |
MD5:
9635e5924953cb595f825238f0b6ba8c
SHA1: bcb5ea8192977c7b5fa9a267a5bcf68be0b605c7 SHA256: 921fde0538b15b296bb83302712177a417ef69a727ef3d5e5e3a4e299b16cf1d SSDeep: 24:4mmz+7EkoHRRwJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdsz:4mmz+7Bo6fi4eshyIK+HMBk3K6tzJf2z |
|
|
| C:\Users\Default\Favorites\MSN Websites\MSNBC News.url | 1.06 KB |
MD5:
77628518a479a0a379c7ca1952ebfc84
SHA1: 61d3e1b9189420fed8ea491a8a45d4707236b882 SHA256: fc9b69c9aaaa70daf11abc84af435961f0f6a8169ca5dce58d7e0ecbda53a016 SSDeep: 24:AFflhemvrRAzpgJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdtbC:ofnTRAF2fi4eshyIK+HMBk3K6tzJfzC |
|
|
| C:\Users\Default\Favorites\Microsoft Websites\IE Add-on site.url | 1.06 KB |
MD5:
0261d41d09a16c66b3e42b5c683c4663
SHA1: 518e186f88c93911db63e90017aba25cc1cb2220 SHA256: 5426732e1ec1989f7ac5bf38b7234966d7b31ad16b2d4ecebd5831af1c42c65c SSDeep: 24:PK/izScbM8toJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd63g:PIOSkM8wfi4eshyIK+HMBk3K6tzJf+g |
|
|
| C:\Users\Default\Favorites\Microsoft Websites\IE site on Microsoft.com.url | 1.06 KB |
MD5:
f758b91f6233f9ef95482a2615b84015
SHA1: 143aa23d1475b9e92fc5edae24530807cf4d3683 SHA256: 210e3a93b997f12825a77d5624f800c4924ae49ac33406318c4c19f41d8ab052 SSDeep: 24:DLz8XCNqCWdJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdRS:3z+UlCfi4eshyIK+HMBk3K6tzJfu |
|
|
| C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Home.url | 1.06 KB |
MD5:
6fd71a487cc29c077c18d14d792e6ba9
SHA1: 6b80331e2b54566a89b2aa34b1be1ee363580531 SHA256: 0622191ec54480a40128777949f45067a5820b18712ef73d19d7ced29e997167 SSDeep: 24:VzQ+dsC2JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd4lJ:p/Ifi4eshyIK+HMBk3K6tzJf+lJ |
|
|
| C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Work.url | 1.06 KB |
MD5:
7bcce36f892ebe31302ad4fbc0f091d8
SHA1: e80d69ae0d1001f85f428abdb9d00849cad29410 SHA256: bade5d7ccffa0e0093970dd71d4c0f32297826363d9cc25d2976e35bd763f641 SSDeep: 24:JUI1G0jH8eyltKb2fJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd6Hg:+s8eopxfi4eshyIK+HMBk3K6tzJfZ |
|
|
| C:\Users\Default\Favorites\Microsoft Websites\Microsoft Store.url | 1.06 KB |
MD5:
afef473d0ed4c6d1d4f2da28ab4637af
SHA1: 0be1882957515922202f8281a345b6514265e7c5 SHA256: b23b5400a2ca7ae8c321564c617f1bdd386e961a66fc7354da02092beaa27798 SSDeep: 24:FB8/PNS2OJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdg:M/U2Qfi4eshyIK+HMBk3K6tzJfW |
|
|
| C:\Users\Default\Favorites\Links\desktop.ini | 1.00 KB |
MD5:
1e6629278facd5335a03e1e375e11734
SHA1: 952411b07ca587b64350726dd5f6c25322532aa4 SHA256: 17de82e2f326446c145c5c94853c5ce52367fb9243384f012c79fdb45c542ad9 SSDeep: 24:gFTjbBGvwJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdimM:gRjbWmfi4eshyIK+HMBk3K6tzJfAT |
|
|
| C:\Users\Default\Favorites\Links\Web Slice Gallery.url | 1.16 KB |
MD5:
d142b25d013b1f57351845f9b0208924
SHA1: dbc37e24006321fb82eeed8cd09f006ac916b4a5 SHA256: cd81ffe169d52ca7a985657e8dd48b916f7496d92e36f25f4e758aed8da2a473 SSDeep: 24:8lD4o47tZDnj62YhJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdjaWk8n:iaDnj62afi4eshyIK+HMBk3K6tzJfRa8 |
|
|
| C:\Users\Default\Downloads\desktop.ini | 1.20 KB |
MD5:
63bc3992633e1c255e5c2b0ac75ff62b
SHA1: 6c76ee0291583745e571f2fc696fece6e673bf20 SHA256: 8a0a93ef2f23f89fc206b4914b5d30a73c8915d689447171c46997fe2b58429e SSDeep: 24:ZvwbtXw7KEwWraL7aTJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd3i:iJAXF67atfi4eshyIK+HMBk3K6tzJf1i |
|
|
| C:\Users\Default\Documents\desktop.ini | 1.33 KB |
MD5:
ff0f737db3f1340f41eb996c4a358677
SHA1: 9ae4fb7af2ab2b021277d6d3a40c10d270326b7f SHA256: 8802dd13827c96ba0b7c6a3d28a19dd84b31d8608ba460a96b592458e1164189 SSDeep: 24:AMywstlZiMxn451PaNklKJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdiEK:AMRKJxnqV0fi4eshyIK+HMBk3K6tzJf2 |
|
|
| C:\Users\Default\Desktop\desktop.ini | 1.20 KB |
MD5:
62ef8142c7fc6cb2fe6b28fa361345e6
SHA1: 1da7a67656407b6bbeacf0434d02ecafcb3d9cf0 SHA256: dc498c78993470780592042c8e36a9822aba445d75b7605ec6d04725d88340ae SSDeep: 24:n40RwlMiEYjqylKnJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd67N:9wlwYQfi4eshyIK+HMBk3K6tzJfmN |
|
|
| C:\Users\Default\Contacts\Administrator.contact | 67.70 KB |
MD5:
d05458e4e4dd82e662a704b70e797f07
SHA1: 95b33d1a21345f663425f29eb69081da0554f962 SHA256: 5e4fd7392337c4025a567d011c344141ec96a18a5355cf35153ee429209413c0 SSDeep: 768:Uv1/UG5grPQ1QVMzOCh8DKAx/mu18J6/f8lrEbK16AslM7DlL5q5xUTAngSilCfQ:OUG4Q6VMKh3N126n8xoFU6g50SEtT1S |
|
|
| C:\Users\Default\Contacts\desktop.ini | 1.33 KB |
MD5:
117609f6ca070958d95a6458e4319b50
SHA1: 6c3fd6d2a746814ff7febce8e50bbf13f7d4852c SHA256: 0dd931fb39ad293ff7f477c3cddfa310486c19e7d173929b5794d12036bf0065 SSDeep: 24:xDoGssbXx08OpdfuLJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdAHc:xD3ssbO8oYfi4eshyIK+HMBk3K6tzJfj |
|
|
| C:\Users\Default\AppData\Local\IconCache.db | 758.91 KB |
MD5:
db5992fc2373e21e05cfc611d9b67486
SHA1: 830987b222707e3797c531d6de7490bebd5da624 SHA256: e5795dacf3a399064958e01d5bbb47d57bc6f5fd842f58ac60acd57c517e86b3 SSDeep: 12288:0X0UGefB/T5VCP8CBeadHHRVXdRtN4kU01KhVR+0Yewh:0TGqT53CbPU0+VxYx |
|
|
| C:\Users\All Users\Sun\Java\Java Update\jaureglist.xml.[new_wave@tuta.io].LotR | 1.05 KB |
MD5:
8438df1b6275e4ee745810e2d9c39c52
SHA1: 2621c6d2830ca30016e25d5ed2e3216eb31f8b8b SHA256: 46ee4d5fe378ecd8424f01c81f6c2bd191449531aa784b74c5ddbf9d08671eca SSDeep: 24:9poHSOOhK2JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdqc6:kHOUIfi4eshyIK+HMBk3K6tzJfc |
|
|
| C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.[new_wave@tuta.io].LotR | 140.92 KB |
MD5:
7b75f0ecea444306b104add520d489e7
SHA1: 4ad58bb3d67cae2d9e8585c0b6748d439f067769 SHA256: 4a4be0ccdee0edbaa6603c6d8d775f9f6425cdd79f1e51eb8e5fb3f29958b064 SSDeep: 3072:XpIBk+jkmGJvic5IGEx4lv7i1BCsCIngIuKQCb1eCVdo9:X6BDj1o0Oi1BTJTQ/F |
|
|
| C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\state.rsm.[new_wave@tuta.io].LotR | 1.67 KB |
MD5:
280e00e64f529f7529ab775475e64d5c
SHA1: da21feb2c29711b42c6063a3ad5f271fe5081678 SHA256: 8f4440401c7394fcebc279856a458f659801057c2b0c47469941488c707bb649 SSDeep: 48:8z1YfiITr6VEYUFXD4vIfi4eshyIK+HMBk3K6tzJfYM:0IfHRFT4vILHMncz9 |
|
|
| C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\VC_redist.x86.exe.[new_wave@tuta.io].LotR | 764.47 KB |
MD5:
dc16a669596bace36caf9e7645b14378
SHA1: 24dce4f7892e55527bd47187e8b4b9469a72fbb0 SHA256: 23a6a293c0b869c9284234e350258f0358c568236098d391109afb60537d48ac SSDeep: 12288:1XQ+dBZTstQWI2Q6EGL5hyuqPR/Y/oOa4Z7PinoKQvZBLifgFOJDm:1XZTsSW1EGL5hNg6at87iYKDm |
|
|
| C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\state.rsm.[new_wave@tuta.io].LotR | 1.58 KB |
MD5:
9a8f83c943b37d1b26e4ee5093dd2786
SHA1: 66fd7affdc46c2d91a81b90c316b8fc4f593d293 SHA256: 261a15b32a36cbd02be7e546446d6b51d4a493adce446258862ea9c2f4f72c22 SSDeep: 48:yIoCwh64SfI5H/H8fi4eshyIK+HMBk3K6tzJfw:yISh6VfaHULHMnczy |
|
|
| C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\vcredist_x86.exe.[new_wave@tuta.io].LotR | 453.05 KB |
MD5:
211cbbe799dc9c8bf7de8e0f304b82b6
SHA1: cedd287f79d8ca5e8fc0b9944602c30c5ecf478d SHA256: c4ce4e6ad9005739d3ea73aa9f9fcc30bfa0a66a3e36395e97e01d14d85546d0 SSDeep: 12288:gnlVkpVDw3LmDOvdFKEw00rtMxeLlQfwxYUz:Uaw3LmCjKrGBAz |
|
|
| C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\VC_redist.x64.exe.[new_wave@tuta.io].LotR | 764.48 KB |
MD5:
91daf09825189aa1fb46622868cfe3da
SHA1: b4d0c6404f0340031ad8db1977c4f508df8881f8 SHA256: adda1e94d6999c01e47805238913ce8151c829a6f9439b6500838929b06e6282 SSDeep: 12288:ZsSnq6659LoymzG34wEBf8GA2vel6Z96y+tAAG1MLCBPcaija2wZEL:Zxq3Lo96Sf8GA2vek9KtA51MTaijF |
|
|
| C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\cab1.cab.[new_wave@tuta.io].LotR | 5.61 MB |
MD5:
d879260728ca59a6fd190db365611027
SHA1: 23c3fc454d2ca08cac402eeed5f5e99ac16131c2 SHA256: 93aecbe6729dfc21e57d9f3c93b941895beda979f500a2312b2c1fea8a896d59 SSDeep: 98304:r0xeZbpcvY1zJEAUNAiB+8d0a416JbGuKexicoegqfQUDpijbcQvm7:tbmA1zJE3+I216JSuhxopqzDsjIQve |
|
|
| C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi.[new_wave@tuta.io].LotR | 140.92 KB |
MD5:
7099c5f7fbf8b6cf8c5bb50b2e652587
SHA1: 3f421dfa0f316589398118835c54cffbf0210ab7 SHA256: 94dae1e4af6dd6186cf19277eabe8d31d7e10c014ff6f04eff557b42b880894d SSDeep: 3072:LNVGeHwHoczizQCIng8TrIUXMZ+K90tjNvFTp:p7IizQFTPi981p |
|
|
| C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab.[new_wave@tuta.io].LotR | 791.72 KB |
MD5:
f8a9f99c6a34b79e2de3a850741c48aa
SHA1: 17930980e9f6862f61040a9a023591a06b1f1e25 SHA256: 845e0bae121dbb0047e6343e4e557c489fd55ad73e9a8e6adb45ab8de708691b SSDeep: 24576:DXX1mSuGcV19Ko7S/mf4ss3JuXL8wRo41FiBYkJh:T1mSur9KoKI4souXto2dkP |
|
|
| C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.[new_wave@tuta.io].LotR | 148.92 KB |
MD5:
8c3fd4ea3f23c431167fe25be58468d1
SHA1: ce398a836ee9e469e5eb5dd58e0fcc1a5d1c461e SHA256: 6ed2d2aee59320617dee45818ef453df721f576baa548b7554d61fb89c37cb95 SSDeep: 3072:Z8nUeLTWPGQr09Q0Ivcw3D+V7ZkQN1gERs4ui2F22QmJs80UF:Z8RLrqqXquN1RRNuiWdiQ |
|
|
Threads
Thread 0xa6c
22
0
| Category | Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Module | Get Filename | process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\rlrgwq.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rlrgwq.exe, size = 2048 |
|
1 | |
| Environment | Get Environment String | name = LOCALAPPDATA, result_out = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\rlrgwq.exe, type = file_attributes |
|
1 | |
| File | Copy | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rlrgwq.exe, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\rlrgwq.exe |
|
1 | |
| Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce |
|
1 | |
| Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce, value_name = BrowserUpdateCheck, data = 69 |
|
1 | |
| Registry | Create Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce |
|
1 | |
| Registry | Write Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce, value_name = BrowserUpdateCheck, data = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\rlrgwq.exe, size = 108, type = REG_SZ |
|
1 | |
| Environment | Get Environment String | name = public, result_out = C:\Users\Public |
|
1 | |
| File | Create | filename = C:\Users\Public\FE3523FAA45D11A890B51B95FAFBCEE159EA84E416AE3EBE497EE9F0BF90B688, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Public\FE3523FAA45D11A890B51B95FAFBCEE159EA84E416AE3EBE497EE9F0BF90B688, size = 258 |
|
1 | |
| File | Write | filename = C:\Users\Public\FE3523FAA45D11A890B51B95FAFBCEE159EA84E416AE3EBE497EE9F0BF90B688, size = 768 |
|
1 | |
| System | Sleep | duration = -1 (infinite) |
|
1 |
Thread 0xa78
4186
0
| Category | Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| File | Create | filename = C:\bootmgr, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\BOOTSECT.BAK, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\BOOTSECT.BAK, type = size, size_out = 8192 |
|
1 | |
| File | Write | filename = C:\BOOTSECT.BAK, size = 896 |
|
1 | |
| File | Read | filename = C:\BOOTSECT.BAK, size = 8192, size_out = 8192 |
|
1 | |
| File | Write | filename = C:\BOOTSECT.BAK, size = 8192 |
|
1 | |
| File | Write | filename = C:\BOOTSECT.BAK, size = 48 |
|
1 | |
| File | Move | source_filename = C:\BOOTSECT.BAK, destination_filename = C:\BOOTSECT.BAK.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\hiberfil.sys, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\pagefile.sys, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\desktop.ini, type = size, size_out = 174 |
|
1 | |
| File | Write | filename = C:\Users\desktop.ini, size = 898 |
|
1 | |
| File | Read | filename = C:\Users\desktop.ini, size = 176, size_out = 176 |
|
1 | |
| File | Write | filename = C:\Users\desktop.ini, size = 176 |
|
1 | |
| File | Write | filename = C:\Users\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\desktop.ini, destination_filename = C:\Users\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Public\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\desktop.ini, type = size, size_out = 174 |
|
1 | |
| File | Write | filename = C:\Users\Public\desktop.ini, size = 898 |
|
1 | |
| File | Read | filename = C:\Users\Public\desktop.ini, size = 176, size_out = 176 |
|
1 | |
| File | Write | filename = C:\Users\Public\desktop.ini, size = 176 |
|
1 | |
| File | Write | filename = C:\Users\Public\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\desktop.ini, destination_filename = C:\Users\Public\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Public\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Public\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Public\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Public\Videos\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Videos\desktop.ini, type = size, size_out = 380 |
|
1 | |
| File | Write | filename = C:\Users\Public\Videos\desktop.ini, size = 900 |
|
1 | |
| File | Read | filename = C:\Users\Public\Videos\desktop.ini, size = 384, size_out = 384 |
|
1 | |
| File | Write | filename = C:\Users\Public\Videos\desktop.ini, size = 384 |
|
1 | |
| File | Write | filename = C:\Users\Public\Videos\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Videos\desktop.ini, destination_filename = C:\Users\Public\Videos\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Videos\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Public\Videos\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Public\Videos\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Public\Videos\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Public\Videos\Sample Videos\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Videos\Sample Videos\desktop.ini, type = size, size_out = 326 |
|
1 | |
| File | Write | filename = C:\Users\Public\Videos\Sample Videos\desktop.ini, size = 906 |
|
1 | |
| File | Read | filename = C:\Users\Public\Videos\Sample Videos\desktop.ini, size = 336, size_out = 336 |
|
1 | |
| File | Write | filename = C:\Users\Public\Videos\Sample Videos\desktop.ini, size = 336 |
|
1 | |
| File | Write | filename = C:\Users\Public\Videos\Sample Videos\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Videos\Sample Videos\desktop.ini, destination_filename = C:\Users\Public\Videos\Sample Videos\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Videos\Sample Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Videos\Sample Videos\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Public\Videos\Sample Videos\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Public\Videos\Sample Videos\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Public\Videos\Sample Videos\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Public\Videos\Sample Videos\Wildlife.wmv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Videos\Sample Videos\Wildlife.wmv, type = size, size_out = 26246026 |
|
1 | |
| File | Write | filename = C:\Users\Public\Videos\Sample Videos\Wildlife.wmv, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Public\Videos\Sample Videos\Wildlife.wmv, size = 2621440, size_out = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\Public\Videos\Sample Videos\Wildlife.wmv, size = 2621440 |
|
1 | |
| File | Read | filename = C:\Users\Public\Videos\Sample Videos\Wildlife.wmv, size = 2621440, size_out = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\Public\Videos\Sample Videos\Wildlife.wmv, size = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\Public\Videos\Sample Videos\Wildlife.wmv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Videos\Sample Videos\Wildlife.wmv, destination_filename = C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Videos\Sample Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Recorded TV\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Recorded TV\desktop.ini, type = size, size_out = 80 |
|
1 | |
| File | Write | filename = C:\Users\Public\Recorded TV\desktop.ini, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Public\Recorded TV\desktop.ini, size = 80, size_out = 80 |
|
1 | |
| File | Write | filename = C:\Users\Public\Recorded TV\desktop.ini, size = 80 |
|
1 | |
| File | Write | filename = C:\Users\Public\Recorded TV\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Recorded TV\desktop.ini, destination_filename = C:\Users\Public\Recorded TV\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Recorded TV\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Recorded TV\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Public\Recorded TV\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Public\Recorded TV\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Public\Recorded TV\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Public\Recorded TV\Sample Media\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Recorded TV\Sample Media\desktop.ini, type = size, size_out = 171 |
|
1 | |
| File | Write | filename = C:\Users\Public\Recorded TV\Sample Media\desktop.ini, size = 901 |
|
1 | |
| File | Read | filename = C:\Users\Public\Recorded TV\Sample Media\desktop.ini, size = 176, size_out = 176 |
|
1 | |
| File | Write | filename = C:\Users\Public\Recorded TV\Sample Media\desktop.ini, size = 176 |
|
1 | |
| File | Write | filename = C:\Users\Public\Recorded TV\Sample Media\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Recorded TV\Sample Media\desktop.ini, destination_filename = C:\Users\Public\Recorded TV\Sample Media\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Recorded TV\Sample Media\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Recorded TV\Sample Media\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Public\Recorded TV\Sample Media\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Public\Recorded TV\Sample Media\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Public\Recorded TV\Sample Media\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv, type = size, size_out = 9699328 |
|
1 | |
| File | Write | filename = C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv, size = 2621440, size_out = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv, size = 2621440 |
|
1 | |
| File | Read | filename = C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv, size = 2621440, size_out = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv, size = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv, destination_filename = C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Recorded TV\Sample Media\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Pictures\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\desktop.ini, type = size, size_out = 380 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\desktop.ini, size = 900 |
|
1 | |
| File | Read | filename = C:\Users\Public\Pictures\desktop.ini, size = 384, size_out = 384 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\desktop.ini, size = 384 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Pictures\desktop.ini, destination_filename = C:\Users\Public\Pictures\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Pictures\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Public\Pictures\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg, type = size, size_out = 879394 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg, size = 879394, size_out = 879394 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg, size = 879394 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg, destination_filename = C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Pictures\Sample Pictures\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Public\Pictures\Sample Pictures\Desert.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\Desert.jpg, type = size, size_out = 845941 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Desert.jpg, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Public\Pictures\Sample Pictures\Desert.jpg, size = 845941, size_out = 845941 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Desert.jpg, size = 845941 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Desert.jpg, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Pictures\Sample Pictures\Desert.jpg, destination_filename = C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Pictures\Sample Pictures\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\desktop.ini, type = size, size_out = 1120 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\desktop.ini, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Public\Pictures\Sample Pictures\desktop.ini, size = 1120, size_out = 1120 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\desktop.ini, size = 1120 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Pictures\Sample Pictures\desktop.ini, destination_filename = C:\Users\Public\Pictures\Sample Pictures\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg, type = size, size_out = 595284 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg, size = 908 |
|
1 | |
| File | Read | filename = C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg, size = 595296, size_out = 595296 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg, size = 595296 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg, destination_filename = C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg, type = size, size_out = 775702 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg, size = 906 |
|
1 | |
| File | Read | filename = C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg, size = 775712, size_out = 775712 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg, size = 775712 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg, destination_filename = C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Pictures\Sample Pictures\Koala.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\Koala.jpg, type = size, size_out = 780831 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Koala.jpg, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Public\Pictures\Sample Pictures\Koala.jpg, size = 780831, size_out = 780831 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Koala.jpg, size = 780831 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Koala.jpg, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Pictures\Sample Pictures\Koala.jpg, destination_filename = C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg, type = size, size_out = 561276 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg, size = 900 |
|
1 | |
| File | Read | filename = C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg, size = 561280, size_out = 561280 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg, size = 561280 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg, destination_filename = C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg, type = size, size_out = 777835 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg, size = 901 |
|
1 | |
| File | Read | filename = C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg, size = 777840, size_out = 777840 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg, size = 777840 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg, destination_filename = C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg, type = size, size_out = 620888 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg, size = 620888, size_out = 620888 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg, size = 620888 |
|
1 | |
| File | Write | filename = C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg, destination_filename = C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Pictures\Sample Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Music\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Music\desktop.ini, type = size, size_out = 380 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\desktop.ini, size = 900 |
|
1 | |
| File | Read | filename = C:\Users\Public\Music\desktop.ini, size = 384, size_out = 384 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\desktop.ini, size = 384 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Music\desktop.ini, destination_filename = C:\Users\Public\Music\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Music\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Music\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Public\Music\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Public\Music\Sample Music\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Music\Sample Music\desktop.ini, type = size, size_out = 586 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\Sample Music\desktop.ini, size = 902 |
|
1 | |
| File | Read | filename = C:\Users\Public\Music\Sample Music\desktop.ini, size = 592, size_out = 592 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\Sample Music\desktop.ini, size = 592 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\Sample Music\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Music\Sample Music\desktop.ini, destination_filename = C:\Users\Public\Music\Sample Music\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Music\Sample Music\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Music\Sample Music\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\Sample Music\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Public\Music\Sample Music\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\Sample Music\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Public\Music\Sample Music\Kalimba.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Music\Sample Music\Kalimba.mp3, type = size, size_out = 8414449 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\Sample Music\Kalimba.mp3, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Public\Music\Sample Music\Kalimba.mp3, size = 2621440, size_out = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\Sample Music\Kalimba.mp3, size = 2621440 |
|
1 | |
| File | Read | filename = C:\Users\Public\Music\Sample Music\Kalimba.mp3, size = 2621440, size_out = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\Sample Music\Kalimba.mp3, size = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\Sample Music\Kalimba.mp3, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Music\Sample Music\Kalimba.mp3, destination_filename = C:\Users\Public\Music\Sample Music\Kalimba.mp3.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Music\Sample Music\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3, type = size, size_out = 4113874 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3, size = 910 |
|
1 | |
| File | Read | filename = C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3, size = 4113888, size_out = 4113888 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3, size = 4113888 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3, destination_filename = C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Music\Sample Music\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Music\Sample Music\Sleep Away.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Music\Sample Music\Sleep Away.mp3, type = size, size_out = 4842585 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\Sample Music\Sleep Away.mp3, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Public\Music\Sample Music\Sleep Away.mp3, size = 4842585, size_out = 4842585 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\Sample Music\Sleep Away.mp3, size = 4842585 |
|
1 | |
| File | Write | filename = C:\Users\Public\Music\Sample Music\Sleep Away.mp3, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Music\Sample Music\Sleep Away.mp3, destination_filename = C:\Users\Public\Music\Sample Music\Sleep Away.mp3.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Music\Sample Music\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Libraries\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Libraries\desktop.ini, type = size, size_out = 88 |
|
1 | |
| File | Write | filename = C:\Users\Public\Libraries\desktop.ini, size = 904 |
|
1 | |
| File | Read | filename = C:\Users\Public\Libraries\desktop.ini, size = 96, size_out = 96 |
|
1 | |
| File | Write | filename = C:\Users\Public\Libraries\desktop.ini, size = 96 |
|
1 | |
| File | Write | filename = C:\Users\Public\Libraries\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Libraries\desktop.ini, destination_filename = C:\Users\Public\Libraries\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Libraries\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Libraries\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Public\Libraries\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Public\Libraries\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Public\Libraries\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Public\Libraries\RecordedTV.library-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Libraries\RecordedTV.library-ms, type = size, size_out = 876 |
|
1 | |
| File | Write | filename = C:\Users\Public\Libraries\RecordedTV.library-ms, size = 900 |
|
1 | |
| File | Read | filename = C:\Users\Public\Libraries\RecordedTV.library-ms, size = 880, size_out = 880 |
|
1 | |
| File | Write | filename = C:\Users\Public\Libraries\RecordedTV.library-ms, size = 880 |
|
1 | |
| File | Write | filename = C:\Users\Public\Libraries\RecordedTV.library-ms, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Libraries\RecordedTV.library-ms, destination_filename = C:\Users\Public\Libraries\RecordedTV.library-ms.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Libraries\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Downloads\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Downloads\desktop.ini, type = size, size_out = 174 |
|
1 | |
| File | Write | filename = C:\Users\Public\Downloads\desktop.ini, size = 898 |
|
1 | |
| File | Read | filename = C:\Users\Public\Downloads\desktop.ini, size = 176, size_out = 176 |
|
1 | |
| File | Write | filename = C:\Users\Public\Downloads\desktop.ini, size = 176 |
|
1 | |
| File | Write | filename = C:\Users\Public\Downloads\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Downloads\desktop.ini, destination_filename = C:\Users\Public\Downloads\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Downloads\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Downloads\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Public\Downloads\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Public\Downloads\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Public\Downloads\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Public\Documents\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Documents\desktop.ini, type = size, size_out = 278 |
|
1 | |
| File | Write | filename = C:\Users\Public\Documents\desktop.ini, size = 906 |
|
1 | |
| File | Read | filename = C:\Users\Public\Documents\desktop.ini, size = 288, size_out = 288 |
|
1 | |
| File | Write | filename = C:\Users\Public\Documents\desktop.ini, size = 288 |
|
1 | |
| File | Write | filename = C:\Users\Public\Documents\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Documents\desktop.ini, destination_filename = C:\Users\Public\Documents\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Documents\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Documents\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Public\Documents\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Public\Documents\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Public\Documents\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Public\Desktop\Adobe Reader X.lnk, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Desktop\Adobe Reader X.lnk, type = size, size_out = 2025 |
|
1 | |
| File | Write | filename = C:\Users\Public\Desktop\Adobe Reader X.lnk, size = 903 |
|
1 | |
| File | Read | filename = C:\Users\Public\Desktop\Adobe Reader X.lnk, size = 2032, size_out = 2032 |
|
1 | |
| File | Write | filename = C:\Users\Public\Desktop\Adobe Reader X.lnk, size = 2032 |
|
1 | |
| File | Write | filename = C:\Users\Public\Desktop\Adobe Reader X.lnk, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Desktop\Adobe Reader X.lnk, destination_filename = C:\Users\Public\Desktop\Adobe Reader X.lnk.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Desktop\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Desktop\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Public\Desktop\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Public\Desktop\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Public\Desktop\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Public\Desktop\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Desktop\desktop.ini, type = size, size_out = 174 |
|
1 | |
| File | Write | filename = C:\Users\Public\Desktop\desktop.ini, size = 898 |
|
1 | |
| File | Read | filename = C:\Users\Public\Desktop\desktop.ini, size = 176, size_out = 176 |
|
1 | |
| File | Write | filename = C:\Users\Public\Desktop\desktop.ini, size = 176 |
|
1 | |
| File | Write | filename = C:\Users\Public\Desktop\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Desktop\desktop.ini, destination_filename = C:\Users\Public\Desktop\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Desktop\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Desktop\Google Chrome.lnk, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Desktop\Google Chrome.lnk, type = size, size_out = 2257 |
|
1 | |
| File | Write | filename = C:\Users\Public\Desktop\Google Chrome.lnk, size = 911 |
|
1 | |
| File | Read | filename = C:\Users\Public\Desktop\Google Chrome.lnk, size = 2272, size_out = 2272 |
|
1 | |
| File | Write | filename = C:\Users\Public\Desktop\Google Chrome.lnk, size = 2272 |
|
1 | |
| File | Write | filename = C:\Users\Public\Desktop\Google Chrome.lnk, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Desktop\Google Chrome.lnk, destination_filename = C:\Users\Public\Desktop\Google Chrome.lnk.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Desktop\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Public\Desktop\Mozilla Firefox.lnk, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Desktop\Mozilla Firefox.lnk, type = size, size_out = 1157 |
|
1 | |
| File | Write | filename = C:\Users\Public\Desktop\Mozilla Firefox.lnk, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\Public\Desktop\Mozilla Firefox.lnk, size = 1168, size_out = 1168 |
|
1 | |
| File | Write | filename = C:\Users\Public\Desktop\Mozilla Firefox.lnk, size = 1168 |
|
1 | |
| File | Write | filename = C:\Users\Public\Desktop\Mozilla Firefox.lnk, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Public\Desktop\Mozilla Firefox.lnk, destination_filename = C:\Users\Public\Desktop\Mozilla Firefox.lnk.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Public\Desktop\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\NTUSER.DAT, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\NTUSER.DAT, type = size, size_out = 786432 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Default\NTUSER.DAT, size = 786432, size_out = 786432 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT, size = 786432 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\NTUSER.DAT, destination_filename = C:\Users\Default\NTUSER.DAT.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\NTUSER.DAT.LOG, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\NTUSER.DAT.LOG, type = size, size_out = 1024 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT.LOG, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Default\NTUSER.DAT.LOG, size = 1024, size_out = 1024 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT.LOG, size = 1024 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT.LOG, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\NTUSER.DAT.LOG, destination_filename = C:\Users\Default\NTUSER.DAT.LOG.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\NTUSER.DAT.LOG1, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\NTUSER.DAT.LOG1, type = size, size_out = 189440 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT.LOG1, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Default\NTUSER.DAT.LOG1, size = 189440, size_out = 189440 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT.LOG1, size = 189440 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT.LOG1, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\NTUSER.DAT.LOG1, destination_filename = C:\Users\Default\NTUSER.DAT.LOG1.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\NTUSER.DAT.LOG2, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\NTUSER.DAT.LOG2, type = size, size_out = 0 |
|
1 | |
| File | Create | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf, type = size, size_out = 65536 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf, size = 65536, size_out = 65536 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf, size = 65536 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf, destination_filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms, type = size, size_out = 524288 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms, size = 524288, size_out = 524288 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms, size = 524288 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms, destination_filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms, type = size, size_out = 524288 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms, size = 524288, size_out = 524288 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms, size = 524288 |
|
1 | |
| File | Write | filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms, destination_filename = C:\Users\Default\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\ntuser.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\ntuser.ini, type = size, size_out = 20 |
|
1 | |
| File | Write | filename = C:\Users\Default\ntuser.ini, size = 908 |
|
1 | |
| File | Read | filename = C:\Users\Default\ntuser.ini, size = 32, size_out = 32 |
|
1 | |
| File | Write | filename = C:\Users\Default\ntuser.ini, size = 32 |
|
1 | |
| File | Write | filename = C:\Users\Default\ntuser.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\ntuser.ini, destination_filename = C:\Users\Default\ntuser.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Videos\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Videos\desktop.ini, type = size, size_out = 504 |
|
1 | |
| File | Write | filename = C:\Users\Default\Videos\desktop.ini, size = 904 |
|
1 | |
| File | Read | filename = C:\Users\Default\Videos\desktop.ini, size = 512, size_out = 512 |
|
1 | |
| File | Write | filename = C:\Users\Default\Videos\desktop.ini, size = 512 |
|
1 | |
| File | Write | filename = C:\Users\Default\Videos\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Videos\desktop.ini, destination_filename = C:\Users\Default\Videos\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Videos\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\Videos\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\Videos\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\Videos\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\Searches\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Searches\desktop.ini, type = size, size_out = 524 |
|
1 | |
| File | Write | filename = C:\Users\Default\Searches\desktop.ini, size = 900 |
|
1 | |
| File | Read | filename = C:\Users\Default\Searches\desktop.ini, size = 528, size_out = 528 |
|
1 | |
| File | Write | filename = C:\Users\Default\Searches\desktop.ini, size = 528 |
|
1 | |
| File | Write | filename = C:\Users\Default\Searches\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Searches\desktop.ini, destination_filename = C:\Users\Default\Searches\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Searches\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Searches\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\Searches\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\Searches\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\Searches\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\Searches\Everywhere.search-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Searches\Everywhere.search-ms, type = size, size_out = 248 |
|
1 | |
| File | Write | filename = C:\Users\Default\Searches\Everywhere.search-ms, size = 904 |
|
1 | |
| File | Read | filename = C:\Users\Default\Searches\Everywhere.search-ms, size = 256, size_out = 256 |
|
1 | |
| File | Write | filename = C:\Users\Default\Searches\Everywhere.search-ms, size = 256 |
|
1 | |
| File | Write | filename = C:\Users\Default\Searches\Everywhere.search-ms, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Searches\Everywhere.search-ms, destination_filename = C:\Users\Default\Searches\Everywhere.search-ms.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Searches\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Searches\Indexed Locations.search-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Searches\Indexed Locations.search-ms, type = size, size_out = 248 |
|
1 | |
| File | Write | filename = C:\Users\Default\Searches\Indexed Locations.search-ms, size = 904 |
|
1 | |
| File | Read | filename = C:\Users\Default\Searches\Indexed Locations.search-ms, size = 256, size_out = 256 |
|
1 | |
| File | Write | filename = C:\Users\Default\Searches\Indexed Locations.search-ms, size = 256 |
|
1 | |
| File | Write | filename = C:\Users\Default\Searches\Indexed Locations.search-ms, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Searches\Indexed Locations.search-ms, destination_filename = C:\Users\Default\Searches\Indexed Locations.search-ms.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Searches\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Saved Games\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Saved Games\desktop.ini, type = size, size_out = 282 |
|
1 | |
| File | Write | filename = C:\Users\Default\Saved Games\desktop.ini, size = 902 |
|
1 | |
| File | Read | filename = C:\Users\Default\Saved Games\desktop.ini, size = 288, size_out = 288 |
|
1 | |
| File | Write | filename = C:\Users\Default\Saved Games\desktop.ini, size = 288 |
|
1 | |
| File | Write | filename = C:\Users\Default\Saved Games\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Saved Games\desktop.ini, destination_filename = C:\Users\Default\Saved Games\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Saved Games\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Saved Games\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\Saved Games\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\Saved Games\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\Saved Games\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\Pictures\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Pictures\desktop.ini, type = size, size_out = 504 |
|
1 | |
| File | Write | filename = C:\Users\Default\Pictures\desktop.ini, size = 904 |
|
1 | |
| File | Read | filename = C:\Users\Default\Pictures\desktop.ini, size = 512, size_out = 512 |
|
1 | |
| File | Write | filename = C:\Users\Default\Pictures\desktop.ini, size = 512 |
|
1 | |
| File | Write | filename = C:\Users\Default\Pictures\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Pictures\desktop.ini, destination_filename = C:\Users\Default\Pictures\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Pictures\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\Pictures\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\Pictures\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\Pictures\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\Music\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Music\desktop.ini, type = size, size_out = 504 |
|
1 | |
| File | Write | filename = C:\Users\Default\Music\desktop.ini, size = 904 |
|
1 | |
| File | Read | filename = C:\Users\Default\Music\desktop.ini, size = 512, size_out = 512 |
|
1 | |
| File | Write | filename = C:\Users\Default\Music\desktop.ini, size = 512 |
|
1 | |
| File | Write | filename = C:\Users\Default\Music\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Music\desktop.ini, destination_filename = C:\Users\Default\Music\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Music\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Music\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\Music\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\Music\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\Music\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\Links\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Links\desktop.ini, type = size, size_out = 580 |
|
1 | |
| File | Write | filename = C:\Users\Default\Links\desktop.ini, size = 908 |
|
1 | |
| File | Read | filename = C:\Users\Default\Links\desktop.ini, size = 592, size_out = 592 |
|
1 | |
| File | Write | filename = C:\Users\Default\Links\desktop.ini, size = 592 |
|
1 | |
| File | Write | filename = C:\Users\Default\Links\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Links\desktop.ini, destination_filename = C:\Users\Default\Links\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Links\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Links\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\Links\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\Links\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\Links\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\Links\Desktop.lnk, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Links\Desktop.lnk, type = size, size_out = 467 |
|
1 | |
| File | Write | filename = C:\Users\Default\Links\Desktop.lnk, size = 909 |
|
1 | |
| File | Read | filename = C:\Users\Default\Links\Desktop.lnk, size = 480, size_out = 480 |
|
1 | |
| File | Write | filename = C:\Users\Default\Links\Desktop.lnk, size = 480 |
|
1 | |
| File | Write | filename = C:\Users\Default\Links\Desktop.lnk, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Links\Desktop.lnk, destination_filename = C:\Users\Default\Links\Desktop.lnk.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Links\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Links\Downloads.lnk, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Links\Downloads.lnk, type = size, size_out = 894 |
|
1 | |
| File | Write | filename = C:\Users\Default\Links\Downloads.lnk, size = 898 |
|
1 | |
| File | Read | filename = C:\Users\Default\Links\Downloads.lnk, size = 896, size_out = 896 |
|
1 | |
| File | Write | filename = C:\Users\Default\Links\Downloads.lnk, size = 896 |
|
1 | |
| File | Write | filename = C:\Users\Default\Links\Downloads.lnk, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Links\Downloads.lnk, destination_filename = C:\Users\Default\Links\Downloads.lnk.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Links\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Links\RecentPlaces.lnk, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Links\RecentPlaces.lnk, type = size, size_out = 363 |
|
1 | |
| File | Write | filename = C:\Users\Default\Links\RecentPlaces.lnk, size = 901 |
|
1 | |
| File | Read | filename = C:\Users\Default\Links\RecentPlaces.lnk, size = 368, size_out = 368 |
|
1 | |
| File | Write | filename = C:\Users\Default\Links\RecentPlaces.lnk, size = 368 |
|
1 | |
| File | Write | filename = C:\Users\Default\Links\RecentPlaces.lnk, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Links\RecentPlaces.lnk, destination_filename = C:\Users\Default\Links\RecentPlaces.lnk.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Links\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\desktop.ini, type = size, size_out = 402 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\desktop.ini, size = 910 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\desktop.ini, size = 416, size_out = 416 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\desktop.ini, size = 416 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\desktop.ini, destination_filename = C:\Users\Default\Favorites\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\Favorites\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\Favorites\Windows Live\Get Windows Live.url, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Windows Live\Get Windows Live.url, type = size, size_out = 133 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Windows Live\Get Windows Live.url, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\Windows Live\Get Windows Live.url, size = 144, size_out = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Windows Live\Get Windows Live.url, size = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Windows Live\Get Windows Live.url, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\Windows Live\Get Windows Live.url, destination_filename = C:\Users\Default\Favorites\Windows Live\Get Windows Live.url.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Windows Live\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\Windows Live\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Windows Live\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\Favorites\Windows Live\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Windows Live\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Gallery.url, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Gallery.url, type = size, size_out = 133 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Gallery.url, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Gallery.url, size = 144, size_out = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Gallery.url, size = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Gallery.url, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\Windows Live\Windows Live Gallery.url, destination_filename = C:\Users\Default\Favorites\Windows Live\Windows Live Gallery.url.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Windows Live\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Mail.url, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Mail.url, type = size, size_out = 133 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Mail.url, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Mail.url, size = 144, size_out = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Mail.url, size = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Mail.url, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\Windows Live\Windows Live Mail.url, destination_filename = C:\Users\Default\Favorites\Windows Live\Windows Live Mail.url.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Windows Live\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Spaces.url, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Spaces.url, type = size, size_out = 133 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Spaces.url, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Spaces.url, size = 144, size_out = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Spaces.url, size = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Windows Live\Windows Live Spaces.url, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\Windows Live\Windows Live Spaces.url, destination_filename = C:\Users\Default\Favorites\Windows Live\Windows Live Spaces.url.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Windows Live\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\MSN Websites\MSN Autos.url, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\MSN Websites\MSN Autos.url, type = size, size_out = 133 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSN Autos.url, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\MSN Websites\MSN Autos.url, size = 144, size_out = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSN Autos.url, size = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSN Autos.url, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\MSN Websites\MSN Autos.url, destination_filename = C:\Users\Default\Favorites\MSN Websites\MSN Autos.url.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\MSN Websites\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\MSN Websites\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\Favorites\MSN Websites\MSN Entertainment.url, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\MSN Websites\MSN Entertainment.url, type = size, size_out = 133 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSN Entertainment.url, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\MSN Websites\MSN Entertainment.url, size = 144, size_out = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSN Entertainment.url, size = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSN Entertainment.url, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\MSN Websites\MSN Entertainment.url, destination_filename = C:\Users\Default\Favorites\MSN Websites\MSN Entertainment.url.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\MSN Websites\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\MSN Websites\MSN Money.url, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\MSN Websites\MSN Money.url, type = size, size_out = 133 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSN Money.url, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\MSN Websites\MSN Money.url, size = 144, size_out = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSN Money.url, size = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSN Money.url, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\MSN Websites\MSN Money.url, destination_filename = C:\Users\Default\Favorites\MSN Websites\MSN Money.url.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\MSN Websites\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\MSN Websites\MSN Sports.url, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\MSN Websites\MSN Sports.url, type = size, size_out = 133 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSN Sports.url, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\MSN Websites\MSN Sports.url, size = 144, size_out = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSN Sports.url, size = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSN Sports.url, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\MSN Websites\MSN Sports.url, destination_filename = C:\Users\Default\Favorites\MSN Websites\MSN Sports.url.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\MSN Websites\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\MSN Websites\MSN.url, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\MSN Websites\MSN.url, type = size, size_out = 133 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSN.url, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\MSN Websites\MSN.url, size = 144, size_out = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSN.url, size = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSN.url, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\MSN Websites\MSN.url, destination_filename = C:\Users\Default\Favorites\MSN Websites\MSN.url.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\MSN Websites\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\MSN Websites\MSNBC News.url, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\MSN Websites\MSNBC News.url, type = size, size_out = 133 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSNBC News.url, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\MSN Websites\MSNBC News.url, size = 144, size_out = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSNBC News.url, size = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\MSN Websites\MSNBC News.url, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\MSN Websites\MSNBC News.url, destination_filename = C:\Users\Default\Favorites\MSN Websites\MSNBC News.url.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\MSN Websites\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\Microsoft Websites\IE Add-on site.url, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Microsoft Websites\IE Add-on site.url, type = size, size_out = 133 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\IE Add-on site.url, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\Microsoft Websites\IE Add-on site.url, size = 144, size_out = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\IE Add-on site.url, size = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\IE Add-on site.url, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\Microsoft Websites\IE Add-on site.url, destination_filename = C:\Users\Default\Favorites\Microsoft Websites\IE Add-on site.url.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Microsoft Websites\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\Microsoft Websites\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\Favorites\Microsoft Websites\IE site on Microsoft.com.url, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Microsoft Websites\IE site on Microsoft.com.url, type = size, size_out = 133 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\IE site on Microsoft.com.url, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\Microsoft Websites\IE site on Microsoft.com.url, size = 144, size_out = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\IE site on Microsoft.com.url, size = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\IE site on Microsoft.com.url, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\Microsoft Websites\IE site on Microsoft.com.url, destination_filename = C:\Users\Default\Favorites\Microsoft Websites\IE site on Microsoft.com.url.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Microsoft Websites\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Home.url, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Home.url, type = size, size_out = 133 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Home.url, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Home.url, size = 144, size_out = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Home.url, size = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Home.url, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Home.url, destination_filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Home.url.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Microsoft Websites\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Work.url, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Work.url, type = size, size_out = 133 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Work.url, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Work.url, size = 144, size_out = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Work.url, size = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Work.url, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Work.url, destination_filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft At Work.url.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Microsoft Websites\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft Store.url, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft Store.url, type = size, size_out = 134 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft Store.url, size = 906 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft Store.url, size = 144, size_out = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft Store.url, size = 144 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft Store.url, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft Store.url, destination_filename = C:\Users\Default\Favorites\Microsoft Websites\Microsoft Store.url.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Microsoft Websites\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\Links\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Links\desktop.ini, type = size, size_out = 80 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Links\desktop.ini, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\Links\desktop.ini, size = 80, size_out = 80 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Links\desktop.ini, size = 80 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Links\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\Links\desktop.ini, destination_filename = C:\Users\Default\Favorites\Links\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Links\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Favorites\Links\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Links\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\Favorites\Links\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Links\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\Favorites\Links\Web Slice Gallery.url, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Links\Web Slice Gallery.url, type = size, size_out = 226 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Links\Web Slice Gallery.url, size = 910 |
|
1 | |
| File | Read | filename = C:\Users\Default\Favorites\Links\Web Slice Gallery.url, size = 240, size_out = 240 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Links\Web Slice Gallery.url, size = 240 |
|
1 | |
| File | Write | filename = C:\Users\Default\Favorites\Links\Web Slice Gallery.url, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Favorites\Links\Web Slice Gallery.url, destination_filename = C:\Users\Default\Favorites\Links\Web Slice Gallery.url.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Favorites\Links\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Downloads\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Downloads\desktop.ini, type = size, size_out = 282 |
|
1 | |
| File | Write | filename = C:\Users\Default\Downloads\desktop.ini, size = 902 |
|
1 | |
| File | Read | filename = C:\Users\Default\Downloads\desktop.ini, size = 288, size_out = 288 |
|
1 | |
| File | Write | filename = C:\Users\Default\Downloads\desktop.ini, size = 288 |
|
1 | |
| File | Write | filename = C:\Users\Default\Downloads\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Downloads\desktop.ini, destination_filename = C:\Users\Default\Downloads\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Downloads\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Downloads\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\Downloads\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\Downloads\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\Downloads\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\Documents\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Documents\desktop.ini, type = size, size_out = 402 |
|
1 | |
| File | Write | filename = C:\Users\Default\Documents\desktop.ini, size = 910 |
|
1 | |
| File | Read | filename = C:\Users\Default\Documents\desktop.ini, size = 416, size_out = 416 |
|
1 | |
| File | Write | filename = C:\Users\Default\Documents\desktop.ini, size = 416 |
|
1 | |
| File | Write | filename = C:\Users\Default\Documents\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Documents\desktop.ini, destination_filename = C:\Users\Default\Documents\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Documents\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Documents\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\Documents\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\Documents\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\Documents\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\Desktop\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Desktop\desktop.ini, type = size, size_out = 282 |
|
1 | |
| File | Write | filename = C:\Users\Default\Desktop\desktop.ini, size = 902 |
|
1 | |
| File | Read | filename = C:\Users\Default\Desktop\desktop.ini, size = 288, size_out = 288 |
|
1 | |
| File | Write | filename = C:\Users\Default\Desktop\desktop.ini, size = 288 |
|
1 | |
| File | Write | filename = C:\Users\Default\Desktop\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Desktop\desktop.ini, destination_filename = C:\Users\Default\Desktop\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Desktop\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Desktop\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\Desktop\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\Desktop\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\Desktop\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\Contacts\Administrator.contact, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Contacts\Administrator.contact, type = size, size_out = 68382 |
|
1 | |
| File | Write | filename = C:\Users\Default\Contacts\Administrator.contact, size = 898 |
|
1 | |
| File | Read | filename = C:\Users\Default\Contacts\Administrator.contact, size = 68384, size_out = 68384 |
|
1 | |
| File | Write | filename = C:\Users\Default\Contacts\Administrator.contact, size = 68384 |
|
1 | |
| File | Write | filename = C:\Users\Default\Contacts\Administrator.contact, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Contacts\Administrator.contact, destination_filename = C:\Users\Default\Contacts\Administrator.contact.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Contacts\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\Contacts\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\Contacts\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\Contacts\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\Contacts\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\Contacts\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Contacts\desktop.ini, type = size, size_out = 412 |
|
1 | |
| File | Write | filename = C:\Users\Default\Contacts\desktop.ini, size = 900 |
|
1 | |
| File | Read | filename = C:\Users\Default\Contacts\desktop.ini, size = 416, size_out = 416 |
|
1 | |
| File | Write | filename = C:\Users\Default\Contacts\desktop.ini, size = 416 |
|
1 | |
| File | Write | filename = C:\Users\Default\Contacts\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\Contacts\desktop.ini, destination_filename = C:\Users\Default\Contacts\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\Contacts\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\AppData\Local\IconCache.db, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\AppData\Local\IconCache.db, type = size, size_out = 776176 |
|
1 | |
| File | Write | filename = C:\Users\Default\AppData\Local\IconCache.db, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\Default\AppData\Local\IconCache.db, size = 776176, size_out = 776176 |
|
1 | |
| File | Write | filename = C:\Users\Default\AppData\Local\IconCache.db, size = 776176 |
|
1 | |
| File | Write | filename = C:\Users\Default\AppData\Local\IconCache.db, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\Default\AppData\Local\IconCache.db, destination_filename = C:\Users\Default\AppData\Local\IconCache.db.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\Default\AppData\Local\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\Default\AppData\Local\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\Default\AppData\Local\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\Default\AppData\Local\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\Default\AppData\Local\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\Default\AppData\Local\Temp\FXSAPIDebugLogFile.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\Default\AppData\Local\Temp\FXSAPIDebugLogFile.txt, type = size, size_out = 0 |
|
1 | |
| File | Create | filename = C:\Users\All Users\Sun\Java\Java Update\jaureglist.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Sun\Java\Java Update\jaureglist.xml, type = size, size_out = 119 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Sun\Java\Java Update\jaureglist.xml, size = 905 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Sun\Java\Java Update\jaureglist.xml, size = 128, size_out = 128 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Sun\Java\Java Update\jaureglist.xml, size = 128 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Sun\Java\Java Update\jaureglist.xml, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Sun\Java\Java Update\jaureglist.xml, destination_filename = C:\Users\All Users\Sun\Java\Java Update\jaureglist.xml.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Sun\Java\Java Update\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Sun\Java\Java Update\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Sun\Java\Java Update\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Sun\Java\Java Update\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Sun\Java\Java Update\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\cab1.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\cab1.cab, type = size, size_out = 4932896 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\cab1.cab, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\cab1.cab, size = 4932896, size_out = 4932896 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\cab1.cab, size = 4932896 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\cab1.cab, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\cab1.cab, destination_filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\cab1.cab.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi, type = size, size_out = 143360 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi, size = 143360, size_out = 143360 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi, size = 143360 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi, destination_filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\state.rsm, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\state.rsm, type = size, size_out = 766 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\state.rsm, size = 898 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\state.rsm, size = 768, size_out = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\state.rsm, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\state.rsm, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\state.rsm, destination_filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\state.rsm.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\VC_redist.x86.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\VC_redist.x86.exe, type = size, size_out = 781872 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\VC_redist.x86.exe, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\VC_redist.x86.exe, size = 781872, size_out = 781872 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\VC_redist.x86.exe, size = 781872 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\VC_redist.x86.exe, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\VC_redist.x86.exe, destination_filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\VC_redist.x86.exe.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\state.rsm, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\state.rsm, type = size, size_out = 666 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\state.rsm, size = 902 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\state.rsm, size = 672, size_out = 672 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\state.rsm, size = 672 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\state.rsm, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\state.rsm, destination_filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\state.rsm.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\vcredist_x86.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\vcredist_x86.exe, type = size, size_out = 462976 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\vcredist_x86.exe, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\vcredist_x86.exe, size = 462976, size_out = 462976 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\vcredist_x86.exe, size = 462976 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\vcredist_x86.exe, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\vcredist_x86.exe, destination_filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\vcredist_x86.exe.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\state.rsm, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\state.rsm, type = size, size_out = 766 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\state.rsm, size = 898 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\state.rsm, size = 768, size_out = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\state.rsm, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\state.rsm, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\state.rsm, destination_filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\state.rsm.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\VC_redist.x64.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\VC_redist.x64.exe, type = size, size_out = 781880 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\VC_redist.x64.exe, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\VC_redist.x64.exe, size = 781880, size_out = 781880 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\VC_redist.x64.exe, size = 781880 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\VC_redist.x64.exe, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\VC_redist.x64.exe, destination_filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\VC_redist.x64.exe.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\cab1.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\cab1.cab, type = size, size_out = 5881317 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 2621440, size_out = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 2621440 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 2621440, size_out = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\cab1.cab, destination_filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\cab1.cab.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi, type = size, size_out = 143360 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi, size = 143360, size_out = 143360 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi, size = 143360 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi, destination_filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab, type = size, size_out = 809765 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab, size = 809776, size_out = 809776 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab, size = 809776 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab, destination_filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi, type = size, size_out = 151552 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi, size = 151552, size_out = 151552 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi, size = 151552 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi, destination_filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm, type = size, size_out = 654 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm, size = 898 |
|
1 |
Process #2: rlrgwq.exe
50979
0
| Information | Value |
|---|---|
| ID | #2 |
| File Name | c:\users\5p5nrgjn0js halpmcxz\appdata\local\rlrgwq.exe |
| Command Line | "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\rlrgwq.exe" |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:01:28, Reason: Autostart |
| Unmonitor | End Time: 00:03:57, Reason: Terminated by Timeout |
| Monitor Duration | 00:02:28 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x4dc |
| Parent PID | 0x3a8 (c:\windows\system32\audiodg.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege |
| Thread IDs |
0x
4E0
0x
538
0x
644
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| rlrgwq.exe | 0x00400000 | 0x0040DFFF | Relevant Image | - | 32-bit | - |
|
|
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\2JSO83ouDCpS9bPG7Ae.swf | 24.75 KB |
MD5:
2573f50c2e434e9f72cbbdfdcc75dc0a
SHA1: e45c8e2bc3bef95737824177e3cdc27892faf4c8 SHA256: bf0a2c74981bdb5548bd4b9c0e7ef373e5e439f6354d4c247c46db295ae94c23 SSDeep: 768:+z4ijox1uK6F4vzMsMg+CByhzi2XyLUQLR8mjMdB/:uzo7uK6yvfrUziXj6mw/ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bKiC9mt1u.mp4 | 31.67 KB |
MD5:
7b4699265ed52d45b11c77cbc2195027
SHA1: 0081a9a1ec60c1fdeda6821114f8370c461207e1 SHA256: af93a6b4dbbdeba60ea94084e18628d6737fd3e3602ab4c991445f91532aff29 SSDeep: 384:CmAhqTU0xcfe74uYfI41hhp2GQhv8zxC40ZpDm0SryO5eticV9b+K/CWlT7Hj/Ul:BAURtzYgc2pluxCFTiQ99NqWlY |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini | 1.44 KB |
MD5:
073e0ba2ed638a557e79172d62606569
SHA1: bfe023c51de873d319980b83b01cbb6cf32e6694 SHA256: 5a46009d91de1ee4203851c89b896080b2001cecdc8a072e6a884b05c577a151 SSDeep: 24:IuXV8Ppgm31gtC2ivRnvKEnOsv8vugYqNrJM+i4cJtmLxONmyIK+HZhoBkrLKRI9:dl8PpnFSxiJniisQqzfi4eshyIK+HMB6 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\PMIlhquoGP0fFB.bmp | 82.31 KB |
MD5:
28aa52ce469db12fcc07310977ce35ad
SHA1: 2064f0aa376cf63edf768a7a4bd95f45a58b9dd1 SHA256: c305f288c07aecb2c157d56cd496fe9a42edec2eea0c8cb6a983abde3b1dff01 SSDeep: 1536:HKKLDmK7MsrtaiW3nw53ippja26lkOOyoyumL654wgFr1YpSEY899HavlEl5K:qK/7Ms5aiW3ne3gO2BBZyf25jgFRzEYd |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\tUKrVvos3DRk_t_A.gif | 32.12 KB |
MD5:
f0900ebf4a516b6827ede767b3f52862
SHA1: 777a4e751a9c161d0935544ffeebafa13081a00a SHA256: d9152b5bdcba553d00408931644d48981b4ac08cb58b06fd5e4b92e24d1ce160 SSDeep: 768:sGKYTpVCFIc/QkvTnsZ9YWmQ7xc5iccX7CX:IWV/SQGLsDmic5itU |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\AkpFL-oB-3Fu6pJr1qI.bmp | 28.98 KB |
MD5:
5634656302ed867f931fe7af575f3b19
SHA1: c6a4f7bf1a267a73ff9a16195287fd3cc1d1d454 SHA256: 8173d7652cdffde849f2d97572b28e2eca1f3ecc5ba223ae2db71ddcbc88a629 SSDeep: 768:WjuWra2lJs0bXISi6inWp4lAuQQQtBjEfmZvHCnPbSE9iW:WyWra2lJbXISHwlAuQQE+ikzr |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\O2aPlZsulS.wav | 12.90 KB |
MD5:
0ccfb9c443626a087d3e26a8480b6073
SHA1: 493f4225b6c13eb5e2a3ae710102a5ceb9da8651 SHA256: aaa72287dfdd1b08ba998a0ba9f6e48a06fba38f9952e79efbc79b14736b8d00 SSDeep: 384:DgLDhG6vfgliXttXy9AO7IeyuC8+Moc8SX76a:D0dsQDfbeyvrna |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\Z-yKq14SjTyCv.mp3 | 81.05 KB |
MD5:
fa6f8c47a4f5d96155bb5d9bc4f5fe93
SHA1: 60fc304c68217dcf76f91e8b098a9da1e5283c7e SHA256: bc68caa8347fa03ed6c2bb039f10f3e003b78e948d74988640afcbbde9f2695e SSDeep: 1536:dRTcckZ0U/ciGsBo9KC1MLIzFzzdbO9ZEaJJsNgz4wtM39L8WXJP7a6vun:4/R8sS9t1XbO9h78wtoakJPWp |
|
|
| C:\#NEW_WAVE.html | 4.39 KB |
MD5:
58ad195e9d0095a431a264750c2da5ce
SHA1: 36694cb4e6c9a7258961769e19f29b0e41c03057 SHA256: 9f65b685b71917ea3347a705bcaefd9be15f5e99a27d1519c3f2e8beef618e2a SSDeep: 96:WfGTAYLZ6LxJQKvQXT6W7Ufh4LHMnczJBVF3cRJk:WfG7ovQuAUJrn+p+ |
|
|
| C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp.[new_wave@tuta.io].LotR | 246.92 KB |
MD5:
4ea75a6d0bb024bbd89b613d21abd79d
SHA1: 2cb38040d02616c34bdc32f204ed5fa018ca1cbf SHA256: cd2ebdd280bc1aac7aceef89821362150935e6494f1d67328ecf3dec82f3a4bd SSDeep: 6144:9ECxTWed175xG92aGKvZ6TxpVEltCFWTcHPL59/2Edo:9EClpd1XaGKEkNB |
|
|
| C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp.[new_wave@tuta.io].LotR | 16.89 MB |
MD5:
a945998891195d97c2136a5901db4840
SHA1: df510154cf246e218ce493e821a5a57073264d79 SHA256: 737707878f73ab58370a672aa9e3ce3bb3f0650c3cb5aa509d3d902afa5f5604 SSDeep: 196608:N/4Vr35od9vDXadSLsS8nQsiAESOsYnwZrja9segf:JO35+9vsItAqpnevIu |
|
|
| C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp.[new_wave@tuta.io].LotR | 16.61 MB |
MD5:
5deba3a52ad17d4d0268ff951cc77085
SHA1: 99c3fc8cd878b170244bb2fbbe91b284b1f4cddd SHA256: fece18fa2f8aeb6190e5b6a6baf9f29eeaf69b125ced36af664e765047fa9070 SSDeep: 196608:YVRoamQ5g+Qo4iT6YqQitS7+KgxUzGVw9vV+Ud5CP46ZjNK:4v9MxdBISxUzGVw7+YMggK |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.ini | 976 bytes |
MD5:
c4f00591c5de364cb9a7c359df2b69b5
SHA1: 961c7f80ad426843c5b7acc6b5dfb45a19b3b027 SHA256: 3fd0298c1d37e3aba5bf24f6c9c055babc34ae648c3a5411df7f0308badeab53 SSDeep: 24:Q+oVto/+wJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdNkdI:ktopfi4eshyIK+HMBk3K6tzJf9 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-nUCOEGRczOsCz1Bo X.mkv | 4.88 KB |
MD5:
e20189e8d50fc088345284d08a1a74c9
SHA1: 840b99d981602ae65e57e9d45b2eb8892f9dffd3 SHA256: 16280da14106c51ba512f56ed2c7fba3400ef10e2d3a9ebadd63b8a5bea5f407 SSDeep: 96:c5x6J1hqUjMOkL77VGf3rZltL5RIfi73/u132drueyllloLHMnczA:cr8qUjRkXhO77tL5RIfGV1Ahn7 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\50go8cizDba.swf | 46.06 KB |
MD5:
582979e44579789350ddffba7b12bde7
SHA1: 11d2e1b0d7d08732fc4cbda496a74f2cfede029c SHA256: a85a57e07a3ee78a988994fd73e25380854797af2b6f2f578e02329b1463d9ce SSDeep: 768:SsR1SXv96zkFXbGJmDxzJchL3/RXBpJNBVw+fhgsd1YsgJY+bMao0CKkeCF:SgSfVpxVcxpJNzvf1YUp00eE |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\66W7GLZlR67bh47tKngc.mkv | 24.91 KB |
MD5:
38b2f2f82cc794df5597be92e4377927
SHA1: 33fdb88cdf310b87e872ed582d94dde5187bd38c SHA256: 19dd75771ce749f716e88a752558c745224c2579f2a0269aa2ea55f27dc1c6f5 SSDeep: 768:bSp5sKsbpqjXGeFdi9aaW8K0S7RlE94VY:0sKsbpqj2ea9oBRmCY |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\7VBXl.flv | 6.23 KB |
MD5:
50dfd6e386c1d5b6522123cc7d4238c7
SHA1: c57f0325543afba38d8af072b52f8a3efb4e5c02 SHA256: 5af42d16b09eff7231095eb2fc1395ed50d933680e37cadd0916b5ac5088fbbe SSDeep: 96:EQpYP1r3jnv2d2+9hFZ3uFx42dRPklCfaSM5g9iti5DQGDL3KGULHMnczhL:9Gzjedt9hFJQfklOaSMb85DN3K8n+ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aE9jV.flv | 100.73 KB |
MD5:
8491e3a6b2c132b7f8ae3840a98ed3c8
SHA1: 3e7e850ffa8e23e65f576958cfe7909d46d96625 SHA256: 167d21b9fb4b4f9f8fd0ca05af1230c774391f1e6cab0e9a5f1de07fcb304c33 SSDeep: 3072:Czy795CnpwanrrhycB6+epKJyDi4l3gw9s/:gnndrNBApJV31s/ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aNUUlrT.flv | 100.34 KB |
MD5:
fcdcb5822536f1b30a458fdc6d7abfbe
SHA1: f0acfce910021c37b21a8bc260c12320fe7715ba SHA256: 5dabfee24a0de4346e884c65cff6c6de9fadec7beea667b3ed82f6f37fa7d949 SSDeep: 3072:sFwa3/EL0apKeRao97ZJI5wKREsG3oPlF2sUxFf8s4dX:sCa3/YD0eRxFZCD3GQbFoFfR4dX |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bCh a1QCSk8UxYc9ccf.mp4 | 11.08 KB |
MD5:
c42c0d521360c945f04c13aa7257b170
SHA1: 4cd21fd0b533e5649890446e7a694fe2a224ab39 SHA256: ba0cf947a83b016d841e0626fa7231b93778623dfb0e38833de896fcab096483 SSDeep: 192:wJArsWhq0o3koZ9Fo/JaIHZs78pTwdtveMc5Wfx59iklRCRXQnC5A/GsXi8nW:ul0+koTFo/JFHZseitvXc58xLDjCNYC1 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cjtMDRiyTAFaUZKrh1q3.avi | 53.44 KB |
MD5:
4b97e70f8024613533821e54b846bf0b
SHA1: fc9f5289e756b2599be69a117070dbe15fd39fa4 SHA256: e31f30aa433471a6260fb3df3e1600a787efba73d0adf2d710be67e23024de21 SSDeep: 768:5vF5ToF9j0CRX/O/SwGeWYCIP/if5kkcRESMPAKoU5WONYc2ksYTx3i3aHlbPP+3:hiasJwGq5Hi9cREJAP0WAokx3i3mALRl |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D a9i.flv | 48.04 KB |
MD5:
2fa7c6b804ec8d2338b848a3774fa334
SHA1: 5b04f0ff9b60c7a7a32dbd07c96b26af7f7c94e8 SHA256: 9467845a4e1e8a144659d6fe5a66f32299f34e7737c558ba70df318c4c297a80 SSDeep: 1536:3P0ZE8A3qX9AyF5gWbePg0gazQRK388Ox9jz2rZwhU:8KFqNAQbePvsN1jzsZwhU |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini | 1.42 KB |
MD5:
435b3a13dd994d90d8924dda95cf94ab
SHA1: a5ad15a7d12c81320ecd524f860b8b8c6ef51ec5 SHA256: 820b83007c6847690193be99e022cf093edae29e830a163945df2c6020df2ed2 SSDeep: 24:1CRq+DjVmxIgZB5sZo5zQuL5Wa+KJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfda:1CRqeVm2iTsZSzQu1r+0fi4eshyIK+H2 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\euiHA5JNEZO0QAE38V.swf | 61.75 KB |
MD5:
fafdab8f764557ab769950c11c435e19
SHA1: 41eccd898518d4620be38c32afe811fc6e537d1e SHA256: dfbe34e697ca3acfb5d6b8c3587b886123f72a2b2f9015a2fa482e01320c24b1 SSDeep: 1536:gWLssumesINqW8RW6K/Jtz4cxzac22sDDJOoba:3f8sINqW8Ri/Pz4cpXMla |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\FvB8YVtqFect_Vs.avi | 83.09 KB |
MD5:
78a4bae81d7621585baa5bd7cc2a4ca5
SHA1: 0fca1e4894f8c5c6c09cdb94fdcba606f4f0adbf SHA256: 61aa69c7dfa7c04373e55f253faf246f670b8e09f9ad0f26c9f02333300973ce SSDeep: 1536:gykDz2hldelCCXkILun6pxtikG2q3zPCnjYxLhtATvDPEu55rT9/h4:NY57kILZ092qDPCjSKTbTzk |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\fW_z.flv | 93.57 KB |
MD5:
a26a21766bcfdd371756fec007031d7e
SHA1: b409d40f9a1fd6948a65e4a92ba9ae673cc540f5 SHA256: 55a67974878f009d0c334c97bb9317a6faff19049b575eda8731364690b8aa5d SSDeep: 1536:d1HdbIRMSX+3LAu8/kjaruOyzjLmndOsxRIsdg9WJIjls1F5e118GLF080R0CHBd:7pIB+3LAjSarLyPKnddW8g9CIjl8+AAG |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gLR9Tkk6Ry-em-K.mkv | 17.89 KB |
MD5:
d3969d27fe992c5b75d700b35cd8e89c
SHA1: 02609a125628ace14d818b5eb5a8a549abea0217 SHA256: 6802319a83f9eb8d480b954175828326e29115211d06e8252077ef7144e78f88 SSDeep: 384:qUAiDD+bEQ5zf0JzFIcRKMOHo6UoZWJfFONOOGWTuezkIA:qC0EYf0JzFI7Hs9ONO66eQ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gsMoEjHN.flv | 41.56 KB |
MD5:
cb2e85e1f8fa1da8fad97f7ad1f50fc1
SHA1: 3a931b9237796b1ad2f6250fec209a7a91d48e12 SHA256: 3426dc39fa3bebc3d2818395e9f5185064188a21a6d3ee90af6841aedcc6df58 SSDeep: 768:FsjNZkGHyTLUamNfYQLL+oKY/lVkkTW+o/EHT6OBC8Ckehx3drALiA64SNtv:CpZkGHykamdzfYY8kI8HT6OBckMxNhAc |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hbHSG0BJ.flv | 35.11 KB |
MD5:
fbe2ec7f951bb37e2c3b8d85e4dd3e31
SHA1: 4e48e125fc10fbd7b560fac1ffcc70d44ded4f0d SHA256: 10498f80f383cff3931728e25079530e3d0d7e9ad99d4ac89957ec4ded1a6a08 SSDeep: 768:0nlbwAl8Qz476LWTvb0teTTwV6LDc8GBOGlWovSnRFBq9PVdLvhnrf:0n58QUG1tejLDcvhlWHRa5vJnrf |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hFuOplmGpA.mp4 | 23.28 KB |
MD5:
8c9ff0d55839fd9b8015f5da40db6565
SHA1: 45a5e3812fda55d0ad427a75a37586268f8b967a SHA256: 451dc41960a443800d8d5633c814f942982ddc71c9cf5551563d8048e554e416 SSDeep: 384:nAkx0bMF5PXFxVfiyjM4NtNhvS8HC8yfV/yyRK79OoVBLowRlGnXmGhWphCQsR:n/nXF3i+NtNha8HifVKpVywMWkGji |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\j3lS-CX.swf | 42.41 KB |
MD5:
936b8326838f4af76be93a35da0a7968
SHA1: bf8bfc2985246a38175359e3965098e5c8ac0ced SHA256: ce0e99ed1c59b762b0183b2a63ad19741b3f2d6c32c2f7532c1c01397b270176 SSDeep: 768:FbgGMtow/pXePVFZ9FriEv9A4YU9lxl517MFzLYbnQCIuc9ZENObqJMd8VZIK:FkGMt5/kPN9Rxl517m8QCIuc9yiqLX/ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\jPsYR8ZZ2L.mkv | 78.64 KB |
MD5:
069d36bc3d2d45e1f58ce0add8d252ff
SHA1: 8da77befd99bfd27b867829308bfcf7a40113eb1 SHA256: 2a741c92593492cf09d01c85bf895ebd3d389c4a6a8564f7738f5bcab31a5f0c SSDeep: 1536:6n08LVh57EkxSU/gA5Qj80e4kquj0JSey3qbPHxDYPeR5lC5Cte8aBnwKkBa9+:2Vh5EQS0TKQJ4kS7ysHxU6UrvyKoa4 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Kgv66V0yUi.flv | 100.56 KB |
MD5:
da509fb01e07be24d568f800be5a2c83
SHA1: 61dd2e0f6e5f25ee248e4c98f16925da747a795f SHA256: 395734f4dd2e1bc4b3ddd87d389ee31b0064d60a9097631680ac269961feef4d SSDeep: 3072:l8AT7L/WXNTtSuQM75psv4RTXknl51/+6DRCz+VCdH:lR7MYuhtRRTXm/+6dbVCdH |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\L9mu6tuR8QFKGNd.mkv | 10.08 KB |
MD5:
ece83a083bde2093555fc8be8c0e18bd
SHA1: f25c28f9edf936babdd8934f99f1b354471c0e40 SHA256: 139d0515ec6564e5eef78045de98b250d5b6b23d2f938f7be3a73af84bd6a896 SSDeep: 192:3m64jmZTTqpvskAgNhbz3G+u7K742ZW/5kSaKSGMiD6UgfAOChWNRFBdXQnC:3CaQVsjKhbXi4zWBYKmiD6UdviRTJQC |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lNQJ.mp4 | 91.05 KB |
MD5:
5f8e7d5bd9de05d3513c6bb806558e90
SHA1: 5e060bb034a528236c801ef1e86b03a725c08822 SHA256: f8cb6d55d23354ed1c46f8dc5864a7893ce312041d18e6347bc2f45b78486a23 SSDeep: 1536:QNAs6VVtCPkLO1rTpgUGIEtU69Ch/NEUhppR1WFSj+8IZGJCjrqTGf:QNA5MPsO1rlgSl69CptpAFnG2f |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lujYR96ua7eRgBXkLlG.flv | 34.11 KB |
MD5:
d1964e13a16f80ac65a5141eb5b4840a
SHA1: 2b2e3d3c0593dd5746631f2d77672c5b7c78d3cd SHA256: 1d699dc60e2f9f7030dca2618bb77dd900b7a16743c011199824a4e9cb828273 SSDeep: 768:Fctqb3OEb/S08pjRIthLdC72nglD97mO2822YbWYwu:mtI3hz38jmhLdC72y7h2PWA |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\m sf.mkv | 58.03 KB |
MD5:
c8c2b169042af04d69d5f2d54c991c72
SHA1: d6906be494861381441a003808dad8e6a06d6cf5 SHA256: 8238136b4d897f270201b83a2ca902e0536101f185b33efa75f895a3ff5d96cd SSDeep: 1536:TZUwbHjWGeME9j9aQ038CfEKinOMkSsNs:dUcWG9E9jH0380oqJs |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\mcMXbxYj93Ssek.mp4 | 8.31 KB |
MD5:
db7a2e4278cf91b2a9bc2ec06a0aee6d
SHA1: 1bcafda88b097d9a72bd1f5b9036e086d9ec0bd0 SHA256: b1e6cd96ff54791b78c2eba27db428fda079d46fec07f83a5cd083d437693a34 SSDeep: 192:DaXPaXpaePQPipWEO/mmOKUbOnn5EdZGqaFha7IxNnV:OXEEipWSvKMOnngSFoeV |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\NjUcM5pMiJ9V4WxAll6.avi | 29.15 KB |
MD5:
715b00f1bef51f5016f76a95d83c8724
SHA1: 0773177ca591dc2890aa0a3e064572e3fb12a90f SHA256: a92c082337893657d2fcad7a80e55dcc899627fa687125a6edc7b84b5f5b575e SSDeep: 768:4JhK868WhybR7sNOqB4fcJy0hj/be7qijWkmeM9oOS:4DBxROdB4fIJTiWFu7 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\nN83yzk3cXA.swf | 15.66 KB |
MD5:
12a2e7deb6982a7ce792a7389da26af1
SHA1: 1e97614bd2fb2a573f9e6a096b29aaa9dbfa7ffa SHA256: 6e5ee8ba5e16ed35d539b91336b79d7ab4690d56cd6b86e7f069b982cd5ebe0e SSDeep: 384:6rFiTg5267NAuDtBFtXWI1PA+ca2s3Hw+2T9CHy:2FQi7bXFoIGS2UHwPBCS |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\q274Jlys8 3Y.swf | 33.28 KB |
MD5:
3c2a410bb87ec86c12f3828e69b859c5
SHA1: a5d1a907ff43f731a4cfcb4c3f913aaab0027974 SHA256: 7249fa5e3e35e54f4e683adfa8e772d6f2ac538ee9e7a66c5f010ce817aa5143 SSDeep: 768:6GlJc+haWxMQiUpOOG9+Pysf02OCksKoDIcS426Wkg/ETXX:jxhTMGpOOJy3zC49423qXX |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\r62Y9.mkv | 11.74 KB |
MD5:
38c241419bfc9075e13b60ec3d07d7b5
SHA1: 4b2c2a2e3b29b1e04785ba94b7374d2a62198113 SHA256: c39666c27051b1cc43e02ed34c466ade9b3c2b6f690dacf6144c72920730d1ae SSDeep: 192:VY/9IWDwM/ye1xvojzN6CHqQ17PBPyX8sDCgiAcTo7lTvtRwbbvDsXrnz8:Vk9IWmevwjzN6CHqQ1ZpssK7l5KvsbQ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\rbPFWos6idXHH.avi | 3.75 KB |
MD5:
d5437437964addc6990d62df31a3f4d3
SHA1: 5290a439008eca183acbfe3da0895872b1deb776 SHA256: 3586cde384be5bd5ad4e85f16e7cba277017f681fb7a1cc844ddb22cdc38b56c SSDeep: 96:l+NWK9WlKXA0BynCVCkswVw3IGMwSWuLHMnczW0:Q99WlaeWjtdTwJnY |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\SrmDFbFK3gj.swf | 60.89 KB |
MD5:
a2989019556c7a1a71d07729e5b29953
SHA1: 04788c97dc0eb27e8656b341d10abfbe95a60618 SHA256: fa37790499f7c9c4badc675c9e15a62de32683f910d32ffd31efe5e576856b81 SSDeep: 1536:LwLMIrcaCIpqSIXzmhkcJ/ShsFWdsjFYWxzlCqJsa:UwIFr0MRSpWKWhEqj |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\TsPuu1 1sMP.mp4 | 10.04 KB |
MD5:
44b50250e44a79c7c1fcd829e2372a57
SHA1: 89ef34f784ddee552bcec6ee53ca63fd5d663ade SHA256: e55d762fab4dbcb6523a9084099f008e6366b7aa5bd3179bf75dc69de55dfeef SSDeep: 192:4rngxTr5IOj7cynYAqDlnJjHdh9bi42BOQt9DzBu4GIUnM:0gN2OjtYnDlnNHdh9bi42/HYHIUM |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\VIz1GRR.swf | 44.00 KB |
MD5:
e5b4fa985c3520efd2d47521abaf8c2e
SHA1: a70cdb2e1391f82c30d10a8543f7afbb5f87af3a SHA256: 2241d6ad5094dec7d3bc1918a85e797b5af47868ebc2e7870ef089a9f93e9fa3 SSDeep: 768:bqJkXt8HgRaDlb3r0rNeEk/nibIQep4JOCBpe2HlZcTiW+GB/zxEsgbj5sSi:bQMt8H9bKeibkp44Ue2HrcW9GBdlYj5o |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WGsPO0aBRCLEqnQH53ju.mkv | 11.99 KB |
MD5:
a391636e3da647fb3aff9bbb05a206a3
SHA1: 6127828aaaf67e2e96ebed8d765283c671005932 SHA256: afbe69695311b6db0c0beff15051809cbdda3f8c627dbbc8fa511a4c46c71d4f SSDeep: 192:0fB3QcdJI1SZh49v/HAgd3uPOrRbWJY0oyD6qzeR/prIQ+cXSjGBq3jcrJdDqCfz:0FdmIPs+YRKm0H6nBRoRzoL2W+iSG |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WQjxjaZ4Wor.flv | 54.39 KB |
MD5:
9eb724aaa78ee32a54429248d745b4e0
SHA1: ee8e2e5bbc1fc63b7a9498683b1e11f97061d67d SHA256: 6ae5c8ca42561c30375f868ad037a8be66c9152b515a6c35fe71e9457ebdd734 SSDeep: 1536:X7I8C8Rot0UBxNp3Dl/5h8jT0AoKV8uNP7:ZFMHBs8uh |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxQZQRTiEQb.swf | 14.19 KB |
MD5:
bafb0869d02740b0564976545f6b9ac6
SHA1: 44d6cecb5abe67097ee11074b1a32acb5e00043e SHA256: 4bf9438197f0a8cf47ff9eeebbfc106dd749a632a367263037f12c3266892b5a SSDeep: 384:GpnHPI5XTzEprLEvOaLqgySpWLYM4DLhV6:GpnHkjzQag9LYM4Hh8 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ybtQ4TGZHLJZLR.swf | 49.45 KB |
MD5:
eeb8af579f1faecefbad786cbb32d09c
SHA1: ec60c46a0cba23d4627acc503da0c31e9c06c8f1 SHA256: 8963f5d944aab5a32a5ce9fff5dd96142718508fa30cce1e97dabd98c2bf6085 SSDeep: 768:C4D4rquTfSVnzgS9KuEc5jC0URNsLf5A9OuHfmCGw+zFXM3s03fb1Lvil9Sx4Yxq:lDQq5VswcMe99Orw+xzgjJ/pxfre |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\z5HdOvqGy8Yj.mp4 | 61.45 KB |
MD5:
5e96b6a1b989b5dfb83119d0ac796b34
SHA1: 3fbddee805f4bb0c79d5f0cf517dea0c681e71b9 SHA256: 5ba2c9423feeb3a8ffb751cd6f12955660f4302c2863509ae1ea222c3c7c055a SSDeep: 1536:tCHDPccUfFnvUmmlKf5ll0llmpezs+gNZZ:AjUGDlaz0fAezsTNz |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_abCHe-XTb.avi | 5.81 KB |
MD5:
a52e858e3bf768bf8ecb8209b4603f0f
SHA1: 92988f64c3bfedc0de875a601cfc8677e9794f61 SHA256: 0d98c8960be3f1e6dc4723a3bd50ea3acd3791a3522c8f01b9928a916ef5706e SSDeep: 96:P7yV5l/LPcedGzXp+E36z5v7gO8NFgcnfZA7iqC0K85IsFoF3eSRO5rOLHMnczy:+V5xzd2X1S5EO8hnfZn0rIrXRsnB |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms | 1.17 KB |
MD5:
39ffba6ffff55965c8f5d9e35ed9da40
SHA1: fc43d2bad01c38de6e247d7a4f9c349d06472172 SHA256: de27409579215aedcfc8a3a7cb7191f22182b457411b406cc84ffdcfe20c6855 SSDeep: 24:OffoWW2byTbME8BPa1JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdwOSE:ebyTbM7BPaLfi4eshyIK+HMBk3K6tzJ9 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms | 1.17 KB |
MD5:
f0b9f07d089fd2801e56ba9461c6996f
SHA1: 990cb2708a895b73ced3326f8781c0edfdc61753 SHA256: 0f37f9fb20f3789131d455754097dbfdd15e5d7d1e5e9fc8a85250a00cb72399 SSDeep: 24:bpWzcjun8ADbCYS5TpvoJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdyoEn:bpWcj5ADb9S5ofi4eshyIK+HMBk3K6te |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini | 1.20 KB |
MD5:
d2fff218c921bd8e4144604f49346a9a
SHA1: 0303e57afe8700a8e9b84a1228a567869f53f8ef SHA256: 3a1b0023db168b3fc7ec6fb1b0995ef543d6ab7be8c7733d33539cd0dfa68a82 SSDeep: 24:G4RY7S8bQq9JiVJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdz5+:TYZbL9Jirfi4eshyIK+HMBk3K6tzJfpQ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\2zE5wO.png | 86.97 KB |
MD5:
6d4525fda1475b74d339da23190202d4
SHA1: 8de547edb3ce254374dc24692dce42af5bc0b886 SHA256: 7295df6ba558fcf857b2897da451b23ec4b5e994a5c847ea60638989cc0b0edc SSDeep: 1536:3X7r60lMvPDvRbIuMdlQTiwO+0GptObyyPGgEByYY0wy3t8YD:3X7G0aDvxdPiwO7GqGgsdwy3WU |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\BDZVG7.jpg | 2.97 KB |
MD5:
701252f739e70cfb1047f2355dec23ce
SHA1: 31348d35e5be831f7ebb7f4089b128738662d9d8 SHA256: da810eb8b52ae66c592d10024d6f72c937ded41f931063ae5c977313c44da3da SSDeep: 48:bFOLkPUGt+eBHUtDT2iowbB17dTGpXpi1JH0WkdIGfi4eshyIK+HMBk3K6tzJfTY:BOgLt+eA6idhTGpZCUpdjLHMnczpC7 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini | 1.42 KB |
MD5:
93d5d1ff53a7e1e62167120ea0cea562
SHA1: 06f784fdab5443762a3482716e072e59c8768399 SHA256: a3d470d679363fcd633424c7c7ac53067f8d02e50904a42917a29af83e2fde37 SSDeep: 24:ra28aoWz9ZQy6kFI/Q4bonZtqGaovNqyNfqpwJM+i4cJtmLxONmyIK+HZhoBkrLl:raD6Iy6kYQ4b0XxakNqyNyIfi4eshyI5 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EhFf.jpg | 76.14 KB |
MD5:
51ca2d1d89303485161d678527a9e761
SHA1: 541321d75479626eeb0f927e39fadca6ad4e87ed SHA256: 94e1352c0c827dd7afa779e8260410b58002590c045373382ec1310581845477 SSDeep: 1536:VwjtvXe6A6lNYhPykQK07+xBBqyDCrxq7HVEmk:QvvlW/b07YB/HVc |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IFD1vl1FyXPwvpwAWHo.gif | 4.75 KB |
MD5:
48c247ad0c6d9fc83dbef2af6b8d48c0
SHA1: 58041633fcdc9ce12d444f0d96e811a88c35c114 SHA256: 585cb818874089d4e6d78127fbdb07d6b1a6c0670cd1b16e5b83bc01d67d0cff SSDeep: 96:vrlgF08bolLj196Je/whGvFqS+abobTYrlZTPlRoza2XKqLHMnczN:v+F3bopjuJe/whGvFqcEYUz7Unq |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\nj9WTrBqdjX.png | 77.73 KB |
MD5:
16af6dedec25fb20deb80fb296cc06be
SHA1: a48d4376478d245bf0d6822ac5576add22670447 SHA256: 2b763b03aa79590361d0e44fdab192bb9aff1bb9d3440bd0a586f81e26d5f0c0 SSDeep: 1536:WNMYnrj2TbawPKt4kkTI/II906KhC2a8RPDeOFDg1i/DN7Zj5zd7y4cbkoFLM+vi:WNMYnrdaA4PI/IcF2fDe0y4DNJ5RCZ1I |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QpjBoBaddhja0bGiYTni.bmp | 36.19 KB |
MD5:
3b63b93f6eb90f988bec4fa71795afad
SHA1: 14cb6ed3c217bf385e229dd13b611376c98861fb SHA256: 53960178437ee4e83253eb62f6a1a0007e43b8aa318cdeed209c54f26770506e SSDeep: 768:gPLA29p8WLTNov/bJ4+DCzmZwBV/KbM0Paf0vx0WzfpV:gPLA29eWlICE8KpPamx0WT3 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\VjwflUU3g7Ux_MGZXe.png | 95.21 KB |
MD5:
941e4bb171c9a514fbffcc49a56e8b65
SHA1: aef1d9bfff5148e29451274f918e089eb72106a4 SHA256: 38ca6afa710a8063d91d57a500683701ae206e890baa7a5c93b34f560103c58a SSDeep: 1536:sjB6eQyoQXM/Mm5oWv5h7VUlLKLRs84pW0FEVv23tSQYn/VkAO8KmLOBZuOWjZnS:8vNXCMWv5hBoL+s8hVGYfGx8VLv9ZnS |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\1Xosf.png | 17.41 KB |
MD5:
f728753ca97ed6ce044a5da6527a2ab9
SHA1: 4f3d66bc5e90ec5e965ea246e6c875f577278340 SHA256: a28b273d603a261b00e548d5a557e32bce2fc20ac56b3e8f723159e7b210ca65 SSDeep: 384:Jmla6kt+RzZyw89wkIpvLQ39Qk/Wc9e2IGUjtrJoojAB:Jml4tu7owkIBk3e3IuBh1oR |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\A7GFfwu-bHqk.gif | 24.16 KB |
MD5:
a7c5c67581ba3d9c42dd1eb40f64153e
SHA1: bf3944d383e0159e8578b5b88916e967dbb92c1c SHA256: af93a8206a09190063fd2039e8fd16df5ec6b825ecfa11b5974473e27822953a SSDeep: 384:916d126g2iZ6xoeNHPFIDsm4feHx4P4NzVq0EPJWcxnXEpNDiWvVZLJtiELZvHhn:916aZ6x5q6eK8SWc9XEppnmcvmI3TOd6 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\SR4T2D.gif | 77.07 KB |
MD5:
1f4e87c59bd7adc6c64ebca47a61e69e
SHA1: 9ebbc64db34c0601fd10603cd8f5a454a58a0799 SHA256: b47c2732cafa52c22ce9f83bf759215f926ac5e0bf479929dc5a234fbc0eeab4 SSDeep: 1536:MPeOJXquUtYv5lYnbB98FVlx2fZWx87TVDUr9z6vqy5Hw1yY2wz5zUNhSIu33vJ2:MPlJ6VYv5lYnbcoZu83V4JCqkH2yhU5e |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\41E2vjn.gif | 30.16 KB |
MD5:
71763570e9c96128d93c83e926b7ac4f
SHA1: 4454591d280568648f3d3dc40bc0507b19e8feae SHA256: 462bc240e3f1fd95eefad4fc7ccfc8cdb57f06a54bdba69a68a2e98a7c91a45e SSDeep: 768:PfjleFBqM08xNsq2UdWQfTmktmkOpKBfhBIDqVQ/UtRXuINsA32qnk:P0XqP87sqDvTZ7MKJITUj+Iv3G |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\aRbWVQ1PBmsE9IYNLeTd.jpg | 42.54 KB |
MD5:
4ef4b11e875ff259fbb1fa45d7b98a57
SHA1: 4aeb25c064c3e99e263ec26311539003b3f5b65f SHA256: 0698299594bd19c5fefe022fe200b4a8fb766a0c9af650cfe3ded08237e0ebe7 SSDeep: 768:RwSogZDTxf3C8o2s7pQibwVnuceGQhAB4WUZJR1bKBq6CrGJ5F:aSdFxfSd2mQ3Qjf6yW8JrK/Cid |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\gkJs4OV85o2x.jpg | 46.86 KB |
MD5:
872a473063c73c8f718c6961626978fa
SHA1: 48cefa78bb314aba2709514b3668dc31a5d1abb5 SHA256: ae8c861bef1ac8fca68d47cac2f5b6b185916627b099c2c2c67af1129d56c07b SSDeep: 768:9MwphL9qoYbhodYHxF/sA3RnlzSL0eU7yccn/bEp4KcBaasWT1g8UviCfs+SjbSv:euqoYbhEYjsOoL00rTyYaI+8URdYSWi |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\36x28XoZYsLFWANK5kq.gif | 8.25 KB |
MD5:
9422f14bf3e6a9cbe9c6cd9679b93e6e
SHA1: 4aa442f5e84c79609bdc105d8e6bce9f0f3c9b08 SHA256: 09e95dc924bef342329952e5914fe349d6a9488dc5c003756ee32aab003386eb SSDeep: 192:8VHYsoXz16QMzyL4OVHUmYrbbqVvgR6kKQJad5sZ9Ya/l3+/AnHgtn4:8WdzkQMzyLHNtur6kW+9Jtu/i84 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\3OPw.jpg | 36.88 KB |
MD5:
22369f89810fdb57c2d5a698221fe85f
SHA1: ba151a9d338203f3074746a8e1486d86bf04ae8d SHA256: 87b3cc0869415ca60ade8dffad07900de5a69380c845dac0c6a58dbff6b6f3e1 SSDeep: 768:nmgj6NTSEG3Dfatt/7LzAgi/kiUh2ExFClH69VBPWIVXDl7tlCXU7iS:nm7NTJwDStxQ9siUYEus1WIV55OU7J |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\dvMivKCGj1eWR6n.png | 48.77 KB |
MD5:
8b7e95bb8c7a4302f5ab1550252957e5
SHA1: f15f3c4fdd5555a8ca043f3db611547abbdd9b5f SHA256: 82f643d05b0134c6b5181ba829e8f867bd79e8d80a0c3ffa918725395bd51843 SSDeep: 768:KaJehMOvzT8T+sJ0GmawU7lZY6NvwnhKHzdOMVlIFdTtM+mihlWPnDvcSG0:lehrT8T+sJcaDZYtmxO3aglWPDvd |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\gyETZxq38xJdGPTIu.bmp | 36.80 KB |
MD5:
ea10c3e6ccb06170895d7e5a169e8d25
SHA1: 955a761fc7bbac910b567b167db90339d8134f0c SHA256: f99fc4ad013e2b6ab66eb33d8a998a273b5b67a393deab3111818ca3bb00bd25 SSDeep: 768:bt6eKw4GkqKlrZRvDJh9a1C1twoLe41JCZwA:sel4DHVRbwADGwA |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YtuNE0kSPzu.gif | 28.54 KB |
MD5:
2c8517d9ca32ecd75d2bb04dc1f20237
SHA1: 14d8dfa93f61d78a58aa3011ef61fa222df96932 SHA256: f47cdebef458c990c898685451182f57448b120c981dc892242fa3a6cd51599b SSDeep: 768:vZ++HeZYucXB9ndiVuV7mSiT3/vv+umQYWk12uUg9aA:vZ++HeZYuevdikV7mSiTjxYFtcA |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YW5vf.bmp | 25.09 KB |
MD5:
55a8131f92acdda7438f55f8c60f85b0
SHA1: 06c0a7bef46cf3c5b95c49d5507ce5224a8da579 SHA256: 2f7f9394f4be288b039bfcebac51ab2a71399c8fa01142188b79c4a11598392b SSDeep: 384:injR9v9n92q/LNUVG584Zbb9fVwQYGWuEppmypvhyNrCP+uIhrmVUdl8/gfT6BkE:il92q/D5DJJtuTpIyqBuIEV+OZ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\_a2Pd.bmp | 85.69 KB |
MD5:
a3acf52d5d564e6bf8c47cc8d7be5374
SHA1: 900d316f482cd4ffa1c462f1066c4f12080774d9 SHA256: 6a12331d139b7e4c0bb0a0941febbbcbc8059c04cb56904bef7b21135ba8b108 SSDeep: 1536:w9i0Wc+4/cryWgxHbjd66uwtn7MI35TvO9NyEHxD0QSDIiMAC04ZlTJc97zxf/S:yi0WxwcryWwbU6uwp35DOlYIiOJe9fpq |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\9WmhgBFveH0j.bmp | 94.51 KB |
MD5:
6339fe73f29c7999f8fb7073cfd07364
SHA1: 56b9b21ae9c488464155c3a259ddbb10ab984578 SHA256: 1fc6151f98d18baba5bfba27fc2c60191b5b9b6ee8a0d5eb2c79981373bb6f89 SSDeep: 1536:32QzSGqAq1+hn/cklzAYcUpkSNOurO2FHOWELqPqcz7c3haay:3219A++hn/ddnbKvoO2ZiEz0c |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\e-v2NjwnasaQ6et0ja.png | 34.28 KB |
MD5:
0b706c9cf718c09877568e9ae6e7ffbc
SHA1: ebfce5692a3dee3c5d30eff35a7bac842d940156 SHA256: e495fb2135722642271af4cfe6e03760c9d8c8be55932158aa23aa6f50572f81 SSDeep: 768:zTgGE7Q+6ORyJHDr17Wug64bQvCnvaVcixq3J0xRh0BuY:zP5n9DroH1bQvKv6cCgJ0f+L |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\l5pUiiym.png | 8.95 KB |
MD5:
ee37f93aa8da215ce45fce26558f4908
SHA1: 02ae3aa4a7d7769c99a1b0747216e83dbb3aa306 SHA256: 45fe7d2129445daf3683070cfcc999eae1ad8adffc94c33af1370b570824cfc6 SSDeep: 192:0OC6aApFs7pAYbFPEaAhPGJb42u0bMNYXOSYtQGTYJK+/w0Xsnrc:0OJMBbpGZGd4GbM9SYVTYJK+/w0Xsrc |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\RCWZBzZRK7zkjlX.bmp | 43.78 KB |
MD5:
e8abbad49a24f1bf928096ee12b9e06d
SHA1: 92c505eb1ba827b71f772b5424afed3afac15e60 SHA256: fe438ec01625efb9130bdb0f2a8fc17e16ddd9b6cca143b3ef599cdbf1756f03 SSDeep: 768:vKfqcxJslURNi7y1oJhOdCcbzU8xtNpXFBfdtYzEiOaulIA2ACWVMbJzTPE:vKfqcxJsYdxX5bdunM7ZCBbJzTPE |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\vcSPsVx.png | 17.17 KB |
MD5:
cf0c96635c230fde32162dc4e000f733
SHA1: 4f136d189daf04228d347f4efa6a5c4a896c1563 SHA256: 2ba130d49918d166cddbdf6e2ec34b691e9f6e117e0413b2e8e592de1f55d374 SSDeep: 384:0qbD/ow87N4RQWPUWdQloI8ery0taE1rGtcW697OKddIHHyUQL380ZRk:nN8YQSUkQGI8Ey0kE1itcfZ4jQRk |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\FB6F-yt_lW0.png | 92.04 KB |
MD5:
3a2edc7f17b1141a3ce3215990b06a16
SHA1: 4bdd74f28ecd944cf6a49a9e0f0e8dad638da22c SHA256: 58f4b7cfd8cecfebb8e148c418b5a8b79c8978929658b7f4457c518cbbf75111 SSDeep: 1536:Bmrb1CVrJ5QWuO7JiU41CLoPsmydXa3NK8UD7rWW22d5xpacysOWUScLHQ:BK1CVTQWHiQcPsRwALaWZd5xpacTUSgQ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\SCfWk5F.jpg | 27.53 KB |
MD5:
bc8ecde99cef4a4d61e03e5e65b64f7e
SHA1: 107758f243d86913dcd4b5edbbf659e39b2f69df SHA256: b459c2b5e24a9ef4f870d2738c82f559ad6748729e8333fa38a6b06040107d59 SSDeep: 768:vmLmZ+hsDsoZf3SSRFm7Bbrf6+YyTGpMR4m86wgd:+LmZJsIbR4trf6+8pMR4m8RG |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\zlMPu11Z9j872BhKsufL.gif | 95.14 KB |
MD5:
1066139ddba9dfd3d5ddcf61509b8ff4
SHA1: 90bb1ed71ecbc08ed9ec2e9ef8b6bbcd90a9f5f1 SHA256: c6fd5f025ede4454a1b4e85956643cc41eeef52a89581fe73b3f6ae77b3d3f4a SSDeep: 1536:sdMMa14wjh39Rb9fwgwHIq4ptTkJ1zGLRpsRm6AfHoDYAuR9XKA1zAysX56tlghH:sdMx6OxsHIq4PpVp2mRofuRd1syDtaVv |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\2qTC0a5scT73Y.png | 78.93 KB |
MD5:
0495a7582165fb83d6b2ca8c0bff725a
SHA1: 0d7043baf025fba1779a4202dd86d05e51b02f4e SHA256: 27d6d2c424344886366f8ead79f436cfc69444d0f6e7193707dcb84cd163c690 SSDeep: 1536:+2ur2biVSUrMoPXX2+r7cQU8iSzNkuzy8m4c3ayCoejoE1zn48SIjpUBg3J+adfG:+2a2mVSUrDPXG+kQLku7m4U9MTSIjiS4 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\F3WWwsmu0xGK1DZvtX.bmp | 72.97 KB |
MD5:
6a0249da992e6e228eb9145bb1fa3d32
SHA1: b267654b60f8007bbdd1a146ef0325b664cd8775 SHA256: 9c073d0f122596d110bf03f7443db2c44d2ef2ad7eb0b0f3114c07ca4c7241cd SSDeep: 1536:6tTHyzkwvthDBQK8QPnyfhDj5R1i5UBaGJNoaXAr4eW:6tEkwvt7QVQvyJDDaUBNNoce4eW |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\2WhK0Jp9M.mp3 | 7.33 KB |
MD5:
4bd529454bb943ce0236e67293ec68f2
SHA1: 9abbce2794f3aca93bc38ef1fe6d774fab570a8e SHA256: dbb455e58348831b0acfa133307ae885d96981a6c63e3f5f8238c1e1ae29e0f1 SSDeep: 192:xKRHo5JAzfPdBBEcbplfHHpGgtIfBSDfnB:x6o0xBBxbHpLtIJSDfB |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\bF-Gyp.wav | 58.66 KB |
MD5:
ee81d57624b2820ecd1d0314be3b37e9
SHA1: e30c7609f340cb38db95d89e1da2b353e7d13c93 SHA256: 386c16d133279250c82e29f3b209ee9c0357ded50155a02082e548e7cb8ae12a SSDeep: 1536:K754Qhl57vL30v0hri+eCoM+nQm4qelHkcMrC5YHL4:K754+57vL30IG+PoM+Qm4zcrC5iE |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\BFLFCvjmAT.wav | 89.52 KB |
MD5:
4984a2c565522815e8a8b7c45c9b02b5
SHA1: 847ed7eca0d29a191660d83d0ea34df1cba8c6b0 SHA256: 8a2863c4595344dd64219bc2ab5073d2abed69d171655996b968e43021e9a83c SSDeep: 1536:tOVfnG0KcRExT5w74ok05oOCn+E6vGjPw3OzkwDo9dOTTq6iTX0+6NPs3mL40VK0:tON7Kcky1CneOjPgOxDqOXq6ib0+6NPZ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\BSkWNi7 iI.m4a | 33.27 KB |
MD5:
d64b3c0373974f4bd4a9e3e0bfaa55df
SHA1: d49eed3e4519a4efef435af504ec138e32bf80e3 SHA256: e5d054f969bb2cd92ad7dd6ef10c2ccded83aa63a61b4cad8b3090ad29d64a12 SSDeep: 768:/ODRooxtuV/GSSw7stWK4xOGW2wmXOHHa5yFFLkpe:oRd0x4WLPwmeHHa5I5p |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini | 1.42 KB |
MD5:
a75d6c9f3799f5d77755208194e9a1e4
SHA1: b41c76f8d231a4f31e6d27aaa58cc301e9c31411 SHA256: 63f48605105c05e7b0ec6c0bcafaccd08352b599ec11afc29003c5fe60232747 SSDeep: 24:VWnhg17zDMe09/WludjKNtG0SAJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdg2k:Gihv0VWludgtG0SWfi4eshyIK+HMBk3U |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\F_2s6FlTtFUdW9.mp3 | 75.72 KB |
MD5:
293789b53a209b77e7819d5f0ddccb37
SHA1: 83d7a354792a2319f3344f92572e294ec67423ae SHA256: 5139ebf11571ebc89c76517266e20b62965ff6275c5e20af01af88b948641360 SSDeep: 1536:H1Zoz8AKk+mQ43CdTzqwRZYuabybwThQ7yfuMUUSgDgVO9vKJyK2gbe6:PtAK9f9bwTY/MRb9AyXgq6 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\g1P_VcvnB.wav | 100.11 KB |
MD5:
f3ccc03941d862716c01a73437e3bd20
SHA1: fa98c18456aadcc7d44ad7e2ab60801bc51f4598 SHA256: e8a9fb99aa925b32df58bdfcd06bae6bda98eefa493a172de5fdaa24261691ae SSDeep: 3072:TvKI3iWCsuHcomS6H2QjpNYwJ4bjLQLOq:TZ3iWFu8ot6HlPr4f0L/ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\J56Jpm_V0AAsmT.wav | 6.45 KB |
MD5:
3de203634cf4fe619a28809e6ff37af5
SHA1: 2de2bae72ebfa76e0f3e1a7d542d0448675425fd SHA256: f9380b16c8b9a08d6da1f55c656050af7b2e31aa6f6c6f2282bd4c37aaa19fd5 SSDeep: 96:pQxFX3eJJsJndh216e/DsOhJuZBpqrypJTJKSY4FSgmnyL4jsjcx2PELHMnczTV:pMFg2ZT2Z56vqepJNKSubyLysjS2P3nq |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\JD-tsrvF2.m4a | 34.94 KB |
MD5:
102875d4445d1969c20c07cb614797ef
SHA1: 67cb77ccb1a4ee839abab733270a6c455b7e3b03 SHA256: 3d1cc79389754700569c9a9a4561a7df00ee442226286ec35a4e4a9a29bbdc57 SSDeep: 768:plh2YJlx1RVtakeOSfQhSHBbxb9BKnxNdEvnVdDs9tvDdRHVW4e3:B2YppdzgHj9kxYVcvDz84K |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\KfS6I9.mp3 | 44.79 KB |
MD5:
635a0fc2dd56bc3b15f3f2ec8dad4e5a
SHA1: 6794cffbd6b3c406ee3f65161b2bceab81dd76d0 SHA256: e7674129fae11cbd75381ccd298f0834fa8a9b9e109538faf4e004a4d3bdcc6e SSDeep: 768:dgoGWhyYOklTXFbQ5jUS/Tz2ms9dBJ1UJAbiZbNeqr3XYTJn+RlP:dgoNo01E5jT3uBJ1Fbw1Yd+HP |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\oVcBcPe8aoMcbmJ6L.wav | 12.84 KB |
MD5:
2d71fbb86c0d037b6302cf8b9a427b72
SHA1: 7f2afbd87ce9e30b73ad0cb8aefa57df83f8b840 SHA256: 2ce58bcd6d8fa39a0c53d62c00f0eecf89750152bb92ca826028fa34260f9f5a SSDeep: 384:3+cCezPoTLLxTFKpe17u9Lp/7pujrniDi2kRyTvKRI+RbdyH6JT:34yULL9oRBB7UCDi2kkWRIqdlR |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\QiM jAC.mp3 | 80.90 KB |
MD5:
c24fc054df14d52fd2c201f28455f42d
SHA1: 1dad834793954f364091d325beb0c227e7cc4deb SHA256: 3d56759204d15330a14d21f1cc6668bf8ea06a1de7c721b31b84cdb86d95b72a SSDeep: 1536:++n0GAZuOnJRXrzr0VVbGnrlAO7CJETVdlRc9g7WPFH7orBr19qG:++n/AlJRbUVVsh9sETVdlq9g7WtbqFmG |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\qPi-26_R5Y.mp3 | 64.89 KB |
MD5:
56a1d54320609ea3e2bf9fb5b797fed3
SHA1: 72363a6fd060ca042ed4ac1100cd95e78224f3ba SHA256: 5f17d1b9c1cb89fb2871acb084d95336746dfab60fcd0affa216f4d5e07c312f SSDeep: 1536:+Las0Tt7+mz8+dk06oYc8M/XihE8JH2SOyoqlKIx5G8IBa:I0J6oYc8uyhE8JH2SOyLKK4fa |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\t92T rcs.mp3 | 41.87 KB |
MD5:
4eb6c8d454fd314ea53eb40f05221939
SHA1: 58e74e8fcf797c9c297cf5ffbfe7ca16b1dee8c9 SHA256: 3a196ad1b56f750ac8c80ceaa4f1430c6d010392904fb678c3059a72f8f4ebe0 SSDeep: 768:lwcHXdScnJyxr6c4hkMixw13jBVW9z93WMPA8FwELAHEFBKAjMb1cOyr:WiNScnJyxWhh0K13jyJPHFwEE3bW1 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\UYjfw0CDsB AodTHHd.m4a | 95.75 KB |
MD5:
9fbddea6bb79e384ffbaa97ddac61050
SHA1: cef367f41c36a7df60d6094884338adcf5fdadc1 SHA256: d08a58074e67c02b616fb8e365279736a2350084c0cdddf9f342f372e707c30a SSDeep: 1536:n8QieTNnMA6Lg/dR4kRXGVuQIk3LoigqMyhiVFTuhA6W3dQMy4kQxIfLXfyePmfr:8JeTNMAIwdRJu8k3L47WA6WNQMyjWsL0 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\WP4KrGPfe.wav | 38.81 KB |
MD5:
564ec76d7e83299b6defca72a6c2f8b9
SHA1: ded409883af2c919e02f91984b2b6d7c8960dff2 SHA256: 365e30324ef0d3378159b1168ed7de920b37e1c174564c8bde74631cdd885a6e SSDeep: 768:z8LSlMb3yO9GMeXdsznH61FJJHXKbHMbP8JbA1N2nqBdXYyzGv:z8elvMIszH6D/XKYbWbA1FYR |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\x hNiw1Ois TfWIABIB.mp3 | 58.92 KB |
MD5:
f5afc0355043345ac2a9884e2f89b1f0
SHA1: fb7ccc050ba61ff797e4868c3941b08b14d3ae32 SHA256: a787593893ca7d01273e2635078d289c303062885bafdb0762283347f3b16c2b SSDeep: 1536:rTjRfh0hNqrLi0ZTTnfOUFHq5PBWtnYUoZSkrXk:rTghNqrHZnWU05PBWpoPzk |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\xqfbr92zFKybE.m4a | 62.06 KB |
MD5:
0be0015c0b268118c863712119be6ed5
SHA1: 5006ac45fc5d28ebccd5dad039c8ba8b26e04fa0 SHA256: 53ab47416210bfff211a9575dd966bf5b5ee666cfa5df512b67cb81d5f635031 SSDeep: 1536:WBj9HPWJu1CZpV9wR+PU61xMCyi0Z/iU1Id9TV:mJep8+c61/0J5I |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\4_U9Ib4M.m4a | 41.70 KB |
MD5:
6f0dcf6b3a48e1986f8d5508a359b3a9
SHA1: ccce9d08b46dc8d45daf04f2dc01b0daeb2f8053 SHA256: 806ae9b49a72b8d356f1077e41e42587a5d34da484701903a56b8f82a9653d2f SSDeep: 768:i1X+Yr6gXEEBq7NerRLMZPrS/ZsxlV9bJ7F85WRQPcIWxZfQHKbbDiR:iprRXEEIIVL7/mf8YRcTUZfcGbeR |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\8uTN.m4a | 54.19 KB |
MD5:
f2110e56f7df06b75c3990f2583610cb
SHA1: d0c1184fca16814c403a68292583cb6c88bb5e47 SHA256: bb38a24bb9b018a6e9f1336f4cdcebd5499d15aa5c5e764807660246b6f2ddaf SSDeep: 1536:X8Et60yBjfWmBVCwce860jPifY5XOmCmihzfypR:XqfnB9860GwRJ8qpR |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\B7VBhHSAUzHh2b.wav | 4.22 KB |
MD5:
319062e2851d45b486eacadeffb0d841
SHA1: 8b12d11fda1fce9cfbd0d453200bfce3d1851f70 SHA256: 0120025eb0f9ecbbc5b055d32fd72303ab45662bb4a6ba624f99cb80cb0396a7 SSDeep: 96:kkf14kszhU9VGT2xSz8S4ioczDPKa0VQVFLHMnczK:jvUqxSOTczDijBnd |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\dQRxy-7flS.mp3 | 46.21 KB |
MD5:
a63feb0398fc7a3ad321b681986f57cc
SHA1: 7d861c190cf5256f7bf7735e68bf83293ba18b69 SHA256: f1fce83b320ac5a878ee201cc94ed02385240c50e4888d84928dd9a04b04c7cf SSDeep: 768:S303sSvYuK6vahBQKDWejuzd9ir3aQas+A5sHKXZm7mlQUGN1UMbDQ6kPUyEKBU:WhBRWeqzilas+0mKXU7CQn2qDQflEKe |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\fsulKw.mp3 | 97.95 KB |
MD5:
1ce29957eef09004812b24b0798e2b0b
SHA1: 25029982bf2681e381c9b013e6a48794a2e995d4 SHA256: c1ebac19489a9d85bbf2d40a6130a67688429bf1757c29fbbc3b634813cc3e30 SSDeep: 1536:M7pWhFfVGUHpwsZ48EMyu/4YaVHThPL+hruUDEyODnCK6jXbH9MoNL2KuFu:/hF93JSnMtTSHZbUD1DLqoNLZ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\gcAd.mp3 | 26.78 KB |
MD5:
7c004bfb0f0d5cffc79233ff1a9c2891
SHA1: de5c789d628bb6f932ab181b7c0fc0396638d6e1 SHA256: af863e31117b74985d0be136ea92637d24edb42a9fb5a2431417ceef66a1848b SSDeep: 768:LCmtTlMayVsKkwYGRiKeNQcAKXQXL3CPdtpf7QLkT1vESPzliOlkwXKD:LCmtTlTyKjGs5QcA3XLy3pf7QyxES5sD |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\JN4A4o3Q9kS.m4a | 58.21 KB |
MD5:
3fff18736606f47feab4e60a7acd2bf0
SHA1: 33535cd50237046ae03a73f229fa158a4df63d43 SHA256: 0099191ed9812232bfa651044a61f0d4e66701588afcccfe074052f78dc774da SSDeep: 1536:+9BKjaAzbSngi1I89CCtMAmjcc1yDM/eGx7tR8R3:+9wja8bSnLq89CCtMbsOeQ8R3 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\kZ_ci1.m4a | 80.20 KB |
MD5:
47aaafa7303d2ab220a895250e929d2c
SHA1: 4c5203417d6579b67825460318c5c709c68adaf7 SHA256: d23c0ed39546ccad98c5fa177ce9f01821e4069ba7481cd2b89c48b2ca7cb3f5 SSDeep: 1536:TWUFMATPn1qwlNKPiLpcexD0XcUTec1WQDFKC/jPI0WIILs:SkMOn1qwSieCRUT71omLzT |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Links\desktop.ini | 1.50 KB |
MD5:
1163a9cf10bafed5e8c759710110aef6
SHA1: d916f853edbb8d344324bc611340cf6589ece479 SHA256: d9de9aebf0457f317cbefaee198c2ac0d781e957c582bef8ae3ce4f9176ae7e8 SSDeep: 24:YWCYqy1K6XCb23VWEvMT8rjJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdig:EY/KnbGVXvg6dfi4eshyIK+HMBk3K6tP |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Links\Desktop.lnk | 1.41 KB |
MD5:
dd3abcf96eef1fb42780b61df1eda345
SHA1: 678a6496afa84560982bef4cbe452f88e03cf0c2 SHA256: b19acfbeb87523a65d7a84021db54efaaf23ea622039f49637217f63241d3b57 SSDeep: 24:4nHoIM4JWQlK2ZvvNyXzvgok8z2B3nc2jlJM+i4cJtmLxONmyIK+HZhoBkrLKRI2:moIVJWQlHvvOW8zDubfi4eshyIK+HMBd |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Links\Downloads.lnk | 1.84 KB |
MD5:
d86374e8853e482444ad48b33a257dfe
SHA1: aebd4b221bba740b34721587a9905f9037355e6e SHA256: 824bf30b41cbc32193ec80fcc70e0a0d1a3ec5c1c82fa4a101bd83717645371d SSDeep: 48:+8aROywlJ7LojdQoZhSPgF0fi4eshyIK+HMBk3K6tzJfSk:+89NltLo5ZMLHMnczh |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Links\RecentPlaces.lnk | 1.28 KB |
MD5:
de262ebfa93c1d47d3397609ce1c8d95
SHA1: cd5e1a6050a5c5f9ee78971219168fa5367b83f1 SHA256: 8d4d83eba3b74a13e682f8d108a0f97145886563083470351f426708ec005a55 SSDeep: 24:khZr75G25K1trwC9n2As3JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdOI:WVf5strP12ffi4eshyIK+HMBk3K6tzJF |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini | 1.33 KB |
MD5:
9ff48e482be9c600540fbdf12ef0c74f
SHA1: 3a47cfd321344e71a555d5b462551ce62196c743 SHA256: bc00396edd64f07c3582e01270b95bf99a903b846429eff0e9a75bcaa641a43f SSDeep: 24:TyhvIvYuoYsyBIO+7Q0lUWiep+JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdKX:TdzoYsyBdsQ0lUWJpgfi4eshyIK+HMB9 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url | 1.06 KB |
MD5:
0dcb55df1f6e1f873b07a4f1a11683e4
SHA1: 82a36fd3ab98595d8aa9943558073cbb627cbd90 SHA256: be5207caa64d23a51af2488f8e3e286b4b2d724d4c69036b46d01c5f30eb9a38 SSDeep: 24:vLNMUESuMuUoAJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfduQv:DNJuMuFWfi4eshyIK+HMBk3K6tzJfgm |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url | 1.06 KB |
MD5:
19f573fdbce5259106ba945ba72261f6
SHA1: 595b43be1c42a565927f935286934d1a581469ad SHA256: a20b2d0bbcc08635f4b500d0e6b088220fd65b8da883adafd1048d542b5cdbf9 SSDeep: 24:+egqys9HR8sJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdw:+eS0RRfi4eshyIK+HMBk3K6tzJfa |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url | 1.06 KB |
MD5:
06fe571b14b3ba1d5b9cd732fc0e9cd3
SHA1: 6f16801a15712177e94dc20f2ae2422e99d4df5c SHA256: 05de6ae2e523727b143ef2f81d4aff58efc310f24b191e5644337c9d56de139e SSDeep: 24:LTi8ChZXpqpEg2wO2JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdd/M0:LTH8Uqw1fi4eshyIK+HMBk3K6tzJfXM0 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url | 1.06 KB |
MD5:
4f5e31f098ee7775c2f7de99712cad0a
SHA1: 0dcc6525735081f597728f084fc68f9e9842c6f3 SHA256: 468a3470b8c3c37cc1b9a9d6f32f02ad22ff0abf08290e142b86991dee7c3118 SSDeep: 24:5Kkmiz1aeb30AJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd3K:5lmiZdhfi4eshyIK+HMBk3K6tzJf4 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url | 1.06 KB |
MD5:
ee270769edc1f66573601e6a8194911f
SHA1: 9e6083b06b35ba8024add86b062b2ac0290a685c SHA256: d567259c7d6fd046309e990baefb88ae9818720d1cbe2243a83865fbfdb4c860 SSDeep: 24:x9KIY12DyPcJmpSpJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdwM:jKIY1LOmSfi4eshyIK+HMBk3K6tzJfz |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url | 1.06 KB |
MD5:
a8177e89ae4214cc96215be5d56a4408
SHA1: 4b66e5a536a1013fb2241772cff2768d6d920d5e SHA256: dd7cef8c30f45441077e4da1a99cf9e6982d14d504d9dc3f92f61c6fea7a14e0 SSDeep: 24:5CRKBAUEwEJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdn/lsp:pEwifi4eshyIK+HMBk3K6tzJfR/lC |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url | 1.06 KB |
MD5:
df49d8774b7b2518614955feb78910fb
SHA1: c3c50b8425a3b823fdf55b733543f44ccc5b9c85 SHA256: 4f1a3a3e6a90a2e71ee10c3bed24b2c32767db70c2927cb4a7f951b251942d23 SSDeep: 24:uJ2nacuOnUQ1/PYnA/JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdN20f1:uJoacusUQ1onARfi4eshyIK+HMBk3K6T |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url | 1.06 KB |
MD5:
b9d9cf8bcb0879251d63d1d8b71d5d54
SHA1: c6631d4eb693a1c0ef0602de5d225baaefdb5572 SHA256: a15d4f8629a3de6a28c6678d6a63677a6876a1b02f2871043406c238295a1914 SSDeep: 24:9kR8W1GoJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdX:GRpfi4eshyIK+HMBk3K6tzJfJ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url | 1.06 KB |
MD5:
4c1e0dd50b8296305811991d4170f42c
SHA1: 3256805ad6d944cfe6df699b9f0772010e467320 SHA256: fafaa5a999eac8dab2803c70c4f336aa873a1cc7bb1834365316534f296ffd9f SSDeep: 24:R1PztU2ozOzRzppJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdQPb1:R1PahgRzBfi4eshyIK+HMBk3K6tzJfEJ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url | 1.06 KB |
MD5:
76a8dbd1f251fe88364db45d40c1db28
SHA1: 4b75bad016b776c6fb5d84df5a4394d85a68ad2e SHA256: be9e9c6a95a929f2c2d2c5ad998175da30d441ec5cb4968e4233e5790e54d67a SSDeep: 24:pWZpFtfKqJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdzN1S:gWUfi4eshyIK+HMBk3K6tzJfE |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url | 1.06 KB |
MD5:
e16c64b64b6d2487f5ee02fa69d82be5
SHA1: 616f027faf70ce4f0913ae2e0068846f1e14e4df SHA256: 24158312b1f080ba6abdd143ab789ada2bd80cfddf27bb0c5c86018967ab3edb SSDeep: 24:Noh6SLKPJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdnDQ:N1uKBfi4eshyIK+HMBk3K6tzJfNDQ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url | 1.06 KB |
MD5:
e192fef6fd21a5411fd8f01a29ec0e21
SHA1: b2db90fd5c50c3414335b798b2b2fc6ca3d46790 SHA256: c6923e4627fb086ac20bd2130a6f2278664bfe5141abae3d53044ffbe948af2f SSDeep: 24:4DJz/2xFsa3zmQKJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd9oY:4h/2Ps77fi4eshyIK+HMBk3K6tzJfD7 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url | 1.06 KB |
MD5:
875555bf9a73393c42aa67fa45886336
SHA1: 7811afa065e2ae6ac8ecbb45825b21e708264350 SHA256: 95a76347f2e790e3d88e0515aa9d7a9be9ceffdfb248c39a83e9a7e4150a0e70 SSDeep: 24:I+FitjLR4KeOJ/JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdR:BYjOKRfi4eshyIK+HMBk3K6tzJfj |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url | 1.06 KB |
MD5:
7045c1806540d6a9a92255efc036507a
SHA1: 05def72f0d527f296ab440fe25293845863ce139 SHA256: beab072963266cc22e8040deedc9676c3636c3948af2743f25024e0ab4f188c2 SSDeep: 24:Y0Bbjwc5/6OwJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdl0:RBb7/6Omfi4eshyIK+HMBk3K6tzJfA |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url | 1.06 KB |
MD5:
2c32dc1ba9dd1cd89ccb0d1e05bbc4bd
SHA1: 96227cb42d2e90d0616bb9f351ccc319aac6c8d4 SHA256: 4f919d901528954bd3ed05f890120a33f7096106693bb1b9f0554a10c0f2680a SSDeep: 24:KmNuK9fU82pJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdejD:puK9czfi4eshyIK+HMBk3K6tzJfi |
|
|
Modified Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\2JSO83ouDCpS9bPG7Ae.swf | 24.75 KB |
MD5:
2573f50c2e434e9f72cbbdfdcc75dc0a
SHA1: e45c8e2bc3bef95737824177e3cdc27892faf4c8 SHA256: bf0a2c74981bdb5548bd4b9c0e7ef373e5e439f6354d4c247c46db295ae94c23 SSDeep: 768:+z4ijox1uK6F4vzMsMg+CByhzi2XyLUQLR8mjMdB/:uzo7uK6yvfrUziXj6mw/ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bKiC9mt1u.mp4 | 31.67 KB |
MD5:
7b4699265ed52d45b11c77cbc2195027
SHA1: 0081a9a1ec60c1fdeda6821114f8370c461207e1 SHA256: af93a6b4dbbdeba60ea94084e18628d6737fd3e3602ab4c991445f91532aff29 SSDeep: 384:CmAhqTU0xcfe74uYfI41hhp2GQhv8zxC40ZpDm0SryO5eticV9b+K/CWlT7Hj/Ul:BAURtzYgc2pluxCFTiQ99NqWlY |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini | 1.44 KB |
MD5:
073e0ba2ed638a557e79172d62606569
SHA1: bfe023c51de873d319980b83b01cbb6cf32e6694 SHA256: 5a46009d91de1ee4203851c89b896080b2001cecdc8a072e6a884b05c577a151 SSDeep: 24:IuXV8Ppgm31gtC2ivRnvKEnOsv8vugYqNrJM+i4cJtmLxONmyIK+HZhoBkrLKRI9:dl8PpnFSxiJniisQqzfi4eshyIK+HMB6 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\PMIlhquoGP0fFB.bmp | 82.31 KB |
MD5:
28aa52ce469db12fcc07310977ce35ad
SHA1: 2064f0aa376cf63edf768a7a4bd95f45a58b9dd1 SHA256: c305f288c07aecb2c157d56cd496fe9a42edec2eea0c8cb6a983abde3b1dff01 SSDeep: 1536:HKKLDmK7MsrtaiW3nw53ippja26lkOOyoyumL654wgFr1YpSEY899HavlEl5K:qK/7Ms5aiW3ne3gO2BBZyf25jgFRzEYd |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\tUKrVvos3DRk_t_A.gif | 32.12 KB |
MD5:
f0900ebf4a516b6827ede767b3f52862
SHA1: 777a4e751a9c161d0935544ffeebafa13081a00a SHA256: d9152b5bdcba553d00408931644d48981b4ac08cb58b06fd5e4b92e24d1ce160 SSDeep: 768:sGKYTpVCFIc/QkvTnsZ9YWmQ7xc5iccX7CX:IWV/SQGLsDmic5itU |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\AkpFL-oB-3Fu6pJr1qI.bmp | 28.98 KB |
MD5:
5634656302ed867f931fe7af575f3b19
SHA1: c6a4f7bf1a267a73ff9a16195287fd3cc1d1d454 SHA256: 8173d7652cdffde849f2d97572b28e2eca1f3ecc5ba223ae2db71ddcbc88a629 SSDeep: 768:WjuWra2lJs0bXISi6inWp4lAuQQQtBjEfmZvHCnPbSE9iW:WyWra2lJbXISHwlAuQQE+ikzr |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\O2aPlZsulS.wav | 12.90 KB |
MD5:
0ccfb9c443626a087d3e26a8480b6073
SHA1: 493f4225b6c13eb5e2a3ae710102a5ceb9da8651 SHA256: aaa72287dfdd1b08ba998a0ba9f6e48a06fba38f9952e79efbc79b14736b8d00 SSDeep: 384:DgLDhG6vfgliXttXy9AO7IeyuC8+Moc8SX76a:D0dsQDfbeyvrna |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\Z-yKq14SjTyCv.mp3 | 81.05 KB |
MD5:
fa6f8c47a4f5d96155bb5d9bc4f5fe93
SHA1: 60fc304c68217dcf76f91e8b098a9da1e5283c7e SHA256: bc68caa8347fa03ed6c2bb039f10f3e003b78e948d74988640afcbbde9f2695e SSDeep: 1536:dRTcckZ0U/ciGsBo9KC1MLIzFzzdbO9ZEaJJsNgz4wtM39L8WXJP7a6vun:4/R8sS9t1XbO9h78wtoakJPWp |
|
|
| C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp.[new_wave@tuta.io].LotR | 246.92 KB |
MD5:
4ea75a6d0bb024bbd89b613d21abd79d
SHA1: 2cb38040d02616c34bdc32f204ed5fa018ca1cbf SHA256: cd2ebdd280bc1aac7aceef89821362150935e6494f1d67328ecf3dec82f3a4bd SSDeep: 6144:9ECxTWed175xG92aGKvZ6TxpVEltCFWTcHPL59/2Edo:9EClpd1XaGKEkNB |
|
|
| C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp.[new_wave@tuta.io].LotR | 16.89 MB |
MD5:
a945998891195d97c2136a5901db4840
SHA1: df510154cf246e218ce493e821a5a57073264d79 SHA256: 737707878f73ab58370a672aa9e3ce3bb3f0650c3cb5aa509d3d902afa5f5604 SSDeep: 196608:N/4Vr35od9vDXadSLsS8nQsiAESOsYnwZrja9segf:JO35+9vsItAqpnevIu |
|
|
| C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp.[new_wave@tuta.io].LotR | 16.61 MB |
MD5:
5deba3a52ad17d4d0268ff951cc77085
SHA1: 99c3fc8cd878b170244bb2fbbe91b284b1f4cddd SHA256: fece18fa2f8aeb6190e5b6a6baf9f29eeaf69b125ced36af664e765047fa9070 SSDeep: 196608:YVRoamQ5g+Qo4iT6YqQitS7+KgxUzGVw9vV+Ud5CP46ZjNK:4v9MxdBISxUzGVw7+YMggK |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.ini | 976 bytes |
MD5:
c4f00591c5de364cb9a7c359df2b69b5
SHA1: 961c7f80ad426843c5b7acc6b5dfb45a19b3b027 SHA256: 3fd0298c1d37e3aba5bf24f6c9c055babc34ae648c3a5411df7f0308badeab53 SSDeep: 24:Q+oVto/+wJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdNkdI:ktopfi4eshyIK+HMBk3K6tzJf9 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-nUCOEGRczOsCz1Bo X.mkv | 4.88 KB |
MD5:
e20189e8d50fc088345284d08a1a74c9
SHA1: 840b99d981602ae65e57e9d45b2eb8892f9dffd3 SHA256: 16280da14106c51ba512f56ed2c7fba3400ef10e2d3a9ebadd63b8a5bea5f407 SSDeep: 96:c5x6J1hqUjMOkL77VGf3rZltL5RIfi73/u132drueyllloLHMnczA:cr8qUjRkXhO77tL5RIfGV1Ahn7 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\50go8cizDba.swf | 46.06 KB |
MD5:
582979e44579789350ddffba7b12bde7
SHA1: 11d2e1b0d7d08732fc4cbda496a74f2cfede029c SHA256: a85a57e07a3ee78a988994fd73e25380854797af2b6f2f578e02329b1463d9ce SSDeep: 768:SsR1SXv96zkFXbGJmDxzJchL3/RXBpJNBVw+fhgsd1YsgJY+bMao0CKkeCF:SgSfVpxVcxpJNzvf1YUp00eE |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\66W7GLZlR67bh47tKngc.mkv | 24.91 KB |
MD5:
38b2f2f82cc794df5597be92e4377927
SHA1: 33fdb88cdf310b87e872ed582d94dde5187bd38c SHA256: 19dd75771ce749f716e88a752558c745224c2579f2a0269aa2ea55f27dc1c6f5 SSDeep: 768:bSp5sKsbpqjXGeFdi9aaW8K0S7RlE94VY:0sKsbpqj2ea9oBRmCY |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\7VBXl.flv | 6.23 KB |
MD5:
50dfd6e386c1d5b6522123cc7d4238c7
SHA1: c57f0325543afba38d8af072b52f8a3efb4e5c02 SHA256: 5af42d16b09eff7231095eb2fc1395ed50d933680e37cadd0916b5ac5088fbbe SSDeep: 96:EQpYP1r3jnv2d2+9hFZ3uFx42dRPklCfaSM5g9iti5DQGDL3KGULHMnczhL:9Gzjedt9hFJQfklOaSMb85DN3K8n+ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aE9jV.flv | 100.73 KB |
MD5:
8491e3a6b2c132b7f8ae3840a98ed3c8
SHA1: 3e7e850ffa8e23e65f576958cfe7909d46d96625 SHA256: 167d21b9fb4b4f9f8fd0ca05af1230c774391f1e6cab0e9a5f1de07fcb304c33 SSDeep: 3072:Czy795CnpwanrrhycB6+epKJyDi4l3gw9s/:gnndrNBApJV31s/ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aNUUlrT.flv | 100.34 KB |
MD5:
fcdcb5822536f1b30a458fdc6d7abfbe
SHA1: f0acfce910021c37b21a8bc260c12320fe7715ba SHA256: 5dabfee24a0de4346e884c65cff6c6de9fadec7beea667b3ed82f6f37fa7d949 SSDeep: 3072:sFwa3/EL0apKeRao97ZJI5wKREsG3oPlF2sUxFf8s4dX:sCa3/YD0eRxFZCD3GQbFoFfR4dX |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bCh a1QCSk8UxYc9ccf.mp4 | 11.08 KB |
MD5:
c42c0d521360c945f04c13aa7257b170
SHA1: 4cd21fd0b533e5649890446e7a694fe2a224ab39 SHA256: ba0cf947a83b016d841e0626fa7231b93778623dfb0e38833de896fcab096483 SSDeep: 192:wJArsWhq0o3koZ9Fo/JaIHZs78pTwdtveMc5Wfx59iklRCRXQnC5A/GsXi8nW:ul0+koTFo/JFHZseitvXc58xLDjCNYC1 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cjtMDRiyTAFaUZKrh1q3.avi | 53.44 KB |
MD5:
4b97e70f8024613533821e54b846bf0b
SHA1: fc9f5289e756b2599be69a117070dbe15fd39fa4 SHA256: e31f30aa433471a6260fb3df3e1600a787efba73d0adf2d710be67e23024de21 SSDeep: 768:5vF5ToF9j0CRX/O/SwGeWYCIP/if5kkcRESMPAKoU5WONYc2ksYTx3i3aHlbPP+3:hiasJwGq5Hi9cREJAP0WAokx3i3mALRl |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D a9i.flv | 48.04 KB |
MD5:
2fa7c6b804ec8d2338b848a3774fa334
SHA1: 5b04f0ff9b60c7a7a32dbd07c96b26af7f7c94e8 SHA256: 9467845a4e1e8a144659d6fe5a66f32299f34e7737c558ba70df318c4c297a80 SSDeep: 1536:3P0ZE8A3qX9AyF5gWbePg0gazQRK388Ox9jz2rZwhU:8KFqNAQbePvsN1jzsZwhU |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini | 1.42 KB |
MD5:
435b3a13dd994d90d8924dda95cf94ab
SHA1: a5ad15a7d12c81320ecd524f860b8b8c6ef51ec5 SHA256: 820b83007c6847690193be99e022cf093edae29e830a163945df2c6020df2ed2 SSDeep: 24:1CRq+DjVmxIgZB5sZo5zQuL5Wa+KJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfda:1CRqeVm2iTsZSzQu1r+0fi4eshyIK+H2 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\euiHA5JNEZO0QAE38V.swf | 61.75 KB |
MD5:
fafdab8f764557ab769950c11c435e19
SHA1: 41eccd898518d4620be38c32afe811fc6e537d1e SHA256: dfbe34e697ca3acfb5d6b8c3587b886123f72a2b2f9015a2fa482e01320c24b1 SSDeep: 1536:gWLssumesINqW8RW6K/Jtz4cxzac22sDDJOoba:3f8sINqW8Ri/Pz4cpXMla |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\FvB8YVtqFect_Vs.avi | 83.09 KB |
MD5:
78a4bae81d7621585baa5bd7cc2a4ca5
SHA1: 0fca1e4894f8c5c6c09cdb94fdcba606f4f0adbf SHA256: 61aa69c7dfa7c04373e55f253faf246f670b8e09f9ad0f26c9f02333300973ce SSDeep: 1536:gykDz2hldelCCXkILun6pxtikG2q3zPCnjYxLhtATvDPEu55rT9/h4:NY57kILZ092qDPCjSKTbTzk |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\fW_z.flv | 93.57 KB |
MD5:
a26a21766bcfdd371756fec007031d7e
SHA1: b409d40f9a1fd6948a65e4a92ba9ae673cc540f5 SHA256: 55a67974878f009d0c334c97bb9317a6faff19049b575eda8731364690b8aa5d SSDeep: 1536:d1HdbIRMSX+3LAu8/kjaruOyzjLmndOsxRIsdg9WJIjls1F5e118GLF080R0CHBd:7pIB+3LAjSarLyPKnddW8g9CIjl8+AAG |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gLR9Tkk6Ry-em-K.mkv | 17.89 KB |
MD5:
d3969d27fe992c5b75d700b35cd8e89c
SHA1: 02609a125628ace14d818b5eb5a8a549abea0217 SHA256: 6802319a83f9eb8d480b954175828326e29115211d06e8252077ef7144e78f88 SSDeep: 384:qUAiDD+bEQ5zf0JzFIcRKMOHo6UoZWJfFONOOGWTuezkIA:qC0EYf0JzFI7Hs9ONO66eQ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gsMoEjHN.flv | 41.56 KB |
MD5:
cb2e85e1f8fa1da8fad97f7ad1f50fc1
SHA1: 3a931b9237796b1ad2f6250fec209a7a91d48e12 SHA256: 3426dc39fa3bebc3d2818395e9f5185064188a21a6d3ee90af6841aedcc6df58 SSDeep: 768:FsjNZkGHyTLUamNfYQLL+oKY/lVkkTW+o/EHT6OBC8Ckehx3drALiA64SNtv:CpZkGHykamdzfYY8kI8HT6OBckMxNhAc |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hbHSG0BJ.flv | 35.11 KB |
MD5:
fbe2ec7f951bb37e2c3b8d85e4dd3e31
SHA1: 4e48e125fc10fbd7b560fac1ffcc70d44ded4f0d SHA256: 10498f80f383cff3931728e25079530e3d0d7e9ad99d4ac89957ec4ded1a6a08 SSDeep: 768:0nlbwAl8Qz476LWTvb0teTTwV6LDc8GBOGlWovSnRFBq9PVdLvhnrf:0n58QUG1tejLDcvhlWHRa5vJnrf |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hFuOplmGpA.mp4 | 23.28 KB |
MD5:
8c9ff0d55839fd9b8015f5da40db6565
SHA1: 45a5e3812fda55d0ad427a75a37586268f8b967a SHA256: 451dc41960a443800d8d5633c814f942982ddc71c9cf5551563d8048e554e416 SSDeep: 384:nAkx0bMF5PXFxVfiyjM4NtNhvS8HC8yfV/yyRK79OoVBLowRlGnXmGhWphCQsR:n/nXF3i+NtNha8HifVKpVywMWkGji |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\j3lS-CX.swf | 42.41 KB |
MD5:
936b8326838f4af76be93a35da0a7968
SHA1: bf8bfc2985246a38175359e3965098e5c8ac0ced SHA256: ce0e99ed1c59b762b0183b2a63ad19741b3f2d6c32c2f7532c1c01397b270176 SSDeep: 768:FbgGMtow/pXePVFZ9FriEv9A4YU9lxl517MFzLYbnQCIuc9ZENObqJMd8VZIK:FkGMt5/kPN9Rxl517m8QCIuc9yiqLX/ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\jPsYR8ZZ2L.mkv | 78.64 KB |
MD5:
069d36bc3d2d45e1f58ce0add8d252ff
SHA1: 8da77befd99bfd27b867829308bfcf7a40113eb1 SHA256: 2a741c92593492cf09d01c85bf895ebd3d389c4a6a8564f7738f5bcab31a5f0c SSDeep: 1536:6n08LVh57EkxSU/gA5Qj80e4kquj0JSey3qbPHxDYPeR5lC5Cte8aBnwKkBa9+:2Vh5EQS0TKQJ4kS7ysHxU6UrvyKoa4 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Kgv66V0yUi.flv | 100.56 KB |
MD5:
da509fb01e07be24d568f800be5a2c83
SHA1: 61dd2e0f6e5f25ee248e4c98f16925da747a795f SHA256: 395734f4dd2e1bc4b3ddd87d389ee31b0064d60a9097631680ac269961feef4d SSDeep: 3072:l8AT7L/WXNTtSuQM75psv4RTXknl51/+6DRCz+VCdH:lR7MYuhtRRTXm/+6dbVCdH |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\L9mu6tuR8QFKGNd.mkv | 10.08 KB |
MD5:
ece83a083bde2093555fc8be8c0e18bd
SHA1: f25c28f9edf936babdd8934f99f1b354471c0e40 SHA256: 139d0515ec6564e5eef78045de98b250d5b6b23d2f938f7be3a73af84bd6a896 SSDeep: 192:3m64jmZTTqpvskAgNhbz3G+u7K742ZW/5kSaKSGMiD6UgfAOChWNRFBdXQnC:3CaQVsjKhbXi4zWBYKmiD6UdviRTJQC |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lNQJ.mp4 | 91.05 KB |
MD5:
5f8e7d5bd9de05d3513c6bb806558e90
SHA1: 5e060bb034a528236c801ef1e86b03a725c08822 SHA256: f8cb6d55d23354ed1c46f8dc5864a7893ce312041d18e6347bc2f45b78486a23 SSDeep: 1536:QNAs6VVtCPkLO1rTpgUGIEtU69Ch/NEUhppR1WFSj+8IZGJCjrqTGf:QNA5MPsO1rlgSl69CptpAFnG2f |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lujYR96ua7eRgBXkLlG.flv | 34.11 KB |
MD5:
d1964e13a16f80ac65a5141eb5b4840a
SHA1: 2b2e3d3c0593dd5746631f2d77672c5b7c78d3cd SHA256: 1d699dc60e2f9f7030dca2618bb77dd900b7a16743c011199824a4e9cb828273 SSDeep: 768:Fctqb3OEb/S08pjRIthLdC72nglD97mO2822YbWYwu:mtI3hz38jmhLdC72y7h2PWA |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\m sf.mkv | 58.03 KB |
MD5:
c8c2b169042af04d69d5f2d54c991c72
SHA1: d6906be494861381441a003808dad8e6a06d6cf5 SHA256: 8238136b4d897f270201b83a2ca902e0536101f185b33efa75f895a3ff5d96cd SSDeep: 1536:TZUwbHjWGeME9j9aQ038CfEKinOMkSsNs:dUcWG9E9jH0380oqJs |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\mcMXbxYj93Ssek.mp4 | 8.31 KB |
MD5:
db7a2e4278cf91b2a9bc2ec06a0aee6d
SHA1: 1bcafda88b097d9a72bd1f5b9036e086d9ec0bd0 SHA256: b1e6cd96ff54791b78c2eba27db428fda079d46fec07f83a5cd083d437693a34 SSDeep: 192:DaXPaXpaePQPipWEO/mmOKUbOnn5EdZGqaFha7IxNnV:OXEEipWSvKMOnngSFoeV |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\NjUcM5pMiJ9V4WxAll6.avi | 29.15 KB |
MD5:
715b00f1bef51f5016f76a95d83c8724
SHA1: 0773177ca591dc2890aa0a3e064572e3fb12a90f SHA256: a92c082337893657d2fcad7a80e55dcc899627fa687125a6edc7b84b5f5b575e SSDeep: 768:4JhK868WhybR7sNOqB4fcJy0hj/be7qijWkmeM9oOS:4DBxROdB4fIJTiWFu7 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\nN83yzk3cXA.swf | 15.66 KB |
MD5:
12a2e7deb6982a7ce792a7389da26af1
SHA1: 1e97614bd2fb2a573f9e6a096b29aaa9dbfa7ffa SHA256: 6e5ee8ba5e16ed35d539b91336b79d7ab4690d56cd6b86e7f069b982cd5ebe0e SSDeep: 384:6rFiTg5267NAuDtBFtXWI1PA+ca2s3Hw+2T9CHy:2FQi7bXFoIGS2UHwPBCS |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\q274Jlys8 3Y.swf | 33.28 KB |
MD5:
3c2a410bb87ec86c12f3828e69b859c5
SHA1: a5d1a907ff43f731a4cfcb4c3f913aaab0027974 SHA256: 7249fa5e3e35e54f4e683adfa8e772d6f2ac538ee9e7a66c5f010ce817aa5143 SSDeep: 768:6GlJc+haWxMQiUpOOG9+Pysf02OCksKoDIcS426Wkg/ETXX:jxhTMGpOOJy3zC49423qXX |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\r62Y9.mkv | 11.74 KB |
MD5:
38c241419bfc9075e13b60ec3d07d7b5
SHA1: 4b2c2a2e3b29b1e04785ba94b7374d2a62198113 SHA256: c39666c27051b1cc43e02ed34c466ade9b3c2b6f690dacf6144c72920730d1ae SSDeep: 192:VY/9IWDwM/ye1xvojzN6CHqQ17PBPyX8sDCgiAcTo7lTvtRwbbvDsXrnz8:Vk9IWmevwjzN6CHqQ1ZpssK7l5KvsbQ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\rbPFWos6idXHH.avi | 3.75 KB |
MD5:
d5437437964addc6990d62df31a3f4d3
SHA1: 5290a439008eca183acbfe3da0895872b1deb776 SHA256: 3586cde384be5bd5ad4e85f16e7cba277017f681fb7a1cc844ddb22cdc38b56c SSDeep: 96:l+NWK9WlKXA0BynCVCkswVw3IGMwSWuLHMnczW0:Q99WlaeWjtdTwJnY |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\SrmDFbFK3gj.swf | 60.89 KB |
MD5:
a2989019556c7a1a71d07729e5b29953
SHA1: 04788c97dc0eb27e8656b341d10abfbe95a60618 SHA256: fa37790499f7c9c4badc675c9e15a62de32683f910d32ffd31efe5e576856b81 SSDeep: 1536:LwLMIrcaCIpqSIXzmhkcJ/ShsFWdsjFYWxzlCqJsa:UwIFr0MRSpWKWhEqj |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\TsPuu1 1sMP.mp4 | 10.04 KB |
MD5:
44b50250e44a79c7c1fcd829e2372a57
SHA1: 89ef34f784ddee552bcec6ee53ca63fd5d663ade SHA256: e55d762fab4dbcb6523a9084099f008e6366b7aa5bd3179bf75dc69de55dfeef SSDeep: 192:4rngxTr5IOj7cynYAqDlnJjHdh9bi42BOQt9DzBu4GIUnM:0gN2OjtYnDlnNHdh9bi42/HYHIUM |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\VIz1GRR.swf | 44.00 KB |
MD5:
e5b4fa985c3520efd2d47521abaf8c2e
SHA1: a70cdb2e1391f82c30d10a8543f7afbb5f87af3a SHA256: 2241d6ad5094dec7d3bc1918a85e797b5af47868ebc2e7870ef089a9f93e9fa3 SSDeep: 768:bqJkXt8HgRaDlb3r0rNeEk/nibIQep4JOCBpe2HlZcTiW+GB/zxEsgbj5sSi:bQMt8H9bKeibkp44Ue2HrcW9GBdlYj5o |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WGsPO0aBRCLEqnQH53ju.mkv | 11.99 KB |
MD5:
a391636e3da647fb3aff9bbb05a206a3
SHA1: 6127828aaaf67e2e96ebed8d765283c671005932 SHA256: afbe69695311b6db0c0beff15051809cbdda3f8c627dbbc8fa511a4c46c71d4f SSDeep: 192:0fB3QcdJI1SZh49v/HAgd3uPOrRbWJY0oyD6qzeR/prIQ+cXSjGBq3jcrJdDqCfz:0FdmIPs+YRKm0H6nBRoRzoL2W+iSG |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WQjxjaZ4Wor.flv | 54.39 KB |
MD5:
9eb724aaa78ee32a54429248d745b4e0
SHA1: ee8e2e5bbc1fc63b7a9498683b1e11f97061d67d SHA256: 6ae5c8ca42561c30375f868ad037a8be66c9152b515a6c35fe71e9457ebdd734 SSDeep: 1536:X7I8C8Rot0UBxNp3Dl/5h8jT0AoKV8uNP7:ZFMHBs8uh |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxQZQRTiEQb.swf | 14.19 KB |
MD5:
bafb0869d02740b0564976545f6b9ac6
SHA1: 44d6cecb5abe67097ee11074b1a32acb5e00043e SHA256: 4bf9438197f0a8cf47ff9eeebbfc106dd749a632a367263037f12c3266892b5a SSDeep: 384:GpnHPI5XTzEprLEvOaLqgySpWLYM4DLhV6:GpnHkjzQag9LYM4Hh8 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ybtQ4TGZHLJZLR.swf | 49.45 KB |
MD5:
eeb8af579f1faecefbad786cbb32d09c
SHA1: ec60c46a0cba23d4627acc503da0c31e9c06c8f1 SHA256: 8963f5d944aab5a32a5ce9fff5dd96142718508fa30cce1e97dabd98c2bf6085 SSDeep: 768:C4D4rquTfSVnzgS9KuEc5jC0URNsLf5A9OuHfmCGw+zFXM3s03fb1Lvil9Sx4Yxq:lDQq5VswcMe99Orw+xzgjJ/pxfre |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\z5HdOvqGy8Yj.mp4 | 61.45 KB |
MD5:
5e96b6a1b989b5dfb83119d0ac796b34
SHA1: 3fbddee805f4bb0c79d5f0cf517dea0c681e71b9 SHA256: 5ba2c9423feeb3a8ffb751cd6f12955660f4302c2863509ae1ea222c3c7c055a SSDeep: 1536:tCHDPccUfFnvUmmlKf5ll0llmpezs+gNZZ:AjUGDlaz0fAezsTNz |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_abCHe-XTb.avi | 5.81 KB |
MD5:
a52e858e3bf768bf8ecb8209b4603f0f
SHA1: 92988f64c3bfedc0de875a601cfc8677e9794f61 SHA256: 0d98c8960be3f1e6dc4723a3bd50ea3acd3791a3522c8f01b9928a916ef5706e SSDeep: 96:P7yV5l/LPcedGzXp+E36z5v7gO8NFgcnfZA7iqC0K85IsFoF3eSRO5rOLHMnczy:+V5xzd2X1S5EO8hnfZn0rIrXRsnB |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms | 1.17 KB |
MD5:
39ffba6ffff55965c8f5d9e35ed9da40
SHA1: fc43d2bad01c38de6e247d7a4f9c349d06472172 SHA256: de27409579215aedcfc8a3a7cb7191f22182b457411b406cc84ffdcfe20c6855 SSDeep: 24:OffoWW2byTbME8BPa1JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdwOSE:ebyTbM7BPaLfi4eshyIK+HMBk3K6tzJ9 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms | 1.17 KB |
MD5:
f0b9f07d089fd2801e56ba9461c6996f
SHA1: 990cb2708a895b73ced3326f8781c0edfdc61753 SHA256: 0f37f9fb20f3789131d455754097dbfdd15e5d7d1e5e9fc8a85250a00cb72399 SSDeep: 24:bpWzcjun8ADbCYS5TpvoJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdyoEn:bpWcj5ADb9S5ofi4eshyIK+HMBk3K6te |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini | 1.20 KB |
MD5:
d2fff218c921bd8e4144604f49346a9a
SHA1: 0303e57afe8700a8e9b84a1228a567869f53f8ef SHA256: 3a1b0023db168b3fc7ec6fb1b0995ef543d6ab7be8c7733d33539cd0dfa68a82 SSDeep: 24:G4RY7S8bQq9JiVJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdz5+:TYZbL9Jirfi4eshyIK+HMBk3K6tzJfpQ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\2zE5wO.png | 86.97 KB |
MD5:
6d4525fda1475b74d339da23190202d4
SHA1: 8de547edb3ce254374dc24692dce42af5bc0b886 SHA256: 7295df6ba558fcf857b2897da451b23ec4b5e994a5c847ea60638989cc0b0edc SSDeep: 1536:3X7r60lMvPDvRbIuMdlQTiwO+0GptObyyPGgEByYY0wy3t8YD:3X7G0aDvxdPiwO7GqGgsdwy3WU |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\BDZVG7.jpg | 2.97 KB |
MD5:
701252f739e70cfb1047f2355dec23ce
SHA1: 31348d35e5be831f7ebb7f4089b128738662d9d8 SHA256: da810eb8b52ae66c592d10024d6f72c937ded41f931063ae5c977313c44da3da SSDeep: 48:bFOLkPUGt+eBHUtDT2iowbB17dTGpXpi1JH0WkdIGfi4eshyIK+HMBk3K6tzJfTY:BOgLt+eA6idhTGpZCUpdjLHMnczpC7 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini | 1.42 KB |
MD5:
93d5d1ff53a7e1e62167120ea0cea562
SHA1: 06f784fdab5443762a3482716e072e59c8768399 SHA256: a3d470d679363fcd633424c7c7ac53067f8d02e50904a42917a29af83e2fde37 SSDeep: 24:ra28aoWz9ZQy6kFI/Q4bonZtqGaovNqyNfqpwJM+i4cJtmLxONmyIK+HZhoBkrLl:raD6Iy6kYQ4b0XxakNqyNyIfi4eshyI5 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EhFf.jpg | 76.14 KB |
MD5:
51ca2d1d89303485161d678527a9e761
SHA1: 541321d75479626eeb0f927e39fadca6ad4e87ed SHA256: 94e1352c0c827dd7afa779e8260410b58002590c045373382ec1310581845477 SSDeep: 1536:VwjtvXe6A6lNYhPykQK07+xBBqyDCrxq7HVEmk:QvvlW/b07YB/HVc |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IFD1vl1FyXPwvpwAWHo.gif | 4.75 KB |
MD5:
48c247ad0c6d9fc83dbef2af6b8d48c0
SHA1: 58041633fcdc9ce12d444f0d96e811a88c35c114 SHA256: 585cb818874089d4e6d78127fbdb07d6b1a6c0670cd1b16e5b83bc01d67d0cff SSDeep: 96:vrlgF08bolLj196Je/whGvFqS+abobTYrlZTPlRoza2XKqLHMnczN:v+F3bopjuJe/whGvFqcEYUz7Unq |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\nj9WTrBqdjX.png | 77.73 KB |
MD5:
16af6dedec25fb20deb80fb296cc06be
SHA1: a48d4376478d245bf0d6822ac5576add22670447 SHA256: 2b763b03aa79590361d0e44fdab192bb9aff1bb9d3440bd0a586f81e26d5f0c0 SSDeep: 1536:WNMYnrj2TbawPKt4kkTI/II906KhC2a8RPDeOFDg1i/DN7Zj5zd7y4cbkoFLM+vi:WNMYnrdaA4PI/IcF2fDe0y4DNJ5RCZ1I |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QpjBoBaddhja0bGiYTni.bmp | 36.19 KB |
MD5:
3b63b93f6eb90f988bec4fa71795afad
SHA1: 14cb6ed3c217bf385e229dd13b611376c98861fb SHA256: 53960178437ee4e83253eb62f6a1a0007e43b8aa318cdeed209c54f26770506e SSDeep: 768:gPLA29p8WLTNov/bJ4+DCzmZwBV/KbM0Paf0vx0WzfpV:gPLA29eWlICE8KpPamx0WT3 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\VjwflUU3g7Ux_MGZXe.png | 95.21 KB |
MD5:
941e4bb171c9a514fbffcc49a56e8b65
SHA1: aef1d9bfff5148e29451274f918e089eb72106a4 SHA256: 38ca6afa710a8063d91d57a500683701ae206e890baa7a5c93b34f560103c58a SSDeep: 1536:sjB6eQyoQXM/Mm5oWv5h7VUlLKLRs84pW0FEVv23tSQYn/VkAO8KmLOBZuOWjZnS:8vNXCMWv5hBoL+s8hVGYfGx8VLv9ZnS |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\1Xosf.png | 17.41 KB |
MD5:
f728753ca97ed6ce044a5da6527a2ab9
SHA1: 4f3d66bc5e90ec5e965ea246e6c875f577278340 SHA256: a28b273d603a261b00e548d5a557e32bce2fc20ac56b3e8f723159e7b210ca65 SSDeep: 384:Jmla6kt+RzZyw89wkIpvLQ39Qk/Wc9e2IGUjtrJoojAB:Jml4tu7owkIBk3e3IuBh1oR |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\A7GFfwu-bHqk.gif | 24.16 KB |
MD5:
a7c5c67581ba3d9c42dd1eb40f64153e
SHA1: bf3944d383e0159e8578b5b88916e967dbb92c1c SHA256: af93a8206a09190063fd2039e8fd16df5ec6b825ecfa11b5974473e27822953a SSDeep: 384:916d126g2iZ6xoeNHPFIDsm4feHx4P4NzVq0EPJWcxnXEpNDiWvVZLJtiELZvHhn:916aZ6x5q6eK8SWc9XEppnmcvmI3TOd6 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\SR4T2D.gif | 77.07 KB |
MD5:
1f4e87c59bd7adc6c64ebca47a61e69e
SHA1: 9ebbc64db34c0601fd10603cd8f5a454a58a0799 SHA256: b47c2732cafa52c22ce9f83bf759215f926ac5e0bf479929dc5a234fbc0eeab4 SSDeep: 1536:MPeOJXquUtYv5lYnbB98FVlx2fZWx87TVDUr9z6vqy5Hw1yY2wz5zUNhSIu33vJ2:MPlJ6VYv5lYnbcoZu83V4JCqkH2yhU5e |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\41E2vjn.gif | 30.16 KB |
MD5:
71763570e9c96128d93c83e926b7ac4f
SHA1: 4454591d280568648f3d3dc40bc0507b19e8feae SHA256: 462bc240e3f1fd95eefad4fc7ccfc8cdb57f06a54bdba69a68a2e98a7c91a45e SSDeep: 768:PfjleFBqM08xNsq2UdWQfTmktmkOpKBfhBIDqVQ/UtRXuINsA32qnk:P0XqP87sqDvTZ7MKJITUj+Iv3G |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\aRbWVQ1PBmsE9IYNLeTd.jpg | 42.54 KB |
MD5:
4ef4b11e875ff259fbb1fa45d7b98a57
SHA1: 4aeb25c064c3e99e263ec26311539003b3f5b65f SHA256: 0698299594bd19c5fefe022fe200b4a8fb766a0c9af650cfe3ded08237e0ebe7 SSDeep: 768:RwSogZDTxf3C8o2s7pQibwVnuceGQhAB4WUZJR1bKBq6CrGJ5F:aSdFxfSd2mQ3Qjf6yW8JrK/Cid |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\gkJs4OV85o2x.jpg | 46.86 KB |
MD5:
872a473063c73c8f718c6961626978fa
SHA1: 48cefa78bb314aba2709514b3668dc31a5d1abb5 SHA256: ae8c861bef1ac8fca68d47cac2f5b6b185916627b099c2c2c67af1129d56c07b SSDeep: 768:9MwphL9qoYbhodYHxF/sA3RnlzSL0eU7yccn/bEp4KcBaasWT1g8UviCfs+SjbSv:euqoYbhEYjsOoL00rTyYaI+8URdYSWi |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\36x28XoZYsLFWANK5kq.gif | 8.25 KB |
MD5:
9422f14bf3e6a9cbe9c6cd9679b93e6e
SHA1: 4aa442f5e84c79609bdc105d8e6bce9f0f3c9b08 SHA256: 09e95dc924bef342329952e5914fe349d6a9488dc5c003756ee32aab003386eb SSDeep: 192:8VHYsoXz16QMzyL4OVHUmYrbbqVvgR6kKQJad5sZ9Ya/l3+/AnHgtn4:8WdzkQMzyLHNtur6kW+9Jtu/i84 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\3OPw.jpg | 36.88 KB |
MD5:
22369f89810fdb57c2d5a698221fe85f
SHA1: ba151a9d338203f3074746a8e1486d86bf04ae8d SHA256: 87b3cc0869415ca60ade8dffad07900de5a69380c845dac0c6a58dbff6b6f3e1 SSDeep: 768:nmgj6NTSEG3Dfatt/7LzAgi/kiUh2ExFClH69VBPWIVXDl7tlCXU7iS:nm7NTJwDStxQ9siUYEus1WIV55OU7J |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\dvMivKCGj1eWR6n.png | 48.77 KB |
MD5:
8b7e95bb8c7a4302f5ab1550252957e5
SHA1: f15f3c4fdd5555a8ca043f3db611547abbdd9b5f SHA256: 82f643d05b0134c6b5181ba829e8f867bd79e8d80a0c3ffa918725395bd51843 SSDeep: 768:KaJehMOvzT8T+sJ0GmawU7lZY6NvwnhKHzdOMVlIFdTtM+mihlWPnDvcSG0:lehrT8T+sJcaDZYtmxO3aglWPDvd |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\gyETZxq38xJdGPTIu.bmp | 36.80 KB |
MD5:
ea10c3e6ccb06170895d7e5a169e8d25
SHA1: 955a761fc7bbac910b567b167db90339d8134f0c SHA256: f99fc4ad013e2b6ab66eb33d8a998a273b5b67a393deab3111818ca3bb00bd25 SSDeep: 768:bt6eKw4GkqKlrZRvDJh9a1C1twoLe41JCZwA:sel4DHVRbwADGwA |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YtuNE0kSPzu.gif | 28.54 KB |
MD5:
2c8517d9ca32ecd75d2bb04dc1f20237
SHA1: 14d8dfa93f61d78a58aa3011ef61fa222df96932 SHA256: f47cdebef458c990c898685451182f57448b120c981dc892242fa3a6cd51599b SSDeep: 768:vZ++HeZYucXB9ndiVuV7mSiT3/vv+umQYWk12uUg9aA:vZ++HeZYuevdikV7mSiTjxYFtcA |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YW5vf.bmp | 25.09 KB |
MD5:
55a8131f92acdda7438f55f8c60f85b0
SHA1: 06c0a7bef46cf3c5b95c49d5507ce5224a8da579 SHA256: 2f7f9394f4be288b039bfcebac51ab2a71399c8fa01142188b79c4a11598392b SSDeep: 384:injR9v9n92q/LNUVG584Zbb9fVwQYGWuEppmypvhyNrCP+uIhrmVUdl8/gfT6BkE:il92q/D5DJJtuTpIyqBuIEV+OZ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\_a2Pd.bmp | 85.69 KB |
MD5:
a3acf52d5d564e6bf8c47cc8d7be5374
SHA1: 900d316f482cd4ffa1c462f1066c4f12080774d9 SHA256: 6a12331d139b7e4c0bb0a0941febbbcbc8059c04cb56904bef7b21135ba8b108 SSDeep: 1536:w9i0Wc+4/cryWgxHbjd66uwtn7MI35TvO9NyEHxD0QSDIiMAC04ZlTJc97zxf/S:yi0WxwcryWwbU6uwp35DOlYIiOJe9fpq |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\9WmhgBFveH0j.bmp | 94.51 KB |
MD5:
6339fe73f29c7999f8fb7073cfd07364
SHA1: 56b9b21ae9c488464155c3a259ddbb10ab984578 SHA256: 1fc6151f98d18baba5bfba27fc2c60191b5b9b6ee8a0d5eb2c79981373bb6f89 SSDeep: 1536:32QzSGqAq1+hn/cklzAYcUpkSNOurO2FHOWELqPqcz7c3haay:3219A++hn/ddnbKvoO2ZiEz0c |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\e-v2NjwnasaQ6et0ja.png | 34.28 KB |
MD5:
0b706c9cf718c09877568e9ae6e7ffbc
SHA1: ebfce5692a3dee3c5d30eff35a7bac842d940156 SHA256: e495fb2135722642271af4cfe6e03760c9d8c8be55932158aa23aa6f50572f81 SSDeep: 768:zTgGE7Q+6ORyJHDr17Wug64bQvCnvaVcixq3J0xRh0BuY:zP5n9DroH1bQvKv6cCgJ0f+L |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\l5pUiiym.png | 8.95 KB |
MD5:
ee37f93aa8da215ce45fce26558f4908
SHA1: 02ae3aa4a7d7769c99a1b0747216e83dbb3aa306 SHA256: 45fe7d2129445daf3683070cfcc999eae1ad8adffc94c33af1370b570824cfc6 SSDeep: 192:0OC6aApFs7pAYbFPEaAhPGJb42u0bMNYXOSYtQGTYJK+/w0Xsnrc:0OJMBbpGZGd4GbM9SYVTYJK+/w0Xsrc |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\RCWZBzZRK7zkjlX.bmp | 43.78 KB |
MD5:
e8abbad49a24f1bf928096ee12b9e06d
SHA1: 92c505eb1ba827b71f772b5424afed3afac15e60 SHA256: fe438ec01625efb9130bdb0f2a8fc17e16ddd9b6cca143b3ef599cdbf1756f03 SSDeep: 768:vKfqcxJslURNi7y1oJhOdCcbzU8xtNpXFBfdtYzEiOaulIA2ACWVMbJzTPE:vKfqcxJsYdxX5bdunM7ZCBbJzTPE |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\vcSPsVx.png | 17.17 KB |
MD5:
cf0c96635c230fde32162dc4e000f733
SHA1: 4f136d189daf04228d347f4efa6a5c4a896c1563 SHA256: 2ba130d49918d166cddbdf6e2ec34b691e9f6e117e0413b2e8e592de1f55d374 SSDeep: 384:0qbD/ow87N4RQWPUWdQloI8ery0taE1rGtcW697OKddIHHyUQL380ZRk:nN8YQSUkQGI8Ey0kE1itcfZ4jQRk |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\FB6F-yt_lW0.png | 92.04 KB |
MD5:
3a2edc7f17b1141a3ce3215990b06a16
SHA1: 4bdd74f28ecd944cf6a49a9e0f0e8dad638da22c SHA256: 58f4b7cfd8cecfebb8e148c418b5a8b79c8978929658b7f4457c518cbbf75111 SSDeep: 1536:Bmrb1CVrJ5QWuO7JiU41CLoPsmydXa3NK8UD7rWW22d5xpacysOWUScLHQ:BK1CVTQWHiQcPsRwALaWZd5xpacTUSgQ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\SCfWk5F.jpg | 27.53 KB |
MD5:
bc8ecde99cef4a4d61e03e5e65b64f7e
SHA1: 107758f243d86913dcd4b5edbbf659e39b2f69df SHA256: b459c2b5e24a9ef4f870d2738c82f559ad6748729e8333fa38a6b06040107d59 SSDeep: 768:vmLmZ+hsDsoZf3SSRFm7Bbrf6+YyTGpMR4m86wgd:+LmZJsIbR4trf6+8pMR4m8RG |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\zlMPu11Z9j872BhKsufL.gif | 95.14 KB |
MD5:
1066139ddba9dfd3d5ddcf61509b8ff4
SHA1: 90bb1ed71ecbc08ed9ec2e9ef8b6bbcd90a9f5f1 SHA256: c6fd5f025ede4454a1b4e85956643cc41eeef52a89581fe73b3f6ae77b3d3f4a SSDeep: 1536:sdMMa14wjh39Rb9fwgwHIq4ptTkJ1zGLRpsRm6AfHoDYAuR9XKA1zAysX56tlghH:sdMx6OxsHIq4PpVp2mRofuRd1syDtaVv |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\2qTC0a5scT73Y.png | 78.93 KB |
MD5:
0495a7582165fb83d6b2ca8c0bff725a
SHA1: 0d7043baf025fba1779a4202dd86d05e51b02f4e SHA256: 27d6d2c424344886366f8ead79f436cfc69444d0f6e7193707dcb84cd163c690 SSDeep: 1536:+2ur2biVSUrMoPXX2+r7cQU8iSzNkuzy8m4c3ayCoejoE1zn48SIjpUBg3J+adfG:+2a2mVSUrDPXG+kQLku7m4U9MTSIjiS4 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\F3WWwsmu0xGK1DZvtX.bmp | 72.97 KB |
MD5:
6a0249da992e6e228eb9145bb1fa3d32
SHA1: b267654b60f8007bbdd1a146ef0325b664cd8775 SHA256: 9c073d0f122596d110bf03f7443db2c44d2ef2ad7eb0b0f3114c07ca4c7241cd SSDeep: 1536:6tTHyzkwvthDBQK8QPnyfhDj5R1i5UBaGJNoaXAr4eW:6tEkwvt7QVQvyJDDaUBNNoce4eW |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\2WhK0Jp9M.mp3 | 7.33 KB |
MD5:
4bd529454bb943ce0236e67293ec68f2
SHA1: 9abbce2794f3aca93bc38ef1fe6d774fab570a8e SHA256: dbb455e58348831b0acfa133307ae885d96981a6c63e3f5f8238c1e1ae29e0f1 SSDeep: 192:xKRHo5JAzfPdBBEcbplfHHpGgtIfBSDfnB:x6o0xBBxbHpLtIJSDfB |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\bF-Gyp.wav | 58.66 KB |
MD5:
ee81d57624b2820ecd1d0314be3b37e9
SHA1: e30c7609f340cb38db95d89e1da2b353e7d13c93 SHA256: 386c16d133279250c82e29f3b209ee9c0357ded50155a02082e548e7cb8ae12a SSDeep: 1536:K754Qhl57vL30v0hri+eCoM+nQm4qelHkcMrC5YHL4:K754+57vL30IG+PoM+Qm4zcrC5iE |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\BFLFCvjmAT.wav | 89.52 KB |
MD5:
4984a2c565522815e8a8b7c45c9b02b5
SHA1: 847ed7eca0d29a191660d83d0ea34df1cba8c6b0 SHA256: 8a2863c4595344dd64219bc2ab5073d2abed69d171655996b968e43021e9a83c SSDeep: 1536:tOVfnG0KcRExT5w74ok05oOCn+E6vGjPw3OzkwDo9dOTTq6iTX0+6NPs3mL40VK0:tON7Kcky1CneOjPgOxDqOXq6ib0+6NPZ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\BSkWNi7 iI.m4a | 33.27 KB |
MD5:
d64b3c0373974f4bd4a9e3e0bfaa55df
SHA1: d49eed3e4519a4efef435af504ec138e32bf80e3 SHA256: e5d054f969bb2cd92ad7dd6ef10c2ccded83aa63a61b4cad8b3090ad29d64a12 SSDeep: 768:/ODRooxtuV/GSSw7stWK4xOGW2wmXOHHa5yFFLkpe:oRd0x4WLPwmeHHa5I5p |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini | 1.42 KB |
MD5:
a75d6c9f3799f5d77755208194e9a1e4
SHA1: b41c76f8d231a4f31e6d27aaa58cc301e9c31411 SHA256: 63f48605105c05e7b0ec6c0bcafaccd08352b599ec11afc29003c5fe60232747 SSDeep: 24:VWnhg17zDMe09/WludjKNtG0SAJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdg2k:Gihv0VWludgtG0SWfi4eshyIK+HMBk3U |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\F_2s6FlTtFUdW9.mp3 | 75.72 KB |
MD5:
293789b53a209b77e7819d5f0ddccb37
SHA1: 83d7a354792a2319f3344f92572e294ec67423ae SHA256: 5139ebf11571ebc89c76517266e20b62965ff6275c5e20af01af88b948641360 SSDeep: 1536:H1Zoz8AKk+mQ43CdTzqwRZYuabybwThQ7yfuMUUSgDgVO9vKJyK2gbe6:PtAK9f9bwTY/MRb9AyXgq6 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\g1P_VcvnB.wav | 100.11 KB |
MD5:
f3ccc03941d862716c01a73437e3bd20
SHA1: fa98c18456aadcc7d44ad7e2ab60801bc51f4598 SHA256: e8a9fb99aa925b32df58bdfcd06bae6bda98eefa493a172de5fdaa24261691ae SSDeep: 3072:TvKI3iWCsuHcomS6H2QjpNYwJ4bjLQLOq:TZ3iWFu8ot6HlPr4f0L/ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\J56Jpm_V0AAsmT.wav | 6.45 KB |
MD5:
3de203634cf4fe619a28809e6ff37af5
SHA1: 2de2bae72ebfa76e0f3e1a7d542d0448675425fd SHA256: f9380b16c8b9a08d6da1f55c656050af7b2e31aa6f6c6f2282bd4c37aaa19fd5 SSDeep: 96:pQxFX3eJJsJndh216e/DsOhJuZBpqrypJTJKSY4FSgmnyL4jsjcx2PELHMnczTV:pMFg2ZT2Z56vqepJNKSubyLysjS2P3nq |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\JD-tsrvF2.m4a | 34.94 KB |
MD5:
102875d4445d1969c20c07cb614797ef
SHA1: 67cb77ccb1a4ee839abab733270a6c455b7e3b03 SHA256: 3d1cc79389754700569c9a9a4561a7df00ee442226286ec35a4e4a9a29bbdc57 SSDeep: 768:plh2YJlx1RVtakeOSfQhSHBbxb9BKnxNdEvnVdDs9tvDdRHVW4e3:B2YppdzgHj9kxYVcvDz84K |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\KfS6I9.mp3 | 44.79 KB |
MD5:
635a0fc2dd56bc3b15f3f2ec8dad4e5a
SHA1: 6794cffbd6b3c406ee3f65161b2bceab81dd76d0 SHA256: e7674129fae11cbd75381ccd298f0834fa8a9b9e109538faf4e004a4d3bdcc6e SSDeep: 768:dgoGWhyYOklTXFbQ5jUS/Tz2ms9dBJ1UJAbiZbNeqr3XYTJn+RlP:dgoNo01E5jT3uBJ1Fbw1Yd+HP |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\oVcBcPe8aoMcbmJ6L.wav | 12.84 KB |
MD5:
2d71fbb86c0d037b6302cf8b9a427b72
SHA1: 7f2afbd87ce9e30b73ad0cb8aefa57df83f8b840 SHA256: 2ce58bcd6d8fa39a0c53d62c00f0eecf89750152bb92ca826028fa34260f9f5a SSDeep: 384:3+cCezPoTLLxTFKpe17u9Lp/7pujrniDi2kRyTvKRI+RbdyH6JT:34yULL9oRBB7UCDi2kkWRIqdlR |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\QiM jAC.mp3 | 80.90 KB |
MD5:
c24fc054df14d52fd2c201f28455f42d
SHA1: 1dad834793954f364091d325beb0c227e7cc4deb SHA256: 3d56759204d15330a14d21f1cc6668bf8ea06a1de7c721b31b84cdb86d95b72a SSDeep: 1536:++n0GAZuOnJRXrzr0VVbGnrlAO7CJETVdlRc9g7WPFH7orBr19qG:++n/AlJRbUVVsh9sETVdlq9g7WtbqFmG |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\qPi-26_R5Y.mp3 | 64.89 KB |
MD5:
56a1d54320609ea3e2bf9fb5b797fed3
SHA1: 72363a6fd060ca042ed4ac1100cd95e78224f3ba SHA256: 5f17d1b9c1cb89fb2871acb084d95336746dfab60fcd0affa216f4d5e07c312f SSDeep: 1536:+Las0Tt7+mz8+dk06oYc8M/XihE8JH2SOyoqlKIx5G8IBa:I0J6oYc8uyhE8JH2SOyLKK4fa |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\t92T rcs.mp3 | 41.87 KB |
MD5:
4eb6c8d454fd314ea53eb40f05221939
SHA1: 58e74e8fcf797c9c297cf5ffbfe7ca16b1dee8c9 SHA256: 3a196ad1b56f750ac8c80ceaa4f1430c6d010392904fb678c3059a72f8f4ebe0 SSDeep: 768:lwcHXdScnJyxr6c4hkMixw13jBVW9z93WMPA8FwELAHEFBKAjMb1cOyr:WiNScnJyxWhh0K13jyJPHFwEE3bW1 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\UYjfw0CDsB AodTHHd.m4a | 95.75 KB |
MD5:
9fbddea6bb79e384ffbaa97ddac61050
SHA1: cef367f41c36a7df60d6094884338adcf5fdadc1 SHA256: d08a58074e67c02b616fb8e365279736a2350084c0cdddf9f342f372e707c30a SSDeep: 1536:n8QieTNnMA6Lg/dR4kRXGVuQIk3LoigqMyhiVFTuhA6W3dQMy4kQxIfLXfyePmfr:8JeTNMAIwdRJu8k3L47WA6WNQMyjWsL0 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\WP4KrGPfe.wav | 38.81 KB |
MD5:
564ec76d7e83299b6defca72a6c2f8b9
SHA1: ded409883af2c919e02f91984b2b6d7c8960dff2 SHA256: 365e30324ef0d3378159b1168ed7de920b37e1c174564c8bde74631cdd885a6e SSDeep: 768:z8LSlMb3yO9GMeXdsznH61FJJHXKbHMbP8JbA1N2nqBdXYyzGv:z8elvMIszH6D/XKYbWbA1FYR |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\x hNiw1Ois TfWIABIB.mp3 | 58.92 KB |
MD5:
f5afc0355043345ac2a9884e2f89b1f0
SHA1: fb7ccc050ba61ff797e4868c3941b08b14d3ae32 SHA256: a787593893ca7d01273e2635078d289c303062885bafdb0762283347f3b16c2b SSDeep: 1536:rTjRfh0hNqrLi0ZTTnfOUFHq5PBWtnYUoZSkrXk:rTghNqrHZnWU05PBWpoPzk |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\xqfbr92zFKybE.m4a | 62.06 KB |
MD5:
0be0015c0b268118c863712119be6ed5
SHA1: 5006ac45fc5d28ebccd5dad039c8ba8b26e04fa0 SHA256: 53ab47416210bfff211a9575dd966bf5b5ee666cfa5df512b67cb81d5f635031 SSDeep: 1536:WBj9HPWJu1CZpV9wR+PU61xMCyi0Z/iU1Id9TV:mJep8+c61/0J5I |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\4_U9Ib4M.m4a | 41.70 KB |
MD5:
6f0dcf6b3a48e1986f8d5508a359b3a9
SHA1: ccce9d08b46dc8d45daf04f2dc01b0daeb2f8053 SHA256: 806ae9b49a72b8d356f1077e41e42587a5d34da484701903a56b8f82a9653d2f SSDeep: 768:i1X+Yr6gXEEBq7NerRLMZPrS/ZsxlV9bJ7F85WRQPcIWxZfQHKbbDiR:iprRXEEIIVL7/mf8YRcTUZfcGbeR |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\8uTN.m4a | 54.19 KB |
MD5:
f2110e56f7df06b75c3990f2583610cb
SHA1: d0c1184fca16814c403a68292583cb6c88bb5e47 SHA256: bb38a24bb9b018a6e9f1336f4cdcebd5499d15aa5c5e764807660246b6f2ddaf SSDeep: 1536:X8Et60yBjfWmBVCwce860jPifY5XOmCmihzfypR:XqfnB9860GwRJ8qpR |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\B7VBhHSAUzHh2b.wav | 4.22 KB |
MD5:
319062e2851d45b486eacadeffb0d841
SHA1: 8b12d11fda1fce9cfbd0d453200bfce3d1851f70 SHA256: 0120025eb0f9ecbbc5b055d32fd72303ab45662bb4a6ba624f99cb80cb0396a7 SSDeep: 96:kkf14kszhU9VGT2xSz8S4ioczDPKa0VQVFLHMnczK:jvUqxSOTczDijBnd |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\dQRxy-7flS.mp3 | 46.21 KB |
MD5:
a63feb0398fc7a3ad321b681986f57cc
SHA1: 7d861c190cf5256f7bf7735e68bf83293ba18b69 SHA256: f1fce83b320ac5a878ee201cc94ed02385240c50e4888d84928dd9a04b04c7cf SSDeep: 768:S303sSvYuK6vahBQKDWejuzd9ir3aQas+A5sHKXZm7mlQUGN1UMbDQ6kPUyEKBU:WhBRWeqzilas+0mKXU7CQn2qDQflEKe |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\fsulKw.mp3 | 97.95 KB |
MD5:
1ce29957eef09004812b24b0798e2b0b
SHA1: 25029982bf2681e381c9b013e6a48794a2e995d4 SHA256: c1ebac19489a9d85bbf2d40a6130a67688429bf1757c29fbbc3b634813cc3e30 SSDeep: 1536:M7pWhFfVGUHpwsZ48EMyu/4YaVHThPL+hruUDEyODnCK6jXbH9MoNL2KuFu:/hF93JSnMtTSHZbUD1DLqoNLZ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\gcAd.mp3 | 26.78 KB |
MD5:
7c004bfb0f0d5cffc79233ff1a9c2891
SHA1: de5c789d628bb6f932ab181b7c0fc0396638d6e1 SHA256: af863e31117b74985d0be136ea92637d24edb42a9fb5a2431417ceef66a1848b SSDeep: 768:LCmtTlMayVsKkwYGRiKeNQcAKXQXL3CPdtpf7QLkT1vESPzliOlkwXKD:LCmtTlTyKjGs5QcA3XLy3pf7QyxES5sD |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\JN4A4o3Q9kS.m4a | 58.21 KB |
MD5:
3fff18736606f47feab4e60a7acd2bf0
SHA1: 33535cd50237046ae03a73f229fa158a4df63d43 SHA256: 0099191ed9812232bfa651044a61f0d4e66701588afcccfe074052f78dc774da SSDeep: 1536:+9BKjaAzbSngi1I89CCtMAmjcc1yDM/eGx7tR8R3:+9wja8bSnLq89CCtMbsOeQ8R3 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Music\YyolnKloa8Zh\kZ_ci1.m4a | 80.20 KB |
MD5:
47aaafa7303d2ab220a895250e929d2c
SHA1: 4c5203417d6579b67825460318c5c709c68adaf7 SHA256: d23c0ed39546ccad98c5fa177ce9f01821e4069ba7481cd2b89c48b2ca7cb3f5 SSDeep: 1536:TWUFMATPn1qwlNKPiLpcexD0XcUTec1WQDFKC/jPI0WIILs:SkMOn1qwSieCRUT71omLzT |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Links\desktop.ini | 1.50 KB |
MD5:
1163a9cf10bafed5e8c759710110aef6
SHA1: d916f853edbb8d344324bc611340cf6589ece479 SHA256: d9de9aebf0457f317cbefaee198c2ac0d781e957c582bef8ae3ce4f9176ae7e8 SSDeep: 24:YWCYqy1K6XCb23VWEvMT8rjJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdig:EY/KnbGVXvg6dfi4eshyIK+HMBk3K6tP |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Links\Desktop.lnk | 1.41 KB |
MD5:
dd3abcf96eef1fb42780b61df1eda345
SHA1: 678a6496afa84560982bef4cbe452f88e03cf0c2 SHA256: b19acfbeb87523a65d7a84021db54efaaf23ea622039f49637217f63241d3b57 SSDeep: 24:4nHoIM4JWQlK2ZvvNyXzvgok8z2B3nc2jlJM+i4cJtmLxONmyIK+HZhoBkrLKRI2:moIVJWQlHvvOW8zDubfi4eshyIK+HMBd |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Links\Downloads.lnk | 1.84 KB |
MD5:
d86374e8853e482444ad48b33a257dfe
SHA1: aebd4b221bba740b34721587a9905f9037355e6e SHA256: 824bf30b41cbc32193ec80fcc70e0a0d1a3ec5c1c82fa4a101bd83717645371d SSDeep: 48:+8aROywlJ7LojdQoZhSPgF0fi4eshyIK+HMBk3K6tzJfSk:+89NltLo5ZMLHMnczh |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Links\RecentPlaces.lnk | 1.28 KB |
MD5:
de262ebfa93c1d47d3397609ce1c8d95
SHA1: cd5e1a6050a5c5f9ee78971219168fa5367b83f1 SHA256: 8d4d83eba3b74a13e682f8d108a0f97145886563083470351f426708ec005a55 SSDeep: 24:khZr75G25K1trwC9n2As3JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdOI:WVf5strP12ffi4eshyIK+HMBk3K6tzJF |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini | 1.33 KB |
MD5:
9ff48e482be9c600540fbdf12ef0c74f
SHA1: 3a47cfd321344e71a555d5b462551ce62196c743 SHA256: bc00396edd64f07c3582e01270b95bf99a903b846429eff0e9a75bcaa641a43f SSDeep: 24:TyhvIvYuoYsyBIO+7Q0lUWiep+JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdKX:TdzoYsyBdsQ0lUWJpgfi4eshyIK+HMB9 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url | 1.06 KB |
MD5:
0dcb55df1f6e1f873b07a4f1a11683e4
SHA1: 82a36fd3ab98595d8aa9943558073cbb627cbd90 SHA256: be5207caa64d23a51af2488f8e3e286b4b2d724d4c69036b46d01c5f30eb9a38 SSDeep: 24:vLNMUESuMuUoAJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfduQv:DNJuMuFWfi4eshyIK+HMBk3K6tzJfgm |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url | 1.06 KB |
MD5:
19f573fdbce5259106ba945ba72261f6
SHA1: 595b43be1c42a565927f935286934d1a581469ad SHA256: a20b2d0bbcc08635f4b500d0e6b088220fd65b8da883adafd1048d542b5cdbf9 SSDeep: 24:+egqys9HR8sJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdw:+eS0RRfi4eshyIK+HMBk3K6tzJfa |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url | 1.06 KB |
MD5:
06fe571b14b3ba1d5b9cd732fc0e9cd3
SHA1: 6f16801a15712177e94dc20f2ae2422e99d4df5c SHA256: 05de6ae2e523727b143ef2f81d4aff58efc310f24b191e5644337c9d56de139e SSDeep: 24:LTi8ChZXpqpEg2wO2JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdd/M0:LTH8Uqw1fi4eshyIK+HMBk3K6tzJfXM0 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url | 1.06 KB |
MD5:
4f5e31f098ee7775c2f7de99712cad0a
SHA1: 0dcc6525735081f597728f084fc68f9e9842c6f3 SHA256: 468a3470b8c3c37cc1b9a9d6f32f02ad22ff0abf08290e142b86991dee7c3118 SSDeep: 24:5Kkmiz1aeb30AJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd3K:5lmiZdhfi4eshyIK+HMBk3K6tzJf4 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url | 1.06 KB |
MD5:
ee270769edc1f66573601e6a8194911f
SHA1: 9e6083b06b35ba8024add86b062b2ac0290a685c SHA256: d567259c7d6fd046309e990baefb88ae9818720d1cbe2243a83865fbfdb4c860 SSDeep: 24:x9KIY12DyPcJmpSpJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdwM:jKIY1LOmSfi4eshyIK+HMBk3K6tzJfz |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url | 1.06 KB |
MD5:
a8177e89ae4214cc96215be5d56a4408
SHA1: 4b66e5a536a1013fb2241772cff2768d6d920d5e SHA256: dd7cef8c30f45441077e4da1a99cf9e6982d14d504d9dc3f92f61c6fea7a14e0 SSDeep: 24:5CRKBAUEwEJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdn/lsp:pEwifi4eshyIK+HMBk3K6tzJfR/lC |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url | 1.06 KB |
MD5:
df49d8774b7b2518614955feb78910fb
SHA1: c3c50b8425a3b823fdf55b733543f44ccc5b9c85 SHA256: 4f1a3a3e6a90a2e71ee10c3bed24b2c32767db70c2927cb4a7f951b251942d23 SSDeep: 24:uJ2nacuOnUQ1/PYnA/JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdN20f1:uJoacusUQ1onARfi4eshyIK+HMBk3K6T |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url | 1.06 KB |
MD5:
b9d9cf8bcb0879251d63d1d8b71d5d54
SHA1: c6631d4eb693a1c0ef0602de5d225baaefdb5572 SHA256: a15d4f8629a3de6a28c6678d6a63677a6876a1b02f2871043406c238295a1914 SSDeep: 24:9kR8W1GoJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdX:GRpfi4eshyIK+HMBk3K6tzJfJ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url | 1.06 KB |
MD5:
4c1e0dd50b8296305811991d4170f42c
SHA1: 3256805ad6d944cfe6df699b9f0772010e467320 SHA256: fafaa5a999eac8dab2803c70c4f336aa873a1cc7bb1834365316534f296ffd9f SSDeep: 24:R1PztU2ozOzRzppJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdQPb1:R1PahgRzBfi4eshyIK+HMBk3K6tzJfEJ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url | 1.06 KB |
MD5:
76a8dbd1f251fe88364db45d40c1db28
SHA1: 4b75bad016b776c6fb5d84df5a4394d85a68ad2e SHA256: be9e9c6a95a929f2c2d2c5ad998175da30d441ec5cb4968e4233e5790e54d67a SSDeep: 24:pWZpFtfKqJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdzN1S:gWUfi4eshyIK+HMBk3K6tzJfE |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url | 1.06 KB |
MD5:
e16c64b64b6d2487f5ee02fa69d82be5
SHA1: 616f027faf70ce4f0913ae2e0068846f1e14e4df SHA256: 24158312b1f080ba6abdd143ab789ada2bd80cfddf27bb0c5c86018967ab3edb SSDeep: 24:Noh6SLKPJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdnDQ:N1uKBfi4eshyIK+HMBk3K6tzJfNDQ |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url | 1.06 KB |
MD5:
e192fef6fd21a5411fd8f01a29ec0e21
SHA1: b2db90fd5c50c3414335b798b2b2fc6ca3d46790 SHA256: c6923e4627fb086ac20bd2130a6f2278664bfe5141abae3d53044ffbe948af2f SSDeep: 24:4DJz/2xFsa3zmQKJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfd9oY:4h/2Ps77fi4eshyIK+HMBk3K6tzJfD7 |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url | 1.06 KB |
MD5:
875555bf9a73393c42aa67fa45886336
SHA1: 7811afa065e2ae6ac8ecbb45825b21e708264350 SHA256: 95a76347f2e790e3d88e0515aa9d7a9be9ceffdfb248c39a83e9a7e4150a0e70 SSDeep: 24:I+FitjLR4KeOJ/JM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdR:BYjOKRfi4eshyIK+HMBk3K6tzJfj |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url | 1.06 KB |
MD5:
7045c1806540d6a9a92255efc036507a
SHA1: 05def72f0d527f296ab440fe25293845863ce139 SHA256: beab072963266cc22e8040deedc9676c3636c3948af2743f25024e0ab4f188c2 SSDeep: 24:Y0Bbjwc5/6OwJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdl0:RBb7/6Omfi4eshyIK+HMBk3K6tzJfA |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url | 1.06 KB |
MD5:
2c32dc1ba9dd1cd89ccb0d1e05bbc4bd
SHA1: 96227cb42d2e90d0616bb9f351ccc319aac6c8d4 SHA256: 4f919d901528954bd3ed05f890120a33f7096106693bb1b9f0554a10c0f2680a SSDeep: 24:KmNuK9fU82pJM+i4cJtmLxONmyIK+HZhoBkrLKRIMEzJfdejD:puK9czfi4eshyIK+HMBk3K6tzJfi |
|
|
Threads
Thread 0x4e0
15
0
| Category | Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Module | Get Filename | process_name = c:\users\5p5nrgjn0js halpmcxz\appdata\local\rlrgwq.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\rlrgwq.exe, size = 2048 |
|
1 | |
| Environment | Get Environment String | name = LOCALAPPDATA, result_out = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local |
|
1 | |
| Registry | Open Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce |
|
1 | |
| Registry | Read Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce, value_name = BrowserUpdateCheck, data = 77 |
|
1 | |
| Registry | Create Key | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce |
|
1 | |
| Registry | Write Value | reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce, value_name = BrowserUpdateCheck, data = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\rlrgwq.exe, size = 108, type = REG_SZ |
|
1 | |
| Environment | Get Environment String | name = public, result_out = C:\Users\Public |
|
1 | |
| File | Create | filename = C:\Users\Public\FE3523FAA45D11A890B51B95FAFBCEE159EA84E416AE3EBE497EE9F0BF90B688, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Read | filename = C:\Users\Public\FE3523FAA45D11A890B51B95FAFBCEE159EA84E416AE3EBE497EE9F0BF90B688, size = 256, size_out = 256 |
|
1 | |
| File | Read | filename = C:\Users\Public\FE3523FAA45D11A890B51B95FAFBCEE159EA84E416AE3EBE497EE9F0BF90B688, size = 768, size_out = 768 |
|
1 | |
| System | Sleep | duration = -1 (infinite) |
|
1 |
Thread 0x538
27339
0
| Category | Operation | Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| File | Create | filename = C:\bootmgr, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\hiberfil.sys, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\pagefile.sys, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\Default\NTUSER.DAT.LOG2, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\Default\AppData\Local\Temp\FXSAPIDebugLogFile.txt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm, type = size, size_out = 1552 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm, size = 1552, size_out = 1552 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm, size = 1552 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm, destination_filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab, type = size, size_out = 821681 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab, size = 911 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab, size = 821696, size_out = 821696 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab, size = 821696 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab, destination_filename = C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab, type = size, size_out = 5153816 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab, size = 5153816, size_out = 5153816 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab, size = 5153816 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab, destination_filename = C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\cab1.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\cab1.cab, type = size, size_out = 1034506 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\cab1.cab, size = 902 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\cab1.cab, size = 1034512, size_out = 1034512 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\cab1.cab, size = 1034512 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\cab1.cab, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\cab1.cab, destination_filename = C:\Users\All Users\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\cab1.cab.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\cab1.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\cab1.cab, type = size, size_out = 5588256 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 2621440, size_out = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 2621440 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 2621440, size_out = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\cab1.cab, destination_filename = C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\cab1.cab.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\cab1.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\cab1.cab, type = size, size_out = 1462871 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\cab1.cab, size = 905 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\cab1.cab, size = 1462880, size_out = 1462880 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\cab1.cab, size = 1462880 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\cab1.cab, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\cab1.cab, destination_filename = C:\Users\All Users\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\cab1.cab.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\cab1.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\cab1.cab, type = size, size_out = 5204382 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\cab1.cab, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\cab1.cab, size = 5204382, size_out = 5204382 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\cab1.cab, size = 5204382 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\cab1.cab, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\cab1.cab, destination_filename = C:\Users\All Users\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\cab1.cab.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\cab1.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\cab1.cab, type = size, size_out = 1292987 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\cab1.cab, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\cab1.cab, size = 1292987, size_out = 1292987 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\cab1.cab, size = 1292987 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\cab1.cab, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\cab1.cab, destination_filename = C:\Users\All Users\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\cab1.cab.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\state.rsm, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\state.rsm, type = size, size_out = 666 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\state.rsm, size = 902 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\state.rsm, size = 672, size_out = 672 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\state.rsm, size = 672 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\state.rsm, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\state.rsm, destination_filename = C:\Users\All Users\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\state.rsm.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\vcredist_x64.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab, type = size, size_out = 5800228 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 2621440, size_out = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 2621440 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 2621440, size_out = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab, destination_filename = C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm, type = size, size_out = 654 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm, size = 898 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm, size = 656, size_out = 656 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm, size = 656 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm, destination_filename = C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\cab1.cab, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\cab1.cab, type = size, size_out = 997054 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\cab1.cab, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\cab1.cab, size = 997054, size_out = 997054 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\cab1.cab, size = 997054 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\cab1.cab, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\cab1.cab, destination_filename = C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\cab1.cab.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu, type = size, size_out = 1034556 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu, size = 900 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu, size = 1034560, size_out = 1034560 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu, size = 1034560 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu, destination_filename = C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\Windows6.1-KB2999226-x64.msu, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\Windows6.1-KB2999226-x64.msu, type = size, size_out = 1012025 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\Windows6.1-KB2999226-x64.msu, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\Windows6.1-KB2999226-x64.msu, size = 1012025, size_out = 1012025 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\Windows6.1-KB2999226-x64.msu, size = 1012025 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\Windows6.1-KB2999226-x64.msu, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\Windows6.1-KB2999226-x64.msu, destination_filename = C:\Users\All Users\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\Windows6.1-KB2999226-x64.msu.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Mozilla\logs\maintenanceservice-install.log, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Mozilla\logs\maintenanceservice-install.log, type = size, size_out = 164 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Mozilla\logs\maintenanceservice-install.log, size = 908 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Mozilla\logs\maintenanceservice-install.log, size = 176, size_out = 176 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Mozilla\logs\maintenanceservice-install.log, size = 176 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Mozilla\logs\maintenanceservice-install.log, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Mozilla\logs\maintenanceservice-install.log, destination_filename = C:\Users\All Users\Mozilla\logs\maintenanceservice-install.log.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Mozilla\logs\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Mozilla\logs\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Mozilla\logs\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Mozilla\logs\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Mozilla\logs\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp, type = size, size_out = 251904 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp, size = 251904, size_out = 251904 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp, size = 251904 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp, destination_filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp, type = size, size_out = 17707008 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp, size = 2621440, size_out = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp, size = 2621440 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp, size = 2621440, size_out = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp, size = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp, destination_filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp, type = size, size_out = 17420288 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp, size = 2621440, size_out = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp, size = 2621440 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp, size = 2621440, size_out = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp, size = 2621440 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp, destination_filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Adobe\ARM\Reader_10.0.0\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Adobe\Acrobat\10.0\Replicate\Security\directories.acrodata, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Adobe\Acrobat\10.0\Replicate\Security\directories.acrodata, type = size, size_out = 479 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\Acrobat\10.0\Replicate\Security\directories.acrodata, size = 897 |
|
1 | |
| File | Read | filename = C:\Users\All Users\Adobe\Acrobat\10.0\Replicate\Security\directories.acrodata, size = 480, size_out = 480 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\Acrobat\10.0\Replicate\Security\directories.acrodata, size = 480 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\Acrobat\10.0\Replicate\Security\directories.acrodata, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\All Users\Adobe\Acrobat\10.0\Replicate\Security\directories.acrodata, destination_filename = C:\Users\All Users\Adobe\Acrobat\10.0\Replicate\Security\directories.acrodata.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\All Users\Adobe\Acrobat\10.0\Replicate\Security\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\All Users\Adobe\Acrobat\10.0\Replicate\Security\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\Acrobat\10.0\Replicate\Security\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\All Users\Adobe\Acrobat\10.0\Replicate\Security\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\All Users\Adobe\Acrobat\10.0\Replicate\Security\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.dat.LOG1, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.dat.LOG2, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.ini, type = size, size_out = 20 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.ini, size = 908 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.ini, size = 32, size_out = 32 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.ini, size = 32 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.ini, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-nUCOEGRczOsCz1Bo X.mkv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-nUCOEGRczOsCz1Bo X.mkv, type = size, size_out = 4038 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-nUCOEGRczOsCz1Bo X.mkv, size = 906 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-nUCOEGRczOsCz1Bo X.mkv, size = 4048, size_out = 4048 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-nUCOEGRczOsCz1Bo X.mkv, size = 4048 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-nUCOEGRczOsCz1Bo X.mkv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-nUCOEGRczOsCz1Bo X.mkv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-nUCOEGRczOsCz1Bo X.mkv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\2JSO83ouDCpS9bPG7Ae.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\2JSO83ouDCpS9bPG7Ae.swf, type = size, size_out = 24399 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\2JSO83ouDCpS9bPG7Ae.swf, size = 897 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\2JSO83ouDCpS9bPG7Ae.swf, size = 24400, size_out = 24400 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\2JSO83ouDCpS9bPG7Ae.swf, size = 24400 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\2JSO83ouDCpS9bPG7Ae.swf, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\2JSO83ouDCpS9bPG7Ae.swf, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\2JSO83ouDCpS9bPG7Ae.swf.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\50go8cizDba.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\50go8cizDba.swf, type = size, size_out = 46222 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\50go8cizDba.swf, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\50go8cizDba.swf, size = 46222, size_out = 46222 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\50go8cizDba.swf, size = 46222 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\50go8cizDba.swf, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\50go8cizDba.swf, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\50go8cizDba.swf.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\66W7GLZlR67bh47tKngc.mkv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\66W7GLZlR67bh47tKngc.mkv, type = size, size_out = 24560 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\66W7GLZlR67bh47tKngc.mkv, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\66W7GLZlR67bh47tKngc.mkv, size = 24560, size_out = 24560 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\66W7GLZlR67bh47tKngc.mkv, size = 24560 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\66W7GLZlR67bh47tKngc.mkv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\66W7GLZlR67bh47tKngc.mkv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\66W7GLZlR67bh47tKngc.mkv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\7VBXl.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\7VBXl.flv, type = size, size_out = 5431 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\7VBXl.flv, size = 905 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\7VBXl.flv, size = 5440, size_out = 5440 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\7VBXl.flv, size = 5440 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\7VBXl.flv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\7VBXl.flv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\7VBXl.flv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aE9jV.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aE9jV.flv, type = size, size_out = 102193 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aE9jV.flv, size = 911 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aE9jV.flv, size = 102208, size_out = 102208 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aE9jV.flv, size = 102208 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aE9jV.flv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aE9jV.flv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aE9jV.flv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aNUUlrT.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aNUUlrT.flv, type = size, size_out = 101808 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aNUUlrT.flv, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aNUUlrT.flv, size = 101808, size_out = 101808 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aNUUlrT.flv, size = 101808 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aNUUlrT.flv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aNUUlrT.flv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\aNUUlrT.flv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bCh a1QCSk8UxYc9ccf.mp4, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bCh a1QCSk8UxYc9ccf.mp4, type = size, size_out = 10398 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bCh a1QCSk8UxYc9ccf.mp4, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bCh a1QCSk8UxYc9ccf.mp4, size = 10398, size_out = 10398 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bCh a1QCSk8UxYc9ccf.mp4, size = 10398 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bCh a1QCSk8UxYc9ccf.mp4, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bCh a1QCSk8UxYc9ccf.mp4, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bCh a1QCSk8UxYc9ccf.mp4.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bKiC9mt1u.mp4, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bKiC9mt1u.mp4, type = size, size_out = 31486 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bKiC9mt1u.mp4, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bKiC9mt1u.mp4, size = 31486, size_out = 31486 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bKiC9mt1u.mp4, size = 31486 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bKiC9mt1u.mp4, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bKiC9mt1u.mp4, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\bKiC9mt1u.mp4.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cjtMDRiyTAFaUZKrh1q3.avi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cjtMDRiyTAFaUZKrh1q3.avi, type = size, size_out = 53763 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cjtMDRiyTAFaUZKrh1q3.avi, size = 909 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cjtMDRiyTAFaUZKrh1q3.avi, size = 53776, size_out = 53776 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cjtMDRiyTAFaUZKrh1q3.avi, size = 53776 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cjtMDRiyTAFaUZKrh1q3.avi, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cjtMDRiyTAFaUZKrh1q3.avi, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\cjtMDRiyTAFaUZKrh1q3.avi.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D a9i.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D a9i.flv, type = size, size_out = 48247 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D a9i.flv, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D a9i.flv, size = 48247, size_out = 48247 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D a9i.flv, size = 48247 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D a9i.flv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D a9i.flv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\D a9i.flv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini, type = size, size_out = 504 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini, size = 904 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini, size = 512, size_out = 512 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini, size = 512 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\euiHA5JNEZO0QAE38V.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\euiHA5JNEZO0QAE38V.swf, type = size, size_out = 62293 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\euiHA5JNEZO0QAE38V.swf, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\euiHA5JNEZO0QAE38V.swf, size = 62293, size_out = 62293 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\euiHA5JNEZO0QAE38V.swf, size = 62293 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\euiHA5JNEZO0QAE38V.swf, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\euiHA5JNEZO0QAE38V.swf, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\euiHA5JNEZO0QAE38V.swf.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\FvB8YVtqFect_Vs.avi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\FvB8YVtqFect_Vs.avi, type = size, size_out = 84134 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\FvB8YVtqFect_Vs.avi, size = 906 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\FvB8YVtqFect_Vs.avi, size = 84144, size_out = 84144 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\FvB8YVtqFect_Vs.avi, size = 84144 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\FvB8YVtqFect_Vs.avi, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\FvB8YVtqFect_Vs.avi, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\FvB8YVtqFect_Vs.avi.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\fW_z.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\fW_z.flv, type = size, size_out = 94874 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\fW_z.flv, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\fW_z.flv, size = 94874, size_out = 94874 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\fW_z.flv, size = 94874 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\fW_z.flv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\fW_z.flv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\fW_z.flv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gLR9Tkk6Ry-em-K.mkv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gLR9Tkk6Ry-em-K.mkv, type = size, size_out = 17361 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gLR9Tkk6Ry-em-K.mkv, size = 911 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gLR9Tkk6Ry-em-K.mkv, size = 17376, size_out = 17376 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gLR9Tkk6Ry-em-K.mkv, size = 17376 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gLR9Tkk6Ry-em-K.mkv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gLR9Tkk6Ry-em-K.mkv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gLR9Tkk6Ry-em-K.mkv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gsMoEjHN.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gsMoEjHN.flv, type = size, size_out = 41616 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gsMoEjHN.flv, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gsMoEjHN.flv, size = 41616, size_out = 41616 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gsMoEjHN.flv, size = 41616 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gsMoEjHN.flv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gsMoEjHN.flv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gsMoEjHN.flv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hbHSG0BJ.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hbHSG0BJ.flv, type = size, size_out = 34993 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hbHSG0BJ.flv, size = 911 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hbHSG0BJ.flv, size = 35008, size_out = 35008 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hbHSG0BJ.flv, size = 35008 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hbHSG0BJ.flv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hbHSG0BJ.flv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hbHSG0BJ.flv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hFuOplmGpA.mp4, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hFuOplmGpA.mp4, type = size, size_out = 22896 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hFuOplmGpA.mp4, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hFuOplmGpA.mp4, size = 22896, size_out = 22896 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hFuOplmGpA.mp4, size = 22896 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hFuOplmGpA.mp4, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hFuOplmGpA.mp4, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hFuOplmGpA.mp4.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\j3lS-CX.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\j3lS-CX.swf, type = size, size_out = 42485 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\j3lS-CX.swf, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\j3lS-CX.swf, size = 42485, size_out = 42485 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\j3lS-CX.swf, size = 42485 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\j3lS-CX.swf, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\j3lS-CX.swf, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\j3lS-CX.swf.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\jPsYR8ZZ2L.mkv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\jPsYR8ZZ2L.mkv, type = size, size_out = 79584 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\jPsYR8ZZ2L.mkv, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\jPsYR8ZZ2L.mkv, size = 79584, size_out = 79584 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\jPsYR8ZZ2L.mkv, size = 79584 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\jPsYR8ZZ2L.mkv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\jPsYR8ZZ2L.mkv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\jPsYR8ZZ2L.mkv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Kgv66V0yUi.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Kgv66V0yUi.flv, type = size, size_out = 102021 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Kgv66V0yUi.flv, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Kgv66V0yUi.flv, size = 102032, size_out = 102032 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Kgv66V0yUi.flv, size = 102032 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Kgv66V0yUi.flv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Kgv66V0yUi.flv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Kgv66V0yUi.flv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\L9mu6tuR8QFKGNd.mkv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\L9mu6tuR8QFKGNd.mkv, type = size, size_out = 9383 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\L9mu6tuR8QFKGNd.mkv, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\L9mu6tuR8QFKGNd.mkv, size = 9383, size_out = 9383 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\L9mu6tuR8QFKGNd.mkv, size = 9383 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\L9mu6tuR8QFKGNd.mkv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\L9mu6tuR8QFKGNd.mkv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\L9mu6tuR8QFKGNd.mkv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lNQJ.mp4, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lNQJ.mp4, type = size, size_out = 92296 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lNQJ.mp4, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lNQJ.mp4, size = 92296, size_out = 92296 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lNQJ.mp4, size = 92296 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lNQJ.mp4, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lNQJ.mp4, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lNQJ.mp4.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lujYR96ua7eRgBXkLlG.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lujYR96ua7eRgBXkLlG.flv, type = size, size_out = 33981 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lujYR96ua7eRgBXkLlG.flv, size = 899 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lujYR96ua7eRgBXkLlG.flv, size = 33984, size_out = 33984 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lujYR96ua7eRgBXkLlG.flv, size = 33984 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lujYR96ua7eRgBXkLlG.flv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lujYR96ua7eRgBXkLlG.flv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\lujYR96ua7eRgBXkLlG.flv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\m sf.mkv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\m sf.mkv, type = size, size_out = 58483 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\m sf.mkv, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\m sf.mkv, size = 58483, size_out = 58483 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\m sf.mkv, size = 58483 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\m sf.mkv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\m sf.mkv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\m sf.mkv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\mcMXbxYj93Ssek.mp4, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\mcMXbxYj93Ssek.mp4, type = size, size_out = 7562 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\mcMXbxYj93Ssek.mp4, size = 902 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\mcMXbxYj93Ssek.mp4, size = 7568, size_out = 7568 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\mcMXbxYj93Ssek.mp4, size = 7568 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\mcMXbxYj93Ssek.mp4, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\mcMXbxYj93Ssek.mp4, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\mcMXbxYj93Ssek.mp4.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\NjUcM5pMiJ9V4WxAll6.avi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\NjUcM5pMiJ9V4WxAll6.avi, type = size, size_out = 28903 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\NjUcM5pMiJ9V4WxAll6.avi, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\NjUcM5pMiJ9V4WxAll6.avi, size = 28903, size_out = 28903 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\NjUcM5pMiJ9V4WxAll6.avi, size = 28903 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\NjUcM5pMiJ9V4WxAll6.avi, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\NjUcM5pMiJ9V4WxAll6.avi, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\NjUcM5pMiJ9V4WxAll6.avi.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\nN83yzk3cXA.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\nN83yzk3cXA.swf, type = size, size_out = 15088 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\nN83yzk3cXA.swf, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\nN83yzk3cXA.swf, size = 15088, size_out = 15088 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\nN83yzk3cXA.swf, size = 15088 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\nN83yzk3cXA.swf, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\nN83yzk3cXA.swf, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\nN83yzk3cXA.swf.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\q274Jlys8 3Y.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\q274Jlys8 3Y.swf, type = size, size_out = 33128 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\q274Jlys8 3Y.swf, size = 904 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\q274Jlys8 3Y.swf, size = 33136, size_out = 33136 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\q274Jlys8 3Y.swf, size = 33136 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\q274Jlys8 3Y.swf, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\q274Jlys8 3Y.swf, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\q274Jlys8 3Y.swf.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\r62Y9.mkv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\r62Y9.mkv, type = size, size_out = 11073 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\r62Y9.mkv, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\r62Y9.mkv, size = 11073, size_out = 11073 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\r62Y9.mkv, size = 11073 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\r62Y9.mkv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\r62Y9.mkv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\r62Y9.mkv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\rbPFWos6idXHH.avi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\rbPFWos6idXHH.avi, type = size, size_out = 2885 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\rbPFWos6idXHH.avi, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\rbPFWos6idXHH.avi, size = 2896, size_out = 2896 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\rbPFWos6idXHH.avi, size = 2896 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\rbPFWos6idXHH.avi, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\rbPFWos6idXHH.avi, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\rbPFWos6idXHH.avi.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\SrmDFbFK3gj.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\SrmDFbFK3gj.swf, type = size, size_out = 61408 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\SrmDFbFK3gj.swf, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\SrmDFbFK3gj.swf, size = 61408, size_out = 61408 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\SrmDFbFK3gj.swf, size = 61408 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\SrmDFbFK3gj.swf, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\SrmDFbFK3gj.swf, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\SrmDFbFK3gj.swf.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\TsPuu1 1sMP.mp4, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\TsPuu1 1sMP.mp4, type = size, size_out = 9341 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\TsPuu1 1sMP.mp4, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\TsPuu1 1sMP.mp4, size = 9341, size_out = 9341 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\TsPuu1 1sMP.mp4, size = 9341 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\TsPuu1 1sMP.mp4, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\TsPuu1 1sMP.mp4, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\TsPuu1 1sMP.mp4.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\VIz1GRR.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\VIz1GRR.swf, type = size, size_out = 44116 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\VIz1GRR.swf, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\VIz1GRR.swf, size = 44116, size_out = 44116 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\VIz1GRR.swf, size = 44116 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\VIz1GRR.swf, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\VIz1GRR.swf, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\VIz1GRR.swf.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WGsPO0aBRCLEqnQH53ju.mkv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WGsPO0aBRCLEqnQH53ju.mkv, type = size, size_out = 11334 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WGsPO0aBRCLEqnQH53ju.mkv, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WGsPO0aBRCLEqnQH53ju.mkv, size = 11334, size_out = 11334 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WGsPO0aBRCLEqnQH53ju.mkv, size = 11334 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WGsPO0aBRCLEqnQH53ju.mkv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WGsPO0aBRCLEqnQH53ju.mkv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WGsPO0aBRCLEqnQH53ju.mkv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WQjxjaZ4Wor.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WQjxjaZ4Wor.flv, type = size, size_out = 54740 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WQjxjaZ4Wor.flv, size = 908 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WQjxjaZ4Wor.flv, size = 54752, size_out = 54752 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WQjxjaZ4Wor.flv, size = 54752 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WQjxjaZ4Wor.flv, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WQjxjaZ4Wor.flv, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\WQjxjaZ4Wor.flv.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxQZQRTiEQb.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxQZQRTiEQb.swf, type = size, size_out = 13585 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxQZQRTiEQb.swf, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxQZQRTiEQb.swf, size = 13585, size_out = 13585 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxQZQRTiEQb.swf, size = 13585 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxQZQRTiEQb.swf, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxQZQRTiEQb.swf, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\wxQZQRTiEQb.swf.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ybtQ4TGZHLJZLR.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ybtQ4TGZHLJZLR.swf, type = size, size_out = 49682 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ybtQ4TGZHLJZLR.swf, size = 910 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ybtQ4TGZHLJZLR.swf, size = 49696, size_out = 49696 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ybtQ4TGZHLJZLR.swf, size = 49696 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ybtQ4TGZHLJZLR.swf, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ybtQ4TGZHLJZLR.swf, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ybtQ4TGZHLJZLR.swf.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\z5HdOvqGy8Yj.mp4, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\z5HdOvqGy8Yj.mp4, type = size, size_out = 61980 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\z5HdOvqGy8Yj.mp4, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\z5HdOvqGy8Yj.mp4, size = 61980, size_out = 61980 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\z5HdOvqGy8Yj.mp4, size = 61980 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\z5HdOvqGy8Yj.mp4, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\z5HdOvqGy8Yj.mp4, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\z5HdOvqGy8Yj.mp4.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_abCHe-XTb.avi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_abCHe-XTb.avi, type = size, size_out = 4999 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_abCHe-XTb.avi, size = 905 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_abCHe-XTb.avi, size = 5008, size_out = 5008 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_abCHe-XTb.avi, size = 5008 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_abCHe-XTb.avi, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_abCHe-XTb.avi, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\_abCHe-XTb.avi.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Videos\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini, type = size, size_out = 524 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini, size = 900 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini, size = 528, size_out = 528 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini, size = 528 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms, type = size, size_out = 248 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms, size = 904 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms, size = 256, size_out = 256 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms, size = 256 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms, type = size, size_out = 248 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms, size = 904 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms, size = 256, size_out = 256 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms, size = 256 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Searches\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini, type = size, size_out = 282 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini, size = 902 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini, size = 288, size_out = 288 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini, size = 288 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\2zE5wO.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\2zE5wO.png, type = size, size_out = 88110 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\2zE5wO.png, size = 898 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\2zE5wO.png, size = 88112, size_out = 88112 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\2zE5wO.png, size = 88112 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\2zE5wO.png, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\2zE5wO.png, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\2zE5wO.png.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\BDZVG7.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\BDZVG7.jpg, type = size, size_out = 2081 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\BDZVG7.jpg, size = 911 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\BDZVG7.jpg, size = 2096, size_out = 2096 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\BDZVG7.jpg, size = 2096 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\BDZVG7.jpg, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\BDZVG7.jpg, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\BDZVG7.jpg.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini, type = size, size_out = 504 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini, size = 904 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini, size = 512, size_out = 512 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini, size = 512 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EhFf.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EhFf.jpg, type = size, size_out = 77028 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EhFf.jpg, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EhFf.jpg, size = 77028, size_out = 77028 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EhFf.jpg, size = 77028 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EhFf.jpg, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EhFf.jpg, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\EhFf.jpg.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IFD1vl1FyXPwvpwAWHo.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IFD1vl1FyXPwvpwAWHo.gif, type = size, size_out = 3918 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IFD1vl1FyXPwvpwAWHo.gif, size = 898 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IFD1vl1FyXPwvpwAWHo.gif, size = 3920, size_out = 3920 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IFD1vl1FyXPwvpwAWHo.gif, size = 3920 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IFD1vl1FyXPwvpwAWHo.gif, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IFD1vl1FyXPwvpwAWHo.gif, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\IFD1vl1FyXPwvpwAWHo.gif.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\nj9WTrBqdjX.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\nj9WTrBqdjX.png, type = size, size_out = 78651 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\nj9WTrBqdjX.png, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\nj9WTrBqdjX.png, size = 78651, size_out = 78651 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\nj9WTrBqdjX.png, size = 78651 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\nj9WTrBqdjX.png, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\nj9WTrBqdjX.png, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\nj9WTrBqdjX.png.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QpjBoBaddhja0bGiYTni.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QpjBoBaddhja0bGiYTni.bmp, type = size, size_out = 36098 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QpjBoBaddhja0bGiYTni.bmp, size = 910 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QpjBoBaddhja0bGiYTni.bmp, size = 36112, size_out = 36112 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QpjBoBaddhja0bGiYTni.bmp, size = 36112 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QpjBoBaddhja0bGiYTni.bmp, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QpjBoBaddhja0bGiYTni.bmp, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QpjBoBaddhja0bGiYTni.bmp.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\VjwflUU3g7Ux_MGZXe.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\VjwflUU3g7Ux_MGZXe.png, type = size, size_out = 96547 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\VjwflUU3g7Ux_MGZXe.png, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\VjwflUU3g7Ux_MGZXe.png, size = 96547, size_out = 96547 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\VjwflUU3g7Ux_MGZXe.png, size = 96547 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\VjwflUU3g7Ux_MGZXe.png, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\VjwflUU3g7Ux_MGZXe.png, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\VjwflUU3g7Ux_MGZXe.png.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\1Xosf.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\1Xosf.png, type = size, size_out = 16877 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\1Xosf.png, size = 899 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\1Xosf.png, size = 16880, size_out = 16880 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\1Xosf.png, size = 16880 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\1Xosf.png, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\1Xosf.png, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\1Xosf.png.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\A7GFfwu-bHqk.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\A7GFfwu-bHqk.gif, type = size, size_out = 23791 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\A7GFfwu-bHqk.gif, size = 897 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\A7GFfwu-bHqk.gif, size = 23792, size_out = 23792 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\A7GFfwu-bHqk.gif, size = 23792 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\A7GFfwu-bHqk.gif, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\A7GFfwu-bHqk.gif, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\A7GFfwu-bHqk.gif.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\PMIlhquoGP0fFB.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\PMIlhquoGP0fFB.bmp, type = size, size_out = 83333 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\PMIlhquoGP0fFB.bmp, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\PMIlhquoGP0fFB.bmp, size = 83344, size_out = 83344 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\PMIlhquoGP0fFB.bmp, size = 83344 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\PMIlhquoGP0fFB.bmp, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\PMIlhquoGP0fFB.bmp, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\PMIlhquoGP0fFB.bmp.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\SR4T2D.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\SR4T2D.gif, type = size, size_out = 77978 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\SR4T2D.gif, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\SR4T2D.gif, size = 77978, size_out = 77978 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\SR4T2D.gif, size = 77978 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\SR4T2D.gif, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\SR4T2D.gif, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\SR4T2D.gif.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\UFJJRn0k\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\41E2vjn.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\41E2vjn.gif, type = size, size_out = 29939 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\41E2vjn.gif, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\41E2vjn.gif, size = 29939, size_out = 29939 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\41E2vjn.gif, size = 29939 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\41E2vjn.gif, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\41E2vjn.gif, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\41E2vjn.gif.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\aRbWVQ1PBmsE9IYNLeTd.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\aRbWVQ1PBmsE9IYNLeTd.jpg, type = size, size_out = 42617 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\aRbWVQ1PBmsE9IYNLeTd.jpg, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\aRbWVQ1PBmsE9IYNLeTd.jpg, size = 42617, size_out = 42617 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\aRbWVQ1PBmsE9IYNLeTd.jpg, size = 42617 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\aRbWVQ1PBmsE9IYNLeTd.jpg, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\aRbWVQ1PBmsE9IYNLeTd.jpg, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\aRbWVQ1PBmsE9IYNLeTd.jpg.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\gkJs4OV85o2x.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\gkJs4OV85o2x.jpg, type = size, size_out = 47038 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\gkJs4OV85o2x.jpg, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\gkJs4OV85o2x.jpg, size = 47038, size_out = 47038 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\gkJs4OV85o2x.jpg, size = 47038 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\gkJs4OV85o2x.jpg, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\gkJs4OV85o2x.jpg, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\gkJs4OV85o2x.jpg.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\tUKrVvos3DRk_t_A.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\tUKrVvos3DRk_t_A.gif, type = size, size_out = 31947 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\tUKrVvos3DRk_t_A.gif, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\tUKrVvos3DRk_t_A.gif, size = 31947, size_out = 31947 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\tUKrVvos3DRk_t_A.gif, size = 31947 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\tUKrVvos3DRk_t_A.gif, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\tUKrVvos3DRk_t_A.gif, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\tUKrVvos3DRk_t_A.gif.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\36x28XoZYsLFWANK5kq.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\36x28XoZYsLFWANK5kq.gif, type = size, size_out = 7503 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\36x28XoZYsLFWANK5kq.gif, size = 897 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\36x28XoZYsLFWANK5kq.gif, size = 7504, size_out = 7504 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\36x28XoZYsLFWANK5kq.gif, size = 7504 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\36x28XoZYsLFWANK5kq.gif, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\36x28XoZYsLFWANK5kq.gif, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\36x28XoZYsLFWANK5kq.gif.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\3OPw.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\3OPw.jpg, type = size, size_out = 36806 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\3OPw.jpg, size = 906 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\3OPw.jpg, size = 36816, size_out = 36816 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\3OPw.jpg, size = 36816 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\3OPw.jpg, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\3OPw.jpg, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\3OPw.jpg.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\dvMivKCGj1eWR6n.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\dvMivKCGj1eWR6n.png, type = size, size_out = 48994 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\dvMivKCGj1eWR6n.png, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\dvMivKCGj1eWR6n.png, size = 48994, size_out = 48994 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\dvMivKCGj1eWR6n.png, size = 48994 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\dvMivKCGj1eWR6n.png, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\dvMivKCGj1eWR6n.png, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\dvMivKCGj1eWR6n.png.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\gyETZxq38xJdGPTIu.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\gyETZxq38xJdGPTIu.bmp, type = size, size_out = 36731 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\gyETZxq38xJdGPTIu.bmp, size = 901 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\gyETZxq38xJdGPTIu.bmp, size = 36736, size_out = 36736 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\gyETZxq38xJdGPTIu.bmp, size = 36736 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\gyETZxq38xJdGPTIu.bmp, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\gyETZxq38xJdGPTIu.bmp, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\gyETZxq38xJdGPTIu.bmp.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YtuNE0kSPzu.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YtuNE0kSPzu.gif, type = size, size_out = 28284 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YtuNE0kSPzu.gif, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YtuNE0kSPzu.gif, size = 28284, size_out = 28284 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YtuNE0kSPzu.gif, size = 28284 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YtuNE0kSPzu.gif, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YtuNE0kSPzu.gif, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YtuNE0kSPzu.gif.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YW5vf.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YW5vf.bmp, type = size, size_out = 24751 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YW5vf.bmp, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YW5vf.bmp, size = 24751, size_out = 24751 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YW5vf.bmp, size = 24751 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YW5vf.bmp, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YW5vf.bmp, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\YW5vf.bmp.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\_a2Pd.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\_a2Pd.bmp, type = size, size_out = 86788 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\_a2Pd.bmp, size = 908 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\_a2Pd.bmp, size = 86800, size_out = 86800 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\_a2Pd.bmp, size = 86800 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\_a2Pd.bmp, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\_a2Pd.bmp, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\_a2Pd.bmp.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\nnMWrS U4i\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\9WmhgBFveH0j.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\9WmhgBFveH0j.bmp, type = size, size_out = 95832 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\9WmhgBFveH0j.bmp, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\9WmhgBFveH0j.bmp, size = 95832, size_out = 95832 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\9WmhgBFveH0j.bmp, size = 95832 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\9WmhgBFveH0j.bmp, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\9WmhgBFveH0j.bmp, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\9WmhgBFveH0j.bmp.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\e-v2NjwnasaQ6et0ja.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\e-v2NjwnasaQ6et0ja.png, type = size, size_out = 34160 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\e-v2NjwnasaQ6et0ja.png, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\e-v2NjwnasaQ6et0ja.png, size = 34160, size_out = 34160 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\e-v2NjwnasaQ6et0ja.png, size = 34160 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\e-v2NjwnasaQ6et0ja.png, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\e-v2NjwnasaQ6et0ja.png, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\e-v2NjwnasaQ6et0ja.png.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\l5pUiiym.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\l5pUiiym.png, type = size, size_out = 8225 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\l5pUiiym.png, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\l5pUiiym.png, size = 8225, size_out = 8225 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\l5pUiiym.png, size = 8225 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\l5pUiiym.png, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\l5pUiiym.png, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\l5pUiiym.png.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\RCWZBzZRK7zkjlX.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\RCWZBzZRK7zkjlX.bmp, type = size, size_out = 43887 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\RCWZBzZRK7zkjlX.bmp, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\RCWZBzZRK7zkjlX.bmp, size = 43887, size_out = 43887 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\RCWZBzZRK7zkjlX.bmp, size = 43887 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\RCWZBzZRK7zkjlX.bmp, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\RCWZBzZRK7zkjlX.bmp, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\RCWZBzZRK7zkjlX.bmp.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\vcSPsVx.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\vcSPsVx.png, type = size, size_out = 16629 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\vcSPsVx.png, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\vcSPsVx.png, size = 16640, size_out = 16640 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\vcSPsVx.png, size = 16640 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\vcSPsVx.png, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\vcSPsVx.png, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\vcSPsVx.png.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\eN7rj f9Axc-\5TGuMy\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\AkpFL-oB-3Fu6pJr1qI.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\AkpFL-oB-3Fu6pJr1qI.bmp, type = size, size_out = 28731 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\AkpFL-oB-3Fu6pJr1qI.bmp, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\AkpFL-oB-3Fu6pJr1qI.bmp, size = 28731, size_out = 28731 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\AkpFL-oB-3Fu6pJr1qI.bmp, size = 28731 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\AkpFL-oB-3Fu6pJr1qI.bmp, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\AkpFL-oB-3Fu6pJr1qI.bmp, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\AkpFL-oB-3Fu6pJr1qI.bmp.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\FB6F-yt_lW0.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\FB6F-yt_lW0.png, type = size, size_out = 93308 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\FB6F-yt_lW0.png, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\FB6F-yt_lW0.png, size = 93308, size_out = 93308 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\FB6F-yt_lW0.png, size = 93308 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\FB6F-yt_lW0.png, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\FB6F-yt_lW0.png, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\FB6F-yt_lW0.png.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\SCfWk5F.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\SCfWk5F.jpg, type = size, size_out = 27250 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\SCfWk5F.jpg, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\SCfWk5F.jpg, size = 27250, size_out = 27250 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\SCfWk5F.jpg, size = 27250 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\SCfWk5F.jpg, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\SCfWk5F.jpg, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\SCfWk5F.jpg.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\zlMPu11Z9j872BhKsufL.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\zlMPu11Z9j872BhKsufL.gif, type = size, size_out = 96480 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\zlMPu11Z9j872BhKsufL.gif, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\zlMPu11Z9j872BhKsufL.gif, size = 96480, size_out = 96480 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\zlMPu11Z9j872BhKsufL.gif, size = 96480 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\zlMPu11Z9j872BhKsufL.gif, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\zlMPu11Z9j872BhKsufL.gif, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\zlMPu11Z9j872BhKsufL.gif.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c487skGxP 7\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\2qTC0a5scT73Y.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\2qTC0a5scT73Y.png, type = size, size_out = 79885 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\2qTC0a5scT73Y.png, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\2qTC0a5scT73Y.png, size = 79885, size_out = 79885 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\2qTC0a5scT73Y.png, size = 79885 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\2qTC0a5scT73Y.png, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\2qTC0a5scT73Y.png, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\2qTC0a5scT73Y.png.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\F3WWwsmu0xGK1DZvtX.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\F3WWwsmu0xGK1DZvtX.bmp, type = size, size_out = 73778 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\F3WWwsmu0xGK1DZvtX.bmp, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\F3WWwsmu0xGK1DZvtX.bmp, size = 73778, size_out = 73778 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\F3WWwsmu0xGK1DZvtX.bmp, size = 73778 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\F3WWwsmu0xGK1DZvtX.bmp, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\F3WWwsmu0xGK1DZvtX.bmp, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\F3WWwsmu0xGK1DZvtX.bmp.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\43u7_iaqBP2Qf3sI\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\2WhK0Jp9M.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\2WhK0Jp9M.mp3, type = size, size_out = 6554 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\2WhK0Jp9M.mp3, size = 902 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\2WhK0Jp9M.mp3, size = 6560, size_out = 6560 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\2WhK0Jp9M.mp3, size = 6560 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\2WhK0Jp9M.mp3, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\2WhK0Jp9M.mp3, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\2WhK0Jp9M.mp3.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\#NEW_WAVE.html, desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\#NEW_WAVE.html, size = 16 |
|
123 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\#NEW_WAVE.html, size = 768 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\#NEW_WAVE.html, size = 16 |
|
110 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\bF-Gyp.wav, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\bF-Gyp.wav, type = size, size_out = 59122 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\bF-Gyp.wav, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\bF-Gyp.wav, size = 59122, size_out = 59122 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\bF-Gyp.wav, size = 59122 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\bF-Gyp.wav, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\bF-Gyp.wav, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\bF-Gyp.wav.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BFLFCvjmAT.wav, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BFLFCvjmAT.wav, type = size, size_out = 90726 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BFLFCvjmAT.wav, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BFLFCvjmAT.wav, size = 90726, size_out = 90726 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BFLFCvjmAT.wav, size = 90726 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BFLFCvjmAT.wav, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BFLFCvjmAT.wav, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BFLFCvjmAT.wav.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BSkWNi7 iI.m4a, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BSkWNi7 iI.m4a, type = size, size_out = 33110 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BSkWNi7 iI.m4a, size = 906 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BSkWNi7 iI.m4a, size = 33120, size_out = 33120 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BSkWNi7 iI.m4a, size = 33120 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BSkWNi7 iI.m4a, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BSkWNi7 iI.m4a, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\BSkWNi7 iI.m4a.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini, type = size, size_out = 504 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini, size = 904 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini, size = 512, size_out = 512 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini, size = 512 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\F_2s6FlTtFUdW9.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\F_2s6FlTtFUdW9.mp3, type = size, size_out = 76589 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\F_2s6FlTtFUdW9.mp3, size = 896 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\F_2s6FlTtFUdW9.mp3, size = 76589, size_out = 76589 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\F_2s6FlTtFUdW9.mp3, size = 76589 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\F_2s6FlTtFUdW9.mp3, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\F_2s6FlTtFUdW9.mp3, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\F_2s6FlTtFUdW9.mp3.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\g1P_VcvnB.wav, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\g1P_VcvnB.wav, type = size, size_out = 101557 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\g1P_VcvnB.wav, size = 907 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\g1P_VcvnB.wav, size = 101568, size_out = 101568 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\g1P_VcvnB.wav, size = 101568 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\g1P_VcvnB.wav, size = 48 |
|
1 | |
| File | Move | source_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\g1P_VcvnB.wav, destination_filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\g1P_VcvnB.wav.[new_wave@tuta.io].LotR, flags = MOVEFILE_REPLACE_EXISTING |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\#NEW_WAVE.html, type = file_attributes |
|
1 | |
| File | Create | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\J56Jpm_V0AAsmT.wav, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_FLAG_WRITE_THROUGH |
|
1 | |
| File | Get Info | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\J56Jpm_V0AAsmT.wav, type = size, size_out = 5656 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\J56Jpm_V0AAsmT.wav, size = 904 |
|
1 | |
| File | Read | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\J56Jpm_V0AAsmT.wav, size = 5664, size_out = 5664 |
|
1 | |
| File | Write | filename = C:\Users\5p5NrGJn0jS HALPmcxz\Music\J56Jpm_V0AAsmT.wav, size = 5664 |
|
1 | |
|
For performance reasons, the remaining 7254 entries are omitted.
The remaining entries can be found in glog.xml. |
|||||
