shaofao.exe
Windows Exe (x86-32)
Created at 2019-05-28T18:57:00
Remarks (2/2)
(0x200000e): The overall sleep time of all monitored processes was truncated from "1 minute" to "10 seconds" to reveal dormant functionality.
Monitored Processes
Behavior Information - Grouped by Category
Process #1: shaofao.exe
5161
0
| Information | Value |
|---|---|
| ID | #1 |
| File Name | c:\users\fd1hvy\desktop\shaofao.exe |
| Command Line | "C:\Users\FD1HVy\Desktop\shaofao.exe" |
| Initial Working Directory | C:\Users\FD1HVy\Desktop\ |
| Monitor | Start Time: 00:00:37, Reason: Analysis Target |
| Unmonitor | End Time: 00:04:05, Reason: Terminated by Timeout |
| Monitor Duration | 00:03:28 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xdb0 |
| Parent PID | 0x860 (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
DA4
0x
CA0
0x
F6C
0x
F94
0x
E5C
0x
384
0x
F78
0x
F8C
0x
F70
0x
754
0x
9E8
0x
37C
0x
F90
0x
7B4
0x
49C
0x
FB4
0x
8AC
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| shaofao.exe | 0x00980000 | 0x00995FFF | Relevant Image | - | 32-bit | - |
|
|
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| C:\Users\FD1HVy\Desktop\shaofao.exe | 71.00 KB |
MD5:
7de40ec678584a92ddeecb01764be5fc
SHA1: e4cc3aec8bd71c8225348ac8a0e1d951662520b0 SHA256: cb82fabfd6229fecaec9af902aab091cf1431e529f625a416424c383e993afd9 SSDeep: 1536:5kGB8nHbKUvryElSpi8jCZGcqDKlKnr8dMXlnQGFD2co:5FBMHRvrAjCZmKcnr86QG9/o |
|
|
| \\?\C:\588bce7c90097ed212\1030\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.10 KB |
MD5:
43f2f4c83fbe5ce4a4bb3ac8c9c605f3
SHA1: e24e551d891793517edc7784d045eea71f034d9c SHA256: cb6b51f14523f4b38072587180ad18989eef1083d37eff0c8ec0d0d545e74a68 SSDeep: 384:lMSHW4IxNN2N+/l+f3M4t7AVk+NaeU8T0Siuhf/s03LVV9TrVK7P0:lFH3yT2IaM4t7AK65eqB1Tr7 |
|
|
| \\?\C:\588bce7c90097ed212\1032\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 19.10 KB |
MD5:
51ee4feac487e9712e46d7b01517f667
SHA1: 649d7e6392db5e8abc5a7bae83aed957221aa45a SHA256: 3c4f6e2f1b5cc7211da4ae2e113398d3ffbc9c19af4c25f6581dc85256d5a2bd SSDeep: 384:0NQk8Xh+527ecOsH+TEZOv5ZBEUc8LjMhXNXPH9KBDc0:0NQBh22HOs4+0PuX5H9KBDD |
|
|
| \\?\C:\588bce7c90097ed212\1025\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 7.63 KB |
MD5:
07753eb9ac990b615697754320c0ebbc
SHA1: 66b1e81a2dbc5219548412d9834c7b2696a96f0f SHA256: f6c365dfddc8c174706a48e7254ce791580f78d95dc7e60e6f029e948dbe118e SSDeep: 192:NxfeKV5KxJaRLRuSVDkwPivy10nVA2jMLnLsoj:HfP7KvCsQ5Pivy10VgVj |
|
|
| \\?\C:\588bce7c90097ed212\1038\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.60 KB |
MD5:
06649f6b7855999107b6fd119ca52b8b
SHA1: b0985e1dc028c289d3e36043819e4a912e96cf79 SHA256: 23b5fd539a1ca24fb94638d2c8586c30035184c249ef3643882163e1bd4daebf SSDeep: 384:qnVZuFGPbjckJUJ1s2AzaIKbJvsEEAt2A81sGW+2cX3z2b0:GuKbwio1lAOaK2p1VZ2cz2Q |
|
|
| \\?\C:\588bce7c90097ed212\1029\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 79.33 KB |
MD5:
f85a99758f4a0cc0174c50db16842f97
SHA1: 2ae1c971faecefd58bd7c9141d60a0c442de6852 SHA256: 6590ef82a28d72c64d0161e35b8b7072bc22abdb7796ac570e0f510927d225aa SSDeep: 1536:3P54y++6fPWdCP6ZVbBuWpKZgzNBqE5HqFKVfEbBXnHITDsxN5cRyh4xcq2Bf:x45yZiWpKZgzbqYqNF3H06NHhU2Bf |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Rotate8.ico.id[B4197730-1016].[randal_inman@aol.com].help | 1.11 KB |
MD5:
f3b8b6afd5895ea642025331e1083086
SHA1: 643871bf3040c7059891db5bb892c4419b49436a SHA256: a454502d5b1f7d486652baf424651516d66c583f95792065d39666ee2a1da6c5 SSDeep: 24:DrknEtgPQ0J0vMy44SEmuo8LgPO6Wf8TQ4Nxr24+ye1X4cPl:fknT40J0tmuo8L4WfGr2T1X4c9 |
|
|
| \\?\C:\588bce7c90097ed212\1043\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 3.71 KB |
MD5:
9fccec2fbb85447b72f2606475f973b9
SHA1: 0bbbd40183e818c3792f3cc1dcee766eb054c0d7 SHA256: 0d6e7cbce28884e72ee9d82f01ba18febb3baf8359bbdf94ea31f28ede60848a SSDeep: 96:GIXNaDqHf+gEgsvEBNRrlBFMQyneP7BgDRawsGgfglM85Mroj:FdzWp8EQJ7BBl3fEM8aroj |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Save.ico.id[B4197730-1016].[randal_inman@aol.com].help | 1.36 KB |
MD5:
39c2937cdb6620223337b66950cab6cc
SHA1: a90b2aa625408f9503a1adac5bbba04dc2b4d5a9 SHA256: 366ed463d352f630390cff08170959345824ca26ad455df07e61713fd5ac0d64 SSDeep: 24:2KqVtwee/10buDr4VSqc+Ehv5ecg2Aa0EL44juKqEaFDR71X4cPl:ceeK10Wswp2tOLju6CDR71X4c9 |
|
|
| \\?\C:\588bce7c90097ed212\1045\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 80.71 KB |
MD5:
ce071a14d63316f2523c6a0209fb21c5
SHA1: 18b5d4265fe2d5b283b0ebf7beac702f6d896be0 SHA256: 854adbd9f651678c46f3df3eec6fbb39c4b4d21c15f5528a8c5aa7bf04f91f62 SSDeep: 1536:6TFQiiPdIZNXz4AxpnQeVAvnA7/xuFOoz4maKigfa7NOFXZ2VTJM:6TFQiiPqBpjAITAMoz4maKigfaR2XZCO |
|
|
| \\?\C:\588bce7c90097ed212\Setup.exe.id[B4197730-1016].[randal_inman@aol.com].help | 76.56 KB |
MD5:
299d8040f47a573c09d18307e63eab4d
SHA1: fe6fd04e34a1e6f77e611989e5096c5557a280ae SHA256: f42988fff85d203229142f3ab3eac805aabeb3e67deb3a9a2a9d35cebb49e886 SSDeep: 1536:7vuWGh3g/f87woK5OL8m2LVVdzt3E+ovgWSxS5Tp2qy5NrH54S54kzb:7Z2gX8UoO4jqXxSf2qyPH5lukP |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 349.30 KB |
MD5:
d3697b587759c4f6b7d7e29311d359aa
SHA1: 788fda457698bfae8cac64ca096b1bfcdda30a34 SHA256: 6518f3b6d8f2f67e4a8c5c3433807886b3640ce3aefb8b28dd9676c2e01c2e75 SSDeep: 6144:dBYpqmmOAuzq+6V9ovLyU3xfpAzTgfE1iP8baQ4v5LD7SU2n36sDeNh:ddmzAj+6rovXfp0gfki0bqL/Ri36Z3 |
|
|
| \\?\C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-1016].[randal_inman@aol.com].help | 41.97 KB |
MD5:
3a6e3d393b17e046bdd2f0d290d7d572
SHA1: 6e387a50794b4419c32959f0b92bfa5c7fbf960f SHA256: 536a68b131f385412664870e3af6004157d0acfe1f52efe8f984b259a85bc1e3 SSDeep: 768:ZCd4Soawl6GBlkPy0kTSdUSERT+mE0s9Xu/S3Id75pyr1DSO7JVZpKwfntaL:ZCeai6GBlueSURT+mE0erYpyr1DSO7Jy |
|
|
| \\?\C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id[B4197730-1016].[randal_inman@aol.com].help | 322 bytes |
MD5:
8a2439d429f1cfc0562d43316f849b80
SHA1: edafe54bac5f96fe09138274bff9a270c1dfdcd1 SHA256: eb682df2304ce13ee3a0110601ab6e21476a2b6723da3cf0b9539199f100c767 SSDeep: 6:a4mqMqUf+6IJde5x165SInqs6YK1hUfBgN30XY1PP8pskocGRQhS1/fj0z:GqMd9Ii/qnqsBKXUeKiPSxocGRQOfs |
|
|
| \\?\C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id[B4197730-1016].[randal_inman@aol.com].help | 6.16 KB |
MD5:
8bfdc613af5df08041b16466cb0ffa42
SHA1: 58447aad6a1d7b31cf5d5f92c9c52e9027bef868 SHA256: 238588fdcdf4767a1a4ff0848148ae64404a349398d28e2322d7fcab2fb5c48c SSDeep: 192:py7PSL0dcBvmtf2+ZFMXmM9Oh3cf6yDlWQ4/1R7uHJ+4DTW2oW:47PSLScItO+7MXJOhSD8QN44DTwW |
|
|
| \\?\C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id[B4197730-1016].[randal_inman@aol.com].help | 418 bytes |
MD5:
3d852e045dc2f4297a7ea21e9989c258
SHA1: 6ed1505675123a4c2e300d9c92ff05dde987c41d SHA256: 4a1f7c0bd23221e0d2a96b1bea3549504f9f9b66b56d1524147a7178e6e919f4 SSDeep: 12:Mop2XCsbvGqRodBHQMMaiwBo9QliPSxocGRQOfXM:lpWCsbvBRYuaiw/ToCL |
|
|
| \\?\C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.id[B4197730-1016].[randal_inman@aol.com].help | 866 bytes |
MD5:
adb2ddae31d00dbe4c75755cc1d3e47e
SHA1: 4255f0e64be8bb682b33290293c15bb47953ffaf SHA256: 3f151730c825af18e5304b7d5013a1d2cdec4e66328c6bca89289851675f6510 SSDeep: 24:K7/5cqgcVVnkdENl5TBX41VwQnsoZN1X4cPA:K75pV5l10VwQBN1X4cY |
|
|
| \\?\C:\$GetCurrent\SafeOS\preoobe.cmd.id[B4197730-1016].[randal_inman@aol.com].help | 322 bytes |
MD5:
1bd15545f951f8fe97605f0c12202ea5
SHA1: 9265c380898f190397475e10f422bb2570e171e8 SHA256: b0b3c3d2efa3b4b9337502a5d8b663df13d0c3782e18a272d6ebc7a2f9f71814 SSDeep: 6:jGGLYTh5WFgDUX1vE4nZcDYjTBlRW1xBj0gaWVXsnVXjHbUVBdH5KTM:jGcYF5WFKUZZcD6BDW1x1h1X+X7QPl |
|
|
| \\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini.id[B4197730-1016].[randal_inman@aol.com].help | 386 bytes |
MD5:
592c459ceb890c4c2482fa461e6f1763
SHA1: eeab36425dd6b66fc9e1ce34f713f10fb7b392b1 SHA256: 64b759a93b718ff9552d68e79179a011dccfc07e02b88fa1619099cc0dddc0e0 SSDeep: 6:kePY4xS2zZbbmC4jVRRW7/wyHpVg9PdIkkeZ0XY1PP8pskocGRQhS1/fjXN:BlbyxEw+/g9KkkeKiPSxocGRQOfrN |
|
|
| \\?\C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id[B4197730-1016].[randal_inman@aol.com].help | 140.96 KB |
MD5:
09ba1b96c3dd2c59a814ae84dcb6cc56
SHA1: 95d3dc71635cfd24389c6b66f28f4cc750276edd SHA256: 2ed7a9a3ed76ea50afccbb77cbfdf1183f9391bf5a202409d4540e0bd47a2f55 SSDeep: 3072:0EkHPQzSPjzgv9O9YrqYsjDxa+yCRQM4IXUSDeUfP6zCx:/GzgvcYrqXxyCRQM4IX5qvk |
|
|
| \\?\C:\$GetCurrent\SafeOS\SetupComplete.cmd.id[B4197730-1016].[randal_inman@aol.com].help | 578 bytes |
MD5:
dd27e040f673340319455abcb4ea17aa
SHA1: 7ad80d7d87bfb3133d05117e5ca3f6f2bf95cf50 SHA256: f496e8f98fcf47f637610394378e1d7653f0c7f661963727760a8b9f53a1b69c SSDeep: 12:0YdO1bzK2NAb2nXmePaTYk1ppqpz37lth1X+X7QPw:a1bzK2NdnWePaUk1p0pb7l31X4cPw |
|
|
| \\?\C:\588bce7c90097ed212\1028\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 14.10 KB |
MD5:
357d3ccfdbd1bfb337bd91154f7350d2
SHA1: 760c26123111880c5cb9bc807bbbd94fc32ef75b SHA256: 31cd4b11b048f34e50bcfceb17008060c57944df05e9dd81a03a3e5da38f1430 SSDeep: 384:lZqq5JjO5jLUtIF5qeOtwkWEsG4HxLOqPIdwvkZ8p5Y0:BRwEtLok4HxHPHvk6p5X |
|
|
| \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id[B4197730-1016].[randal_inman@aol.com].help | 386 bytes |
MD5:
379b194dad3b6bc570404d875505bc6e
SHA1: fb36822cdec27f47cd7ee3b9ac932d10ce5fdd33 SHA256: d10cbf329368491efcf832cb863fb53424d2081dc9c1c1feaeea12d528b35b28 SSDeep: 6:ok7kq9eG7jytTaCsTUPx5rN8TOLA7PesI3AS18rg9ge10XY1PP8pskocGRQhS1/5:ew3TTexYTOLA7Peso2ZiPSxocGRQOfrN |
|
|
| \\?\C:\588bce7c90097ed212\1025\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 17.10 KB |
MD5:
2850a87cdc5764c448cc681c7042879c
SHA1: 8428de65387ca3cc97850eed70688025ac20c14e SHA256: 2e6f74ada7cd75d1398e027e9dbf92614d512988b76ed8c6671ebe37126278a6 SSDeep: 384:BVubxozqsBB8/NN0/Nl1M+LQvPob2RmbE4b1YyX0:rJq26/CM+5yRmnhYT |
|
|
| \\?\C:\588bce7c90097ed212\1029\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.10 KB |
MD5:
023f4617714752921d31fd66652281d4
SHA1: bfce26a47967f8db06d8a7c39ef8313da9e14d96 SHA256: cf38832d042b64e31a3fcb17dae84ec6dab5669fc53ff473ed761af4b52bf9e2 SSDeep: 384:eY0+G2v7yI5K7v0hjfNQwx9IvTK5x+LVhva1zhdRUULfuMjUfM0:h0+d7yIA7v0hjFQwx9gTSxghva1zb2Mo |
|
|
| \\?\C:\588bce7c90097ed212\1031\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.60 KB |
MD5:
01a94cc76a5a55e3cbabd26507770410
SHA1: 550e4380f657864b223dfa9a709d96b26ab49235 SHA256: 366fced78ec4daa5ba93dc69ef242247722368a65117511e647ac4a15d429c8f SSDeep: 384:9ndUVUhHbUKCIcd0uTcC0IpfpfK8hACwep4Cc9wL6LWn3uQzfMxndcS98UQPAqE1:xd3hydNQCB+8eCDoS+q3JgjJ |
|
|
| \\?\C:\588bce7c90097ed212\1035\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.10 KB |
MD5:
016ad390bc72e96273932472069bd57b
SHA1: 4928cd2ef06259ba08f6bdb5911f05cb6df0fd7a SHA256: d3a8c65210ec359190691ba66914f617cdf96f6e1020a427cb7406c1a94d9477 SSDeep: 384:TsbnkhH0+/0YeT/tm4MkjZdvz1sOItkdJHqI18b7KD512N/nx6r0:TsbkxXmm4fjZdvzvIyLHl18/S1k/x6A |
|
|
| \\?\C:\588bce7c90097ed212\1033\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 17.10 KB |
MD5:
07905c80f65269a193a761e1ad1fb2d2
SHA1: 4b4b628c8b014bbec4947738ab6ac217d2a5645e SHA256: acb20fbd65d2e02fda257e81c79bf10f4534b5b221e227067d5e1559a8f56c83 SSDeep: 384:l/GQNxpogRW95jjwWdGpOsjOfzTVUrR8ZB35zlf+sW6PSBwEdl0:leEo195/OpO9fzBU1UPfOPBvc |
|
|
| \\?\C:\588bce7c90097ed212\1025\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 72.74 KB |
MD5:
83e3ab93f1ebf38cde9e4baadf8db870
SHA1: be773c966cfa51bee02f8304fc68009412bba55b SHA256: 23c0499e66ada4ddf70fbd7be09f8ae4a00cf2348eb1c77a542d7035c411f04b SSDeep: 1536:Nk23N9S/cqy+qdvSkkLDe1mv4XLZdTJ4qc8c3FChBZ3YPMGXdyVE:NkQS/c9+yKkkLDesQXnTcdC9oPHXV |
|
|
| \\?\C:\588bce7c90097ed212\1028\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 6.41 KB |
MD5:
89bf9e0ddb47755935272550fdcec190
SHA1: 1adbba16499a20d8bec6052c712d834a6287202b SHA256: bbd1c6e6d17e6cb59c834af1bc6893bf5809fec1239015b641070d303fa68d07 SSDeep: 192:x1GdyPdwQSvORDEGigy0eHtAVlvVbKKAOGoj:91RHRYGu0eHinVbKCnj |
|
|
| \\?\C:\588bce7c90097ed212\1028\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 59.66 KB |
MD5:
f128c47a5b6ea6d6ef232fc58ec0d2d4
SHA1: 2ca64a9c3e5cf2f78dcbd3e0451e7399dac96bf9 SHA256: 93a420a1564a11039400538102a7c2043cab03c4cb729732f31aef023500fcbb SSDeep: 1536:pMwSPEo1QLpQE7hjCUj89Qh+P2krWwS3d:q1p1QLpQ0tVmA3d |
|
|
| \\?\C:\588bce7c90097ed212\1037\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 16.60 KB |
MD5:
50f4071ac6894e70aa8d75e93b718551
SHA1: 74b7e15ac48da118ce0517c6a8bd34122f0fb4d6 SHA256: f2078a81517e31549c7cf84da4986b19f4351a1bae161294ad7692f8cb5fb5c3 SSDeep: 384:HouMnRuNvEwk0jnNo3Z/33CHm31yKZQu8fzjGAAiFF0:NuRokUngZP3ZZQuoVAiU |
|
|
| \\?\C:\588bce7c90097ed212\1029\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 3.88 KB |
MD5:
596215b9884bd7fbd82a1d75156479a9
SHA1: 77c861d34dc79226d248f5cc53109bdc58f8a2b1 SHA256: b235f6edcf0647084e12c085f1bc37760942d0ada8e6a0341c9b7465bc8c24f4 SSDeep: 96:Uf7Uy6EUNo7X3pKbdNzGhs3bhkKrFymZe6PMuO+ULoj:Uf7VDJ7Xuzr3WKRBpbYoj |
|
|
| \\?\C:\588bce7c90097ed212\1040\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.10 KB |
MD5:
933d1b380e89376b3e37c41145ca397d
SHA1: 918cafe0c13489b61dd9be3f36ae306fb620516d SHA256: bdf94c441ae3e0d8755f63e1ea263f15e4f0b6d8a8ba7297c91f0e7ea1a4a607 SSDeep: 384:VjSlVqvLnzeQz40thprXzu98c5NwQdbcVhSXp64Ga6B2FX2fXb2Xm65b50:VjSlkLzFz1rDumcQQPpKa6xfXke |
|
|
| \\?\C:\588bce7c90097ed212\1030\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 3.49 KB |
MD5:
10e36807d1c732c268452b566098c76b
SHA1: 9559e490011353e866181af57d64bde7790c7a57 SHA256: ba3d1c39a6290c3a23870f77d9873b7938a5f8a26f7c526e9b9267fee38bcd4b SSDeep: 96:uT8ts+xDa/iJ4NACDynTdgyejL84BIvH0oj:LDxvJaAM0buL1BI8oj |
|
|
| \\?\C:\588bce7c90097ed212\1036\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.60 KB |
MD5:
ed7497321d8358ed99a049dad3aa4784
SHA1: 5fd85a295e371866928a690cbc72fcc6d74d3691 SHA256: 765d3215d2cf5a5c4bd34486196205dd2272f2d7218065c924394b19f0596736 SSDeep: 384:b6YBLFnSdCmwDUnjaE6dA1EWvBEtIuc+HwWQDd37snCbld82mRKybvGi0:HxnSI5gjaE6dA1E8BEuuc+ANTbz8LKiy |
|
|
| \\?\C:\588bce7c90097ed212\1041\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 15.60 KB |
MD5:
f72b3a3f756afbc4ffc7423dac4b4dce
SHA1: e7ce6f1d8c953cb0da5ad6b933882ede3ee9c311 SHA256: 1c3f812ca2348e5392ef56ad69b194e0f5582bfc901e5cb0efc5e483bc77c122 SSDeep: 384:fWyORLX363Z8MQQseodBp/eZpt0yfAlMEvWc+VfeSXEpqa9Z0:rOtXK3GqUBp/eH6yfCME9+V2Hpqa9a |
|
|
| \\?\C:\588bce7c90097ed212\1031\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 3.58 KB |
MD5:
dbd90d469aaeb74cc4fc08cdb75e1771
SHA1: b9de25fe14c376b4a1b3c8f1bb4b8c1fa306b9b7 SHA256: f526839998451fbc31f7cbcc9f95eb0f50538f5dc4bab36130e8af9e480fd68a SSDeep: 96:oz0V+j8enzHGmyttQJreujCVzquPq26W7cboj:Ithzmmyy7jCV+UOHboj |
|
|
| \\?\C:\588bce7c90097ed212\1043\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 19.10 KB |
MD5:
0148dd422971636fd8ee77e20fb120b4
SHA1: d4c1b70abf3be2f32f8bd6b69ceb7f16ec775741 SHA256: 242481707451fe3d7cfb16f080e884b2db4a017b5b128fbe0ade49152db95a8e SSDeep: 384:3cNsa7Xci16L5fEOOa7B3XP9zcCGjKBAtQIg1tUwygcx0:sP7dO5fEO73XP9+jAAqtUwF |
|
|
| \\?\C:\588bce7c90097ed212\1031\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 80.67 KB |
MD5:
9ed05e6ce4ef982bad415e7f5211a000
SHA1: 7c9545af771bfd8e653bf1739ed2049b3ab3d3dc SHA256: fd657a8951d2e86dc20422da25c3846debdba5d77d6c765194a51121524056f4 SSDeep: 1536:4KlPIvWDVx8nZDX9XJWAwRwFlHFBKlHLQX19DG4eGKEF5sJV+COW2mnGwNSYmCxn:tI+f8nZ7VIAw0llBKFMlM4RHvOwCPG+v |
|
|
| \\?\C:\588bce7c90097ed212\1030\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 76.19 KB |
MD5:
8931f1c9df7f1ba9b9b37f50db0598de
SHA1: 86907ecf7da962ed21826da731e300475078c559 SHA256: 0a3cf6900fd55300c3bd66875d4d9f22a8031a3553a61b571e04eb1fa0c5098a SSDeep: 1536:sQjhJj+/fTqYaDp5NBx5mx0IZyYphMIx6AnX7w79U9ejqFitL231i4mP3tg:sQVtC+7D7NPE3ZyYTL68wsegd3o42tg |
|
|
| \\?\C:\588bce7c90097ed212\1044\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 17.60 KB |
MD5:
3c5370e36767e09bd726eecf6a0dc9f3
SHA1: 05d32d0cdf45782ec56424ace97a835b3fae5604 SHA256: 3c3f55114861151d2d6112d626316ac5f8e30fc576c5d1bb53fd0c972354fe5f SSDeep: 384:bBzt8Vo/sksfZBDWLoJ5ZD5sk5bMzSZdA91wKvXa2F/cPR6CWFx8Cf0:b38VsWfZJWLerO4ikdA37Z/cPc/Fx89 |
|
|
| \\?\C:\588bce7c90097ed212\1045\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.10 KB |
MD5:
34996ce4aa27d2eba65212b20d1d94e7
SHA1: 4fc4182dc6ec6128c92cef296af8e4ec953ee68d SHA256: 6360b48f268b9661114ce5f331f304675f9525273cd7ddb7568a6177585fd574 SSDeep: 384:IUy1+kHiXiUXl2BXDaZwa5m/aSOfIEnYnrgL65Z0kI6L0:IUyniyaw0zRYnx5A6g |
|
|
| \\?\C:\588bce7c90097ed212\1032\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 8.91 KB |
MD5:
370e10ec95f74a227c2c9c93ec00a1fd
SHA1: 439415b098b45269d5ea079501f9e248b8eb016f SHA256: 545c7adf3fda2434ec6db8fb5af6ab739ef0e5fd9fda715a06571b035369f013 SSDeep: 192:3bKQ9qg0M1hvs7Fyh9RWp7b+p2byaBtNGKxKEs72ioj:OQ9qPM0FQ9Ru7tea5GCKrirj |
|
|
| \\?\C:\588bce7c90097ed212\1032\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 84.52 KB |
MD5:
5fb925ccdaaffd26f6b61b8cc78ea435
SHA1: dc2872a02bbf91ca2779bc8f44c0eb332fbe9428 SHA256: d74e9bd9d62fee037953c2db2c73478fed6c68b83834c0e5cca52815451ac56c SSDeep: 1536:uriWKCTCIC9g8FJ3lOKpxMh95I4SIJdjvHBfese7wAHaWLEMvTAd1Rq1VH:uBmIC1ZvMhfBSI3rhfeseM8LtvTa1wnH |
|
|
| \\?\C:\588bce7c90097ed212\1046\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.10 KB |
MD5:
105bd921533bea891f53065df7e8e91b
SHA1: 4723078eb171af7e5e009b80c9f82601d76e895a SHA256: 7802de0e53c2bdafc79dd218738bc8fce784c0dba2813d7404473d905ed784f0 SSDeep: 384:Wg8fSzAtR+uq+nWpbbTx3Y+tWAmK+oMG8NHW+6U4pTO2iRV+0:O+AzEUWpbTxoAmKTMTNHiU4Yb |
|
|
| \\?\C:\588bce7c90097ed212\1033\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 3.36 KB |
MD5:
46fd7e5030f70bb2407f94f5cd50f673
SHA1: d64248267ba488c5c4554d4f748b28a5220f6cfe SHA256: d2bcf13bc37f980c69e3cd7b7fd6912e290dadf32df7bb76d4d197c7d8f4e35f SSDeep: 96:FFRkegGVxiVs7pdRzoKgF7cJGB8x3ze/S9oj:nJVxiG7RM7cMBs3qeoj |
|
|
| \\?\C:\588bce7c90097ed212\1049\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.10 KB |
MD5:
8a41f6dbba2f3aeaeabd1e0709b75bef
SHA1: 3a760231e2f19ecec24d82bce9829ed3bcf64947 SHA256: e362ff38ee89746f70e4c299e82ddf1859448c454215b5eb5bb3d434451d47f3 SSDeep: 384:5Tbb8kVdyCAW427rZalDxyXF469vpYs0SMP0Chlh7jga2Z0:dn8hFg7dp8PdltX2a |
|
|
| \\?\C:\588bce7c90097ed212\1033\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 75.69 KB |
MD5:
a5b5fbb97372d12f544b12d32067536f
SHA1: 1bb1f258a4d4e11b8d6cfcb76ed28e638f711d90 SHA256: d979e395a6a9aa178e18d0942f44a15e67e77c516d512cbca34d170fbbbd452a SSDeep: 1536:zsZ8dTfhD1mafb6X1hH+nkAbTUJ7IW48+/FopEW0CRlR:wZ4TfXf+lN+kAbTm7JPCFAyCRlR |
|
|
| \\?\C:\588bce7c90097ed212\1053\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 17.60 KB |
MD5:
5b1645c7fe9abba2fa466bc0e2404431
SHA1: 5c7d8ec729722faf877b023896d97c9cd5c2117b SHA256: 71db18fcddecb0b1670c0e785cb17d1b7956cba2598cdc71f560b262e7704235 SSDeep: 384:T0EQY87PR7M5upR3mZKWrbzlsDSHXi4jFrgxRfd0:T0HY87PR70YR3mZKYb8krg+ |
|
|
| \\?\C:\588bce7c90097ed212\1042\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 15.10 KB |
MD5:
bfd53a13d6891a38f59f5ee8a68f899f
SHA1: f1421e2e571d7b8f0bd1c4fe11eada44c5832561 SHA256: 980f78e5062151994ecad4f4c25892769f94a86053d2889d73a198c7a56b5c82 SSDeep: 384:9T0OQWmoemjuvXbR25Cc4FUPN38M5wgD97Etf+m43mbySU90:97QnuQQmGh8gAtvdbtU2 |
|
|
| \\?\C:\588bce7c90097ed212\1055\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 17.60 KB |
MD5:
59011d490abb9f11bca5d175449dce3e
SHA1: 0d5d2b14ccd2ef38bd1d511d09306ae2b5176afe SHA256: 36fda3c326c11ea4ca304bec32479a84c08ef2560c023b6a1a92e60245052451 SSDeep: 384:BnzgS3iIqDKgXE7L92nF9pMM4ko3B+KKA8TBk6kY0YRhfHZTgfMWcIvs0L0:BnLsOgXE7wtMqoYKN8TBkRY0gZKNy |
|
|
| \\?\C:\588bce7c90097ed212\2070\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.60 KB |
MD5:
16259f9c1fa3af7e92644d34be2e0eb0
SHA1: 0d78d4540cf06ec3a3fc96df193f2dc1754ef7ac SHA256: 9695b505a9087276dd0ee9dbd0f9fcaf151e4a9c66c3313c988caeadda9c814c SSDeep: 384:m49FGaE2opQjNKvo+UaNHoN7eFkF+dfqENrLbcgC9M6OCbgn0:BGaypQgvXzHodQkFAyENwbp |
|
|
| \\?\C:\588bce7c90097ed212\1035\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 75.47 KB |
MD5:
e99e12d266fe798a83780a3737034e5e
SHA1: 27b6f91baab7403c52f0fc0eb4e50ec12625a610 SHA256: 9a221174468dbc56cd2a33e4c4bab8b2146819eba06e97bbf2ae46818e586fa2 SSDeep: 1536:d544n/N/iQxml23GyO78bHOe+7DENNiDab1nhnug:dO4n/xDWLyO78bf+sNeaphv |
|
|
| \\?\C:\588bce7c90097ed212\1036\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 3.69 KB |
MD5:
277673e1822e0de4d1e921663e91b0b1
SHA1: 3e7f5f9ce51adccd6531a5ebec18cd30ad8057d3 SHA256: 2fe0acc03a55322227b019c5928fdcbde382a0a02e4055063a0197d07cb7a801 SSDeep: 96:UjnNBUuA3sGmwL8eesPE7Jc5Rf/JI7PAF1aoj:2n717/wPE7Jyfxq4F0oj |
|
|
| \\?\C:\588bce7c90097ed212\1036\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 81.28 KB |
MD5:
c6883985c5984879f1475a7ea6d08b92
SHA1: 9d297303e5ff8872e75b0e7eb9e2c07058e7a9b7 SHA256: 0136dfd37b0927642eb0bf940bcb6010488105437fce8ed41bf6506bf1cde72f SSDeep: 1536:UWz/xfvMNGaEA55ORxYkq1MHXHoR2hqaS8qsOVTBtAq+FVj8kfgUg:Uk/xf0NGavORa/CHfLSb9VFN4ZfZg |
|
|
| \\?\C:\588bce7c90097ed212\1035\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 3.86 KB |
MD5:
bee26ce8087edc57d14ae2c6ac6d86a4
SHA1: de6435530c9a163ab88555c64055192bed55e351 SHA256: f424e1e2c5902f7f37bbf21925136367bd2796e4ad3c3fe630f3ddb06f1917b4 SSDeep: 96:e0i2gsFtbq9HeX1ZuMY5EbZAHMd5BOr7d6rDZcoj:e0i2F29Hg1ZoWbZAs07k3Zcoj |
|
|
| \\?\C:\588bce7c90097ed212\1037\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 70.64 KB |
MD5:
09dc0cac6bdf7233996d448d84c5c70f
SHA1: 64e28c6a3511953d5fde03214c62a263f7f8eea0 SHA256: 1cdd3de89a62065f47a91660a7e21257b687872a6186d14b1da296c860ba3aea SSDeep: 1536:2hmRd1sIc9jPCxf1usd4aIPiNuQNOa3Zscy92vDgLQ/SsXE9QmBE:2MRd1xc9jaxf1usdsPilH3WKzqRjE |
|
|
| \\?\C:\588bce7c90097ed212\1038\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 4.39 KB |
MD5:
100489764b56fd78e2259f0564d52ebd
SHA1: 19ae857df90ff98dda5bef805e4766b5b76649e9 SHA256: b1ca831882bcc3954bd6314c7c853d0cbf87098ef0dcbb5868e4edf155686e68 SSDeep: 96:ZnruRHFEHfBrcy+Q87Mc+qvINTyIowZlj9793oj:puRHm/VcfQ8r+eIOK953oj |
|
|
| \\?\C:\588bce7c90097ed212\2052\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 14.10 KB |
MD5:
215e8e70e6a40599130d97b1134ca472
SHA1: bce3090314f1af9974d581e3fa9ca09edb8c0a0b SHA256: dfb11c001d4edb406cc56b15ecd5bd4f6ae68c2b01ea88c4a665944d8480fbba SSDeep: 384:FwN/uhMMykmFNjKR6qKNT/NTnowPOP+6nBTQgHPPlzUnXLD4I0:F4/BNkmFpvdtow0nBTQgXyXn4n |
|
|
| \\?\C:\588bce7c90097ed212\3076\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 14.10 KB |
MD5:
c0894c94b55508412a69fe2100465750
SHA1: bea0b3ae6725c522a09900a7b42c2a856f8e020b SHA256: 2db85209afb7822f56d2e83b89b8ed27ae436f15d44ba246077830ec170a0716 SSDeep: 384:bLGm3A8T1BaUJx7AZ2uvbaPYR64Q4pfjFc+RnNA1O/lKYbP0:bHA0eUJxcZ2uGPYR6F4hjFcipbbs |
|
|
| \\?\C:\588bce7c90097ed212\1037\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 6.94 KB |
MD5:
b0831021f0d9a1727b1945b49f1daacd
SHA1: e2dcadcd15b1c06741a3a44623ac1d1b93971d67 SHA256: df36a663976b92e527b4e1a81de26805135aa8e3ac3c10ebb23f84d457826092 SSDeep: 192:4AdvEzXHrQqpYnqBd2JAmodCHRyKM2uS506oj:4mWLQHod2JkcHEKM290jj |
|
|
| \\?\C:\588bce7c90097ed212\DisplayIcon.ico.id[B4197730-1016].[randal_inman@aol.com].help | 86.71 KB |
MD5:
d64fe456d59a59c56bccceba8b28ab95
SHA1: f437d1e6616e9b06c1b7a21ee9c1534271917c58 SHA256: 7c2de41007348e8f3729bd42f3e010764b2215324e61d7af66c854faede3b60a SSDeep: 1536:JX+JQOT2EBZ7A5oP6syxWLZwMx+evgOOzMvhWMqAEyC6BHJeCnxyYBzGvMW:kJQwBZ7A5zeLZw14gBM8vATFUKBzAp |
|
|
| \\?\C:\588bce7c90097ed212\3082\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.60 KB |
MD5:
dddff626896dae9fd4561aa1012a0978
SHA1: 739b6fc88893b2ecf38b9626289d1a5b3f469e02 SHA256: eb5e3097936e3c9e1a0e8ff09c9ebebabf4148901e572da9003a95651a0d2c2c SSDeep: 384:qZY8cdrS73axEVNROcBpSclbnoAMiLw0JGY9CwZdmphx95BkGygiNdz0:qQoeEVnOcHlcenYS5zOh/5Lyg2dY |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Print.ico.id[B4197730-1016].[randal_inman@aol.com].help | 1.36 KB |
MD5:
a774565a469b0e05cc83df4313e80e3c
SHA1: 95aee1e59fcca5dba505a8e24b778780a3ec8caa SHA256: e2e1e2b3454f367e9d99896294ca90c7eab2746e21335a763be7218c96ca7aa9 SSDeep: 24:1nYi8mTehsR3CGhPMlkHHmdiL5iA8/JSIRT7qH95ECI4C1JwmnA4Cf9NAjkr/715:1t1TehUPokHeiL5R8hSIRT7C95dC1Jp2 |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Rotate1.ico.id[B4197730-1016].[randal_inman@aol.com].help | 1.11 KB |
MD5:
f4e5c31be42148046d038970b9967737
SHA1: 5b2c7f9e60aaced48de350ad48b00170eeb64813 SHA256: c1d79dba112682748634d69b45b865ba911146a012237a79f1c5516b98832f3f SSDeep: 24:VlLml+EWKI+mopDpL0LipY/cTMooRrcpf1X4cPl:DVHo+cA3rG1X4c9 |
|
|
| \\?\C:\588bce7c90097ed212\1040\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 3.80 KB |
MD5:
f85dee97f15d75d8bc0b1feb462453ca
SHA1: d52cb883daf633b83f60a594dcfd27be948ca681 SHA256: fa7eb2d3e66ae18f914c1c09ea9b21e9a8ffc46e06db9ee274117fc8709fa6ba SSDeep: 96:iGOo+7coli3Qq0U0pIHazv61Ic9cV9JSGJoyJIgdneHsqIwzPoj:EAqIHA6uNfSGJowzdneHXIYoj |
|
|
| \\?\C:\588bce7c90097ed212\1040\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 78.44 KB |
MD5:
7d82c10ac04cddf8bae5d05b402c1f56
SHA1: b2261058e85c7336aa2fe61ac441cb82002e6bf6 SHA256: 9899655322eee1ed1725edf46ca3021684710fd22e5e39aab842cb03e01da61d SSDeep: 1536:vQfl5o4o7KymgqRo8GbxdjRmJRZfsuXH9Nqb9zgRwJJoH0FL0Mev3b:YN54/mapR6Rp5H9Nqb9zgOJJoUB0d |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Rotate2.ico.id[B4197730-1016].[randal_inman@aol.com].help | 1.11 KB |
MD5:
db1ae58a4eeee1ea75bf5e39a7916d80
SHA1: 1749b658ff8a5abd1a92a153bac7d97275cb6a47 SHA256: 2d306d22651f1b5eb07d3b39a906982ba4cd70831cfd31f96ad089410924ba49 SSDeep: 24:rxxr1dd5LHVAJQ5R3C+aoB/M/Roz/YBAaPB1X4cPl:Prjd1HVAaR3E+z/iRB1X4c9 |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Rotate3.ico.id[B4197730-1016].[randal_inman@aol.com].help | 1.11 KB |
MD5:
0dd60e34fd18a68cbcb2850c47a7ca13
SHA1: 3e8254a7c7a3ede686fb03a6a8e68e4aab583bed SHA256: 757c1148c910963a9eb24e790c4b8dce2e860a0d5ba83f13c27e0833c15f56a9 SSDeep: 24:vo2Hd9IrMjUhHjhIVTnMlpyHlSF5t845lnSc2VpLGR+k/yC1X4cPl:vOeUhDxw4jQnLGR+k/D1X4c9 |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Rotate5.ico.id[B4197730-1016].[randal_inman@aol.com].help | 1.11 KB |
MD5:
5893d7ccdc90cb7993f74fd85684ed25
SHA1: 6d4f9ae62483a168b64f350dbf7a41585231ed63 SHA256: f84296d08c972fb74fa4ef43d5d600ced72e8f93d45b0e8a58ddaf1e80af59ef SSDeep: 24:Und63tV5qlIUuEDYt4KpOAxGtJk8QgEIiHsSLrC1X4cPl:Und85qlIUuEDZKpOEumHX3C1X4c9 |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Rotate4.ico.id[B4197730-1016].[randal_inman@aol.com].help | 1.11 KB |
MD5:
178a7e741cdb0d5bf8ac9e032ec1265d
SHA1: d5aaa463498d13ce1d59a79e8e5852a815e1b9cf SHA256: a6d0475fcf288dc24d1c0b1b66d314f6338da475caae5a93af02f787902c9a21 SSDeep: 24:gSNOGxzvPZSgUtBdPB19zjUxVqMfe7eZZuJUwQ/1X4cPl:gQxbkgcBVpFMfe7eLuJUX1X4c9 |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Rotate7.ico.id[B4197730-1016].[randal_inman@aol.com].help | 1.11 KB |
MD5:
12c8e6cbeae274453941d967040515cd
SHA1: 1fb119e608c6ccfffb4c6680254558c891903ae8 SHA256: 0d11bea731f6d6025f11e1458ee2b74ff79cf77b72bc57d5129918a02983573e SSDeep: 24:M3GOKbr0rBQuUHsi5850DJqgq405avchSqlryc85DZGYa1X4cPl:M3jm0rBYMi58OJFA5ajqxyc8HTa1X4c9 |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Rotate6.ico.id[B4197730-1016].[randal_inman@aol.com].help | 1.11 KB |
MD5:
09893ec5ef3765a51e92d2ab56cf69d9
SHA1: 361555f523c5af3e5a055b01c76726cc5e2aca4b SHA256: 377738704bea5e0a12a2bcd466f7d38401196deb726ca338a7a3f5d357434f19 SSDeep: 24:6p5eriVs0TR28WZYVlccoj9cbdVyxq41FVzEy/xZgr1X4cPl:ieos0T0HSV2cohK7ZEf8r1X4c9 |
|
|
| \\?\C:\588bce7c90097ed212\1038\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 84.67 KB |
MD5:
1bc44e0b76af69e7ef95c0814573c3a3
SHA1: 2204ff00e3af2c24994a7bc96736c4f595993372 SHA256: 758cfd25934babb1d2c284335e20848f4d2d646c2d59f050f19f14bc15342bee SSDeep: 1536:ePExJWaIXNNTNDY0NQvSEyTsDj+p8gRj0ob2uFdrfB1wu2dODhNc2FMQj9DSobko:e8xJWrLhD9QaESGY8gRTDFFfByuEI7cu |
|
|
| \\?\C:\588bce7c90097ed212\1041\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 66.89 KB |
MD5:
97bad186635eda883daf422d59af6898
SHA1: aa24e3fb5be0e22e427aede6f5640ab552b7a581 SHA256: 07b869d3077fd624a969dcd3650f12103f40857b5a0abf59aa2c509e238705df SSDeep: 1536:anErGXlf63+9D/ivQ8ZCP6wqiMJNOK53YVLvZM/vrjEdU/DopET9SJ:kErG1fX9zcW6riFKBYVFWvEd4oqQ |
|
|
| \\?\C:\588bce7c90097ed212\1041\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 10.13 KB |
MD5:
696445aaa5b7a386a043ea07fe4e479e
SHA1: 737028ced0d2facd8cafdd88e96af2c0aaffd6e0 SHA256: 5e1ca3babd7d2060705502a61815e81b1d1f9218e142c5373f04a289ef984561 SSDeep: 192:uhAorBClp80UvhRPfIwD/61cWeCFH7QnWCXEgXGgEQrjnKci8zoc46foj:uhAorwuPflD/6iWtFwF0gNGci8zoc4Rj |
|
|
| \\?\C:\588bce7c90097ed212\1042\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 12.63 KB |
MD5:
426fb23cd7450a8d1504dc5a85007fe9
SHA1: f210f3acff210e7c0e8e40681e5d2a24a6215d83 SHA256: ebbe78a5cb1c3c73d5452affc5041657c9c5d92bfe9da1c2c587db81674460aa SSDeep: 192:sjEBv0okhGWHX/NcMrLFgYP7ynYJgiOpQpA3Fpt0Lc7H8qJxoJOTmlOtBTokjaoj:shXBa6ZgYzMfzac7H3oJVlOPpj |
|
|
| \\?\C:\588bce7c90097ed212\1042\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 63.97 KB |
MD5:
fc4c34acc887dda129a48eb818c1e489
SHA1: 9d57158e45494e296262e2be34602bfa24b1ef23 SHA256: 73bc6ed5322b9eb6cca964aa86f5c7a5220c4c51b2b85b72affa1066ff753cd6 SSDeep: 1536:tJ6o8xKmeulN9BBNQypoDQCSVAOvL62lWnKrCCwO0sEdXO:tJ6o6KKl/DzbVdjzlWnKrCCL |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\Setup.ico.id[B4197730-1016].[randal_inman@aol.com].help | 36.10 KB |
MD5:
e48466068d5afcc0da811d92c8b75689
SHA1: c9c90f95add7f59b61f2ff865301ff5b8d36baf5 SHA256: 8261576b493510253605c174036fb717042746441db32f2151f2e4f89de4ef1f SSDeep: 768:hmlNg5RIIeEb/yqwQDj7nJ9hwsSkJZxxG0GWJTBN+QF+7ZN:hmfgPI0K+nJDCmDTBN7UZN |
|
|
| \\?\C:\588bce7c90097ed212\1043\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 78.03 KB |
MD5:
2ad3aa880082664efd3e5379ade31a3a
SHA1: 31a4776af0c685e12105e9c6f320c0f2e1ba1496 SHA256: 546ca7e9fe25ec69991f72f5f9f02227c0369edfa361da3787d0ab10145909ad SSDeep: 1536:2l1TWPPFyROHPZDK38tUa7gefd9FDw7aSYAIu9HpvbVJc0:WWP9yAZDK8SmgefrF8eSYCjA0 |
|
|
| \\?\C:\588bce7c90097ed212\1044\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 3.22 KB |
MD5:
48a5170eda0f3beb4b6d28cc02d5cb2c
SHA1: e1194201bed1e3b8a7c2303e904652d941a0f88d SHA256: 39d3615ffd8e85a676e17d579dd72906935a03323f8877e545c4287cd04053fc SSDeep: 96:fwCitQjgVWQgCz22aTrSRvqr1f9w2tCgVBoj:fX6QjgW8mrgdvgVBoj |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\stop.ico.id[B4197730-1016].[randal_inman@aol.com].help | 10.14 KB |
MD5:
cf47edcf9516be55e32628bdcaabc97a
SHA1: 5f65bcc66e52e82713e2d0155d6b9f2bd0b3225e SHA256: 497bfb569b15b549eec21a2e8f0f45a135e98581a7a654784a81a6515e920248 SSDeep: 192:lRaqSgXd8OapXSVUBMxWfDMJeDlHqTxDqUsVeFd/XXFuq1qKXW1t5:lkqFXi9pXSVO/fDpQ8Usyd/nY7CK5 |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id[B4197730-1016].[randal_inman@aol.com].help | 1.36 KB |
MD5:
61be4e14d861f3ce467c5e8fcc277e29
SHA1: 886ebe82df4bf35bbfa9fcfa271630737897e558 SHA256: 9a8b5f4c39311f507a25c500f10f42a2cfd22701c6e187174c03fe4c4ea523c9 SSDeep: 24:DaDoV0z23PdWmSjXAn2nfL7prvuChrTA3rVA1GcBzDyL6mVwIxrkOL571X4cPl:DSoGNmiX02nBrvuChrTArGGcBzD3wRLV |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id[B4197730-1016].[randal_inman@aol.com].help | 1.38 KB |
MD5:
b2eb424cd013ca6a9b2f32936bc9cf18
SHA1: fe14784a9ae261f0f257882a06a57e759fd43bf1 SHA256: 8f36bffd03939090daf7ba504ef0cad1f1cea147260d6d7c1e610df56525c794 SSDeep: 24:Bv2JFGQh8LlSlA3PJ6sh6R6XMcNj9tCoPRGZnUof8JvpuKf1X4cPw:B08QklS4P8TR6Xrj9tCoE44Q1X4cI |
|
|
| \\?\C:\588bce7c90097ed212\1045\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 4.19 KB |
MD5:
0da9ffe5f1b175cca4d0837c4e77d9a7
SHA1: 98151784bf31cf8fe4ce5199d3c48f4a61300d46 SHA256: 951526b91ea81388f31c26247c39508a1e3320c1f64e4a15e846af9c551ee017 SSDeep: 96:NtxLx5NGysQ4LU9p/ZACG3qOPXjj81rcpZB1IYgW85Qwu/oTGBM1oj:H9ZG6SPj6QR1AWd3oTeioj |
|
|
| \\?\C:\588bce7c90097ed212\1044\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 77.71 KB |
MD5:
f42b2f6d19917ce0eaccc73196eb44a2
SHA1: dd7c89349cb9923b0d1659fed280b47272b129f3 SHA256: e911fd730ca9d5507c5d033ca59530f33cf52ab1b8b7baf7158544358a9e7a9b SSDeep: 1536:k+79vT9SU9aXtA/aOgZS3W5XXKfPN8dXe92/6Bb2kWgyt:J9v3Y9A/aOUS5WdXQ8E2Ey |
|
|
| \\?\C:\588bce7c90097ed212\1046\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 3.85 KB |
MD5:
2b4999ae5df6bac80ddfdcf46c349d8a
SHA1: 0fb51fd20c37b53bdf0bbc8d0d888b37c49dc90c SHA256: cd1e239787413eec80248504125b15d19203d6ad7cd8b30c50b4f3fc02c59fde SSDeep: 96:87LwSfsg31/dlmQmxHTpHw6G5Jspn+gQAv7t0q4n1MFoj:87MUsA9dMQmXH43gQAv76Tn1qoj |
|
|
| \\?\C:\588bce7c90097ed212\1049\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 53.42 KB |
MD5:
52c729bcd2d7b1caf19a83fc10b0e24c
SHA1: 99c67a7d52ae2088edd16c638f39e21f7db1f175 SHA256: fa5c010358717c9f4298d38acab9c6990a9197171761f67dcb4d59747688f484 SSDeep: 1536:7dz8JM2tHl9mS5QudQ/YBylyd0gZFPygttzjB5Id2j:7dwJM2tHXQoMpgPFPYdO |
|
|
| \\?\C:\588bce7c90097ed212\1049\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 79.83 KB |
MD5:
abd20b7f501759f0fbae051ca9734afb
SHA1: b4a9a4a0dd6cf1c2afa5d8d7c4ac72b65dbf6bd3 SHA256: cf382157850f3d59877e8006badcb2e6b993d77f854fb24378de1ef4f074b9f3 SSDeep: 1536:rQEI2F87L2Srqq/cMUHGztGuEpTv+tf5u+zxZv+ieXUMEse:sE9UCCpEMUmzqREHxZvuw |
|
|
| \\?\C:\588bce7c90097ed212\1053\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 4.02 KB |
MD5:
d632764c2eb970580d969723dd1326eb
SHA1: 5584ad6ec7bf237ef857c3ba501d6167e4dd510e SHA256: c419d04f5d8fb94ea52c1a5b65a1723b243f6e26bbfa3405b90e0254e532a288 SSDeep: 96:nGLQz2nktd/CSbwx81xW4lLvRgbs7bagl5+roduFuwb2qSjoj:nGsikt7blXcebagScuFujhoj |
|
|
| \\?\C:\588bce7c90097ed212\1053\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 76.13 KB |
MD5:
3f458a4f7982b5d5805d42ceb0ce0b10
SHA1: ca5de6cbc3f332a1e039c73801f510c335307f94 SHA256: 847c9137a809c2ddb4561822eb921679d008de4e708e2d705d4c323872fcf4ea SSDeep: 1536:53lUO4G9kwm8TqE9t3rjGFP6BhA4kVDVNREnF4dHgVPFjqZL3Aos6B:NlFj5uGjmMhA4OEnWBgVdjwL3Ao/B |
|
|
| \\?\C:\588bce7c90097ed212\Graphics\warn.ico.id[B4197730-1016].[randal_inman@aol.com].help | 10.14 KB |
MD5:
cdae31e25b958a912c10ac108da98875
SHA1: b0654ef53020fd4e18e70002c64ef540f603e259 SHA256: f6bab1cfb36e4d1ed4e146efa537b55f37c9559114e6cd090ce0e0bf70d277c1 SSDeep: 192:yrDhCopR2hEYzr7GX9hECqgxoWFAGSYwlb3NUj2MXAldLO2sS5:YlpR2x/7GX9COxvSnthdLzR5 |
|
|
| \\?\C:\588bce7c90097ed212\1046\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 79.11 KB |
MD5:
b8b7ea5b2f507d1d7f2980ad7d63da37
SHA1: dc579d6c28e9bfc90f3d26c8fbe073f59a1f9ae9 SHA256: bb07cba8dd2f24f0584f070cf2656d2f8876bf268a361c13e0e1f29be444165f SSDeep: 1536:9FHrxlRNql7phxMQmq3822PD+kovJyoBY+oyEDUtev/oMaAoArSUVxSDhdm:DDRArxHqDvHoBY+oxDIevAMiKSUVxom |
|
|
| \\?\C:\588bce7c90097ed212\1055\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 4.02 KB |
MD5:
d1654edf53270f3429d0ee3130bfa36d
SHA1: b1e2a033dfe0d5fd084ccdeda4c1a31b1971ae9d SHA256: 6c0d9c3c570afc77cb0bc6b6b4df96dd1fbfca3de5386667b152e020091362dc SSDeep: 96:McbjlyNJXk77O0aoqKPSzE+fMv038SjR8hRhUJvcEn4OvOuEoj:lfcNJ077+6qzfPebUJvcEn43Toj |
|
|
| \\?\C:\588bce7c90097ed212\netfx_Core.mzz.id[B4197730-1016].[randal_inman@aol.com].help | 173.83 MB |
MD5:
cc75e7bda8993fedfe1a6badcf08dce7
SHA1: 9f7920f930c3874402c2d3c14535e2bdd1fe4eed SHA256: e104262286e666244be9b1244b073d074f316420ff783d93d664a93ea8c7c99c SSDeep: 196608:GV04YyKSBXZ35w+KBK2KJKDcloT46ooP8ZNoz+hK12RP1O7lT:z4Y7qZ3CwFISoT46ooP8Zyz+hm6Mp |
|
|
| \\?\C:\588bce7c90097ed212\netfx_Core_x64.msi.id[B4197730-1016].[randal_inman@aol.com].help | 2.56 MB |
MD5:
11fa3f7afbc6d6ee303e6e76ca11c479
SHA1: 13698054082d675ed9460d726504787b8c3bc07e SHA256: 3a88ab74d2f924dc8af3a8c50c2538b8a900e0964d7b68bd6accee41232f5a3d SSDeep: 49152:ncxisfQxoMLk5SgH/ZtU8ECKvOwpz1zSrvi:ncxiy4ktU8EpGwpEvi |
|
|
| \\?\C:\588bce7c90097ed212\1055\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 75.28 KB |
MD5:
1400ba0357e0b61e6c4a743a958d17b0
SHA1: d1896ba932c7c88c60557210dc3edbecc8672f4b SHA256: f2a92b1e5d8f2a83b3deb2b3d4702c15f03fc27aa93249dc77a649bbafe2fb01 SSDeep: 1536:DDjrWh0ZdzM47okLN+1nw0yUB78cGKd16gYzv9ja9m0nQr:nHBZtn/N+r7zGO4S2r |
|
|
| \\?\C:\588bce7c90097ed212\2052\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 5.94 KB |
MD5:
1db6c2c016860068ebacf864ee0f4d19
SHA1: a4552bced0ce1dcb85d2f4e423882bee8c7383f5 SHA256: 7742c7ef677b4be539075528a4d00ba212200d21eee95a6c223327c560c37e62 SSDeep: 96:xmpz+EajDiSFBrXlJMY1WU05dUOEJlatzSe+J4qJUzgqmZWD2oj:E+fj3V0Y1WB5pEJlaINZi2oj |
|
|
| \\?\C:\588bce7c90097ed212\2052\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 59.52 KB |
MD5:
61752021672323262508892633e9daf6
SHA1: 186a7e726e1247ab035eb61784ff17bd5d6c10ac SHA256: 559feea137fd85708abaecb131f204b144dc5e60be7582cd3f0f73b18479ab12 SSDeep: 1536:wqGjPELt95Rj/ZszcsJFMY/i4S43Ia8tauxpNORyjbbZg9jjE:wqgEBRrZvWFDS44a+aOpTcjE |
|
|
| \\?\C:\588bce7c90097ed212\2070\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 78.63 KB |
MD5:
948188fb12198068e17a400f85ae2461
SHA1: 8d930153049cc855ba48975c59532c8625b79030 SHA256: 335a44f915241b99556bb11812b75f13760ecb5f99f34ff9f0db59b847221037 SSDeep: 1536:vVXg1EvXfmJYtqTprU8Xrs6YnQFH4qG4rNpf1OCOZhh1wYWoIa2W:vK0mJY0Q8ozAH4qNVACOZ/V2W |
|
|
| \\?\C:\588bce7c90097ed212\2070\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 4.16 KB |
MD5:
1f450dd90022f83227a48e3a2fa5e4e7
SHA1: 404981037bb4b1ebec26617205ea68becffd4ded SHA256: 66aea510a5d26b861e4ab7222ae3e14003540bf6eaaedc9af6b998947c00e23e SSDeep: 96:Q6nSi+SuEgrvG8dbZktTHzU2lTJIS8KYloj:QGSOuEgrvG8RZmTHDRJISFCoj |
|
|
| \\?\C:\588bce7c90097ed212\3076\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 6.41 KB |
MD5:
91e468d52fd84a259240bf4dcd67f45a
SHA1: 489383433e0d43983c6993c057e060d95c5d1b6a SHA256: 79bedd3ccce25a5a4d8905473bd9122ac6374e066fec01ccffc131aa3b1a0e98 SSDeep: 192:cxv9b5EuCUmN5o2TcP5jFTy2abJePeZNEJoj:cdZ5EdUgo221PeZSej |
|
|
| \\?\C:\588bce7c90097ed212\3076\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 59.66 KB |
MD5:
44c09dcc0c545c06518cd2d4669c8de4
SHA1: 19ab4a740a593b0c0d6644e1f245ec0ff11932ec SHA256: 2b341321baeb6bacf5592278e2f1164259a505bbe152391c3460a232779ad9c3 SSDeep: 1536:dpEIMkqIaVVqLM2NaOhZrxGam/CtdgLsS8oAiwUAG2az2pU6a:HEjkn2qI2TZrmxQSD6acUZ |
|
|
| \\?\C:\588bce7c90097ed212\3082\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | 3.24 KB |
MD5:
49e328e01e3b86c9d50103b6dfea351d
SHA1: 5f96e035553ce5411ea6c1ac6ac85245657614ea SHA256: bef576a5ad46e05cc3954a53201c42ba06dd45b8b14106f1b59df7d234bafeb1 SSDeep: 48:A6gpQbibCzXXMlD6+xN5jY7/nrxA2x+SIiyel8VMkLSnCj5OJhRy78MoxSYoCe:AVQb4CLMl3eFAlSj8qp20hxSYoj |
|
|
| \\?\C:\588bce7c90097ed212\3082\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | 78.38 KB |
MD5:
7620254343612925d02ba0b7f08e1bee
SHA1: 99b87717c029d43b52988a224218b6d4c2f11163 SHA256: 840c950a6b6af198f97d0610a3e3234d1ac4457b943d4b92c52288df703bb25f SSDeep: 1536:IIJhB1BmCcXzCO9UrCxX7QHc3ufJ7wXe3FmNsMycTQ8IPMf4+sP2uv/u9:7B2JX+t2Q8+fJ7ECFmSXsIP4iP2uv/Y |
|
|
| \\?\C:\588bce7c90097ed212\Client\Parameterinfo.xml.id[B4197730-1016].[randal_inman@aol.com].help | 197.33 KB |
MD5:
367ec154be7a749b1e3e40a5065b7271
SHA1: bc050a892ff58575942fc6c709567496a286d162 SHA256: 64f59728f9cf9e0e45214d2869cb58925113b99758eed618822965536f68b3ed SSDeep: 6144:JaXFbs7XygknJR/vUqt/rYt2PyiiyCJ3PO:4buXyfnUO/rmqyiw0 |
|
|
| \\?\C:\588bce7c90097ed212\DHtmlHeader.html.id[B4197730-1016].[randal_inman@aol.com].help | 16.00 KB |
MD5:
6ddf63c20a92d6e2f7d5d0013953e01c
SHA1: cbd6aa6d023e21fb3c8c3fbfa69d1f79083502a3 SHA256: f2d831c45c6ec48daafa4ca33ecbb269b809733a496bdbe74168afc460b9a4ab SSDeep: 384:5Ji4JkJy1HlX7HAnahv+LsIStDucBXhWsV0wY2:e2Uy1HBzkLsISlu1ir |
|
|
| \\?\C:\588bce7c90097ed212\netfx_Core_x86.msi.id[B4197730-1016].[randal_inman@aol.com].help | 1.11 MB |
MD5:
f5fe7bb3334c41903e2b539f75e4b31d
SHA1: c9f9fade77855eb0c81f4a8ccffb5d0ff5ccb38c SHA256: 6ea693da01ca48447e92e12de9bb6f12436846b79a5c23d1addce667571b537a SSDeep: 24576:DDRKET5Oy0tr5n7Q/n+sQqq2SnWamWoRgt3Q0nLuk4J5bLRY:Dl7DK5n7ZslyWHvgtQtT5Hy |
|
|
| \\?\C:\588bce7c90097ed212\Extended\Parameterinfo.xml.id[B4197730-1016].[randal_inman@aol.com].help | 91.39 KB |
MD5:
d09ea98559a3a4e502c07e618cc43375
SHA1: caf405e1fca9202497c76d5ea774b777f5ba89db SHA256: 1cee0ae41cbcd503111a0c834eff7e2276fc20d8d8cb162c9352deddeb78efbc SSDeep: 1536:M4uB7HabTaQJWIowSLY9WkBzpoRSwnQxbA9cf1Vfd0Y5xIc0YPxa:ruRyZJW4SLY0kBzpoNnobA9cfXfIcba |
|
|
| \\?\C:\588bce7c90097ed212\Extended\UiInfo.xml.id[B4197730-1016].[randal_inman@aol.com].help | 38.38 KB |
MD5:
ac9cf82bc026499a45a019ffed2020f6
SHA1: c98f63ff7606acc259e7b036792f4060b817f7db SHA256: a872721b4eba15571a5185bdcb0fbbcc9b28d256124ff876419e5e8e7d3dbf11 SSDeep: 768:wVAAQwlwP0mizC50QmW2mLIOHDl5DJpdJ9jzWd+SUjkjhyzc9EvFbO:6QW9maPWxLIOHDPDb9k+SikYzKEg |
|
|
| \\?\C:\588bce7c90097ed212\Client\UiInfo.xml.id[B4197730-1016].[randal_inman@aol.com].help | 38.38 KB |
MD5:
a16a6099ae89f63e749b98015e70f0f2
SHA1: 7f3db1899d7cf6a06cf72e6e3fcf061396f4ddfc SHA256: 6c75dd1e48aeb7e0b60de611db2c216c1b5752897563ac3ecd05eb8bb06b95be SSDeep: 768:jwwTX4qAR8cTOjhJ612XVlMVEtd2XQSj+6k216KLSc+kJ4RTDkf7:km4RGlLo2KY8Xl+1KLrjUD0 |
|
|
| \\?\C:\588bce7c90097ed212\header.bmp.id[B4197730-1016].[randal_inman@aol.com].help | 3.78 KB |
MD5:
b0af44eb3122d1a319e2dc930b6a23c5
SHA1: 37a60e87ccb60898c852fae2431bf2dcdfead9fb SHA256: 798563407f7986619238b05b74d25c5acda7ad29dbbb4cc6d870d484378eb638 SSDeep: 96:35btrZLYujP5uDVtbn+sRWNnNFRbGavhbSVRvQktf/Woj:35btr5jRgzbnvOnLRiavN4vh2oj |
|
|
| \\?\C:\588bce7c90097ed212\ParameterInfo.xml.id[B4197730-1016].[randal_inman@aol.com].help | 265.92 KB |
MD5:
f5d50b406a0864eeff90e2821153bec5
SHA1: 69e5edcf22af71e833cae380ffa3753d9bccbe56 SHA256: 620857717eaec5ee3e696587b543bce4ddc28d3aa1eca62623bf9e75d8771804 SSDeep: 6144:48rovsadJi6vKnHkcJcurBRfbN/LZ9g1lC:48rovskJitzT1lb5U1w |
|
|
| \\?\C:\588bce7c90097ed212\SetupUi.xsd.id[B4197730-1016].[randal_inman@aol.com].help | 29.66 KB |
MD5:
5e78fb781c239879cfa937f2f448e218
SHA1: f69c2a79c9879d5a5111e6f43328b4154449d009 SHA256: 7c6c06ba7ed3bed38cf73628113d8b244288f8a78428edf6f31f6429a0bed407 SSDeep: 768:MgxOw+GPTx1mLn0CaqDZ2QJ4vIYLjf+ONkduMN5C9:DxeGs0MQQwI4SAkU7 |
|
|
| \\?\C:\588bce7c90097ed212\Strings.xml.id[B4197730-1016].[randal_inman@aol.com].help | 14.00 KB |
MD5:
88565e1c07e23b5e58527b5437197e71
SHA1: bcc5ff8d57e803db8e42365cca26050f83750926 SHA256: a93bda1b06f9b0101e1872136d5fd2ddb33575252e4f276fea504105b1d38c13 SSDeep: 384:53UF0slVS1Zppws4LSSuubL5MuPgJlP45kmz5Pm0dyqo2wj:ZUWlVyRd32uPolg5zzIcyqo2E |
|
|
| \\?\C:\588bce7c90097ed212\UiInfo.xml.id[B4197730-1016].[randal_inman@aol.com].help | 38.24 KB |
MD5:
e5821f49eb76a06660d74e60079784b4
SHA1: 7bbca1e69f250cafe6f5eb86d8e80db7f47d4967 SHA256: 0adcf3b2412bd870f0da9a06f243c72d5441dca6f8379826d88b17604b35f634 SSDeep: 768:0LfAPbynPHuxR/4lLze9wRTHtaEfjEOK+Xegv+6ajZXbKO:08PbynP4R/4hze9UrEOfujJKO |
|
|
| \\?\C:\588bce7c90097ed212\watermark.bmp.id[B4197730-1016].[randal_inman@aol.com].help | 101.88 KB |
MD5:
fed430a21f4f8225b88c74725fee2296
SHA1: 0ff9d64ed5619332f1a123c7462bf6f275e39e97 SHA256: f7afed7c754af639e5b37b6d6b6f4db112f7916587730d1131bd6886e4617589 SSDeep: 3072:Ctej6kvjnQ6J4llpqRKAjqX4hdDXHJN7m:Cte2+jnQ6qllpATjqXIdDXpU |
|
|
| \\?\C:\588bce7c90097ed212\SplashScreen.bmp.id[B4197730-1016].[randal_inman@aol.com].help | 40.38 KB |
MD5:
a6babdecd334ae22c935b5b927169d8c
SHA1: c94b11911f35d5a6f2b5863ac64ed602b51bd76d SHA256: b429b767b8147de9a054c4e9ef1ea4c5eebefc6299ed14d59f5683fdc8a10dce SSDeep: 768:wnftVV0tIjTS85gL12Ajd57PVbvlp3dai6P7A:wnytVf2AdtPBD3daigA |
|
|
| \\?\C:\Boot\BOOTSTAT.DAT.id[B4197730-1016].[randal_inman@aol.com].help | 64.25 KB |
MD5:
b2546f9d95edc296dd179b5eab627a38
SHA1: 07d37a107da3d8f8ceb01f53440df4cda462d635 SHA256: bc33b8ec1691248882975ae013cdb6a1b7d32dfe391c9819c4c36d7ad0441e13 SSDeep: 1536:bZAJjDo1V74f8KNqzhsRrV6di2HKQY5hGhWEvhGpv/2iBF8+Hy4+:tAJjDon74Kd8sioKD4wEJy2iz8k+ |
|
|
| \\?\C:\588bce7c90097ed212\netfx_Extended_x64.msi.id[B4197730-1016].[randal_inman@aol.com].help | 852.27 KB |
MD5:
1b3e031f914f25ee1f0fe9c6c8480fa4
SHA1: 53f26092e191ef65cedac5c7a79cf4d1433456bf SHA256: 05af39b967f457741375303833cbf7166af1bd5e40379605377216f9116a3ead SSDeep: 24576:dZN1f4uc1ABx3x67R7KG+M3vrUERiHu+2w:XNt4uXBxB6Ne4jUEYHR3 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id[B4197730-1016].[randal_inman@aol.com].help | 4.30 KB |
MD5:
1b8ff6d8461e910d3115524c1c3996f2
SHA1: 24727aebc39a7b369438a1ee2e89a4fb407b105f SHA256: 0d280372b9a9c6a0527d876488a7875cc078f030a00d4c629c06f730f98cd936 SSDeep: 96:o9b9YVMZF+aVS+l+mhxpRDLwLb6/yb4mtmjs69rKe1V/0mWo2:o92GFjU2+gx3LZ/LYk/rWo2 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id[B4197730-1016].[randal_inman@aol.com].help | 4.94 KB |
MD5:
33a603f64d7e37e54b24ca062c10b3e6
SHA1: beb06462082abbf33362e7b3867853e8cf5a8f72 SHA256: 69cafd38eb4030a8eb3bcd563b8cd08183f04ad388e760e6ade432dbea844c01 SSDeep: 96:YCO9TZL+i22f4ZElGLOd3iFY8w/Uf92Rk/mZdno4VVd+n6SjRzSom:YCSNkElX3Mxw/UfxO/no8Vd+n6oROom |
|
|
| \\?\C:\588bce7c90097ed212\netfx_Extended_x86.msi.id[B4197730-1016].[randal_inman@aol.com].help | 484.27 KB |
MD5:
0a299c8f93b34900817d71d4295893d7
SHA1: 9353ec5214df0219c53e377760e9e3048cc61069 SHA256: 1f6bc57b81bd6a452ed139ea1432caae0594b3bfdefc845ee3d1d5a764af3228 SSDeep: 6144:sZ7Pj0G9+rt5knQtIXEbWu2z4CLmczs0uVii3YFjmhMEMrDNckCIIHTOU9w7hBFK:sZ7rbG5dmEbWZzUINfpmDIc9w7fg |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id[B4197730-1016].[randal_inman@aol.com].help | 4.63 KB |
MD5:
215d72f459b51f9fc697a140928aaf50
SHA1: 8a41f92cdb4f5dec6bc8bbe002d1d0375435263a SHA256: 3993392babd10ab478a5580f7f30ca0d0bb17947bcb2439a058eeef3fcdd06e2 SSDeep: 96:ghqIGM6CJE0CvvcggQSTGBNiR+rSZHDsAHgkGFyAAP6dTkMom:gh16COP1gQSi0RocHDsIgsyVom |
|
|
| \\?\C:\BOOTSECT.BAK.id[B4197730-1016].[randal_inman@aol.com].help | 8.25 KB |
MD5:
65bb223fec2664cb98661ad838562ae7
SHA1: d0b1542f3e21669adeee8a0b30ba05d3003595b3 SHA256: 3bea836a89f8415c49fcdc12311ca05bb8f4dd8be58cc2757f93fd773b0e7ab5 SSDeep: 192:/qSh/afytSbIQXxyhQBUeiiTb/oc9o+iTjddGQa0ympQpdAAAiWoj:/nmyobzyhQBUeiivR9OHGZ0ymYeaXj |
|
|
| \\?\C:\588bce7c90097ed212\RGB9RAST_x64.msi.id[B4197730-1016].[randal_inman@aol.com].help | 180.77 KB |
MD5:
6c413defaa04e72a30fb1464fec7f607
SHA1: 225d33099d6cbf55de7f2fb050727df05871418c SHA256: f1b71335bf5b691f3b01005f58a44a3a8b1096cef2150ce9be746b0d33ebeb1c SSDeep: 3072:V6+FyehDZYYdH7/EMjz4IWNRmoW+WU3ZLD4xsw4RZHjZ0dko8J:U+Fd1eY5pj8IWzbWTyZwh6Udkoe |
|
|
| \\?\C:\588bce7c90097ed212\RGB9Rast_x86.msi.id[B4197730-1016].[randal_inman@aol.com].help | 92.77 KB |
MD5:
f8f87259a0745eb0362278bd611c4e4d
SHA1: 3de6a009dd0d82120e701c9c5b3e371d85e67de5 SHA256: 01db538eff892217990f87f254059c9ac1d95511572ee146116ffce33ab38387 SSDeep: 1536:4HNv+gF/T+f960OzJnH8KWsgOvqXIG3sblLe7Pljx6vB5WCqUNM68I5xjp:4z1T4OzdnzvqH8lLcPlwDGJ682b |
|
|
| \\?\C:\588bce7c90097ed212\SetupEngine.dll.id[B4197730-1016].[randal_inman@aol.com].help | 788.58 KB |
MD5:
78fc97a13b96a82e5bf475734400e2ce
SHA1: 4f9dd53439fc188e7cf7787a76900c6562ce963d SHA256: 1f54d284331c8fe08cc87151c59eda9792828c0113687da4412782b26372ec0d SSDeep: 24576:euiwAz9fpkseOeM4/dXdCvvMQd1duYltllxM8qZ:QfpZD4VcrdXuGxM8u |
|
|
| \\?\C:\588bce7c90097ed212\SetupUi.dll.id[B4197730-1016].[randal_inman@aol.com].help | 288.58 KB |
MD5:
1c6d8c378c2570c97240d6b86a1ed5ee
SHA1: 9e415c21d5601eb6eaf4bfaab92f75c12891bbe1 SHA256: edaf91cf6f631844ab50f6f73a89e03f7eb9a737fbbf4e7730b644921df312c1 SSDeep: 6144:biHKvoUEjbQSRCPo/NdGi+RrFlWda/UXye8mM5/vnjj9cH7:+HeebQC/Nd56r9aJ8hvn1cH7 |
|
|
| \\?\C:\588bce7c90097ed212\SetupUtility.exe.id[B4197730-1016].[randal_inman@aol.com].help | 94.10 KB |
MD5:
d1c0807ba1d4db475a773bf691142757
SHA1: 2f7fdfc1e689778cff29986e67c25aa3d9f4a573 SHA256: d2ee104016095327116b66dbe81580f9da46f1929eb8f33543a841382018d1d4 SSDeep: 1536:V3Jt7x4tnvXk5jvYBgjF0NBIAcCSYbtCf5XSL4qsnqvfSPlNQ+Mhx47baznQwFnM:VztJdvYBgjF0NarUUf5IYMGzMhx8+LQD |
|
|
| \\?\C:\588bce7c90097ed212\sqmapi.dll.id[B4197730-1016].[randal_inman@aol.com].help | 141.28 KB |
MD5:
1fcbff4a84b3cd8889e2face2ea4c9a2
SHA1: 81e6b95df1cc80f7687c5fa793643e7e856f5186 SHA256: bb62fd667414d3256cad36330dfa81ad6a71554aed4ec19eead0c8f5b86c8159 SSDeep: 3072:D9JtoMrEM4XeJN3/9Nvx/7+65dGq+P8hCE6/jnrAe/qr5y889Ed24:D9noPXe5Nvx/q65MPDE6/b0eCFy8Ph |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id[B4197730-1016].[randal_inman@aol.com].help | 898 bytes |
MD5:
4f4b2d752276830a385045e70647acac
SHA1: 99afe36c4d0fc0f7d41d5bf5982021cae78ae5de SHA256: 5d710b498e455e851bd31ab2565acb763bb1589705c7d0b39b014103ee791514 SSDeep: 24:wGcHtM2aI9rCjs/CTexNSbESbK+dK5ER7p4oCe:wGa+I9rCWb7SbKaZeoCe |
|
|
| \\?\C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id[B4197730-1016].[randal_inman@aol.com].help | 5.71 MB |
MD5:
fc56430604fa242caaf4976e811eb5f7
SHA1: 7fbae35d5c062eabd4678a7e0d002c0c0a1956c0 SHA256: c60b9d03256d7c6cae594de8f96ddd6e9e643c833d1705aba93e1a347a3606b8 SSDeep: 98304:uuEAUjb7BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKvfdF6B:e3PBkOK2Knq45mY4H5OMKkKHdFu |
|
|
| \\?\C:\Program Files\desktop.ini.id[B4197730-1016].[randal_inman@aol.com].help | 418 bytes |
MD5:
aca56f4d3a9de1398d39e3e600a62a8e
SHA1: 2c4f925a218945f708deda33314e347ec516cdb4 SHA256: dffd53d232f1f6b753f62d71aa4faebe525a29089e916a438463893e701ce382 SSDeep: 12:1XMWeHe6dszc5JwBaBzKiPSxocGRQOfrN:db2JwBhoCe |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id[B4197730-1016].[randal_inman@aol.com].help | 1.63 KB |
MD5:
21bec8eb83e2e9e615acad308152b259
SHA1: dc251eb929917b4b9dbcc415391091aeff8c9297 SHA256: b38c995cf7c2ede6eb676fc02eb1a5ae92e99e81246e24e77492af23ec00e08a SSDeep: 48:Ydb+vD1oXV86fQ7Thu2rNKRKJuvaMEX5h1OVoCe:Y1kmX6qQ7ThdZKRKJutEJTUoj |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id[B4197730-1016].[randal_inman@aol.com].help | 14.06 KB |
MD5:
355d3dd1bf2e954f758e958765a67325
SHA1: 3d66a0a14f6384945834c38fe682d2b2b8e3104f SHA256: 8c4360607c8a1738b6472e10ec065fef7a01a79c20948d8bec4619e57fcfe2dc SSDeep: 384:7+FbhIqSWbV9yeDvuG09k98/CJwP8Z/ABp4bP0yceMaj:qhp9yCvujeWayUMp4bMyOi |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id[B4197730-1016].[randal_inman@aol.com].help | 8.63 KB |
MD5:
08fbd7826d5ec7a81057c3bd6fc615ae
SHA1: 23d808feb76085475502dcf4f2b9ce0f7d53e046 SHA256: 266e7be516c6037e9bce69b648677bfb1bd9df63b29b57c1115dad08e8581ed1 SSDeep: 192:K41f9KdzJ+KB3KEAZSJq/qUI3KvKv1WWOvYf/gU1gktnNmKHOmYve2jq8TAoj:PINQw3KRZSJcqUI3KvKv1QwXgQgmNOmw |
|
|
| \\?\C:\588bce7c90097ed212\netfx_Extended.mzz.id[B4197730-1016].[randal_inman@aol.com].help | 41.88 MB |
MD5:
b790da90d0c6c3db2d470430d72b0adf
SHA1: ba28aaf3de47f780fd99f939c6190d4a029b4166 SHA256: 9079e442aee573d221fa746a405405a2553f60de994e7db863d6eb28640df578 SSDeep: 49152:cpSdqU6tLnvVqSK5G22mDgBOOmeGGiU9Erqkbnt7QTr5+Oc2EI+8dd0ZwTse9QOH:CtZKH2mALErq2nt7rvfI+vZpfQ |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id[B4197730-1016].[randal_inman@aol.com].help | 15.16 KB |
MD5:
f42554b2c0d221a7dc6393735d8a053a
SHA1: 4537fc9737dac4f1d030233a5b1b41562228785a SHA256: 8ca5e00c503134d8d9e9286a292a325d90f94e51c7196bef0f72f4fcef667d04 SSDeep: 384:zdmX1X5Wdm77gfaSMsUes850kG/8fUb/zkIKTgJtBujkVAj:zdmp5P77uaHhZ8cbbLKhjku |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id[B4197730-1016].[randal_inman@aol.com].help | 7.88 KB |
MD5:
46461e7540d892a774ccd979ab8a1403
SHA1: c3b42c239e3bb9cd6b99394f0aec93324bdd5a46 SHA256: 6a603d45a97910572b03d83c88b7ceed830fe142dd983be6dad14047e373a8bf SSDeep: 192:neZFRYcNS5Oc90ZtSrZzWXtosSk9VmTSNio2:neZ/SAtZ+C5SeVmU2 |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id[B4197730-1016].[randal_inman@aol.com].help | 12.22 KB |
MD5:
717e7a352b5c60780a204c4668c87935
SHA1: 78a6668ffa9bfc7790e4c063491c3761f3742c9a SHA256: c97aa0db0f8d2dd838a573b8de2b73323f71ee2bdda90b3ddd7fe732d06d09d1 SSDeep: 384:XDolVRiPaOFGbu/+k7qfIEih987d+NdP08f9lSh2:sR4aOMbu//7UI0+X3VlSs |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | 434 bytes |
MD5:
853d4947f2367eb99863429da82772a3
SHA1: 888879218280a48e33554d8ac0b131fb923a3764 SHA256: 78ab2c0e8514000e7a2eeda1d516bf953eda270d1fb0c41a96e8cff38ddbb7f2 SSDeep: 12:Co7FIzpgf8PLWg8P/NgjeEZ+i+iPSxocGRQOfXM:Co7F0F8PFEs7oCL |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | 434 bytes |
MD5:
cd6e25a214e23a6dfc15d62d8902699a
SHA1: 531e34af5f850fdbe34d3a29485c3429fe14b54b SHA256: 0bf8456b89c92eca28f0b55e4e4add41cab1055278d577ae884f2475d46f453f SSDeep: 6:UlaLWMmVnrXQdkfnWbGWBeHBDezVGbjHzJ1//swGAEJA56N1krh80XY1PP8pskom:/+prXhncBWUAb7vZE1wiPSxocGRQOfs |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | 434 bytes |
MD5:
9a8cbfa4995815e2121f2523bfefcd87
SHA1: f791ce1c50449d0a6caab858cce348b8bf1af463 SHA256: b79547c9babdf35108d697febd642705ceecec54929a5b966011cdf852691c90 SSDeep: 12:U1IVQ7zjT0UBR+Gihkgw7VelWiPSxocGRQOfXM:neAUH+GihlwMlsoCL |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | 418 bytes |
MD5:
1a9bc898a43b5e5344761f61323293d2
SHA1: c7b3c20c4374448f5f802426b8b2817829169fff SHA256: bbcb0e8bc852dcb188a5f6d6a0fd9abfb01a2a88cd7146e47a8ec0793cb8899d SSDeep: 12:9gPOH5yl1qtDgkdT+wjKiPSxocGRQOfXM:9gPOUeD7JsoCL |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | 434 bytes |
MD5:
2f09ef69035e6d40e27d45f042cf914d
SHA1: 313b41e869a18d066b859ec6ab70cfdc08a0f41e SHA256: 4f53ccd9c8d2deeba8aeb57ae9bf3b9107300536e410f891de5529bfc529a65a SSDeep: 6:fwly4Lg5Q16lzqbjKSLt6VEuCAzpAeRZR1bcKcpZ1PEeE80XY1PP8pskocGRQhS6:Ily4voqTlaAknSKKZ1YiPSxocGRQOfs |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | 418 bytes |
MD5:
0e0f1f88c045ac7ebd575c276904f41c
SHA1: 98e1c930d7f51db34dca223329c75b0ec2c5c3d0 SHA256: bde0a653cdd0458a72af573235a3265592bdef9e8204e74b1a60838f41e76231 SSDeep: 6:DK/Oi0Avs3GbhP/zfDehuTarBaXfsKo5h3VFijb3lbZ0XY1PP8pskocGRQhS1/f8:DQ8cN1arovsKobli5KiPSxocGRQOfXM |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | 434 bytes |
MD5:
55cb4df35deb0a7baa559b8aded7a195
SHA1: 0c070d6619ccf97dae2c4aa477872548ea0f206e SHA256: d3c300b850817a980ba79aa87b5396f4a3a1fd097c0ad66bd9f8365ccd310b94 SSDeep: 12:nRf9sD397cPGzagsEcXJXpnnQRxSTQ6p48lRiPSxocGRQOfs:nRVsD3xXzajOkQ6p4c3oC7 |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id[B4197730-1016].[randal_inman@aol.com].help | 4.38 KB |
MD5:
3308649e7f797acbec4537f3ab6d95ca
SHA1: 336f3ed4951d5eee68fd484db8321fb90db3a6de SHA256: f7fa4f05ecd0bd89a44007d89f7d31f72918c8d2ab0329d3a8c8fafaef699d25 SSDeep: 96:sy1SQNimXwmXRnnbg8DLmLj2TKE8y6NWTQAsPCeoj:sy1UmAwtnbVDLmLaV8y6osqeoj |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\README.txt.id[B4197730-1016].[randal_inman@aol.com].help | 290 bytes |
MD5:
e7002e476962f5fca982d8fcb9b79b6a
SHA1: b9c26f1132138fe9caf2ff05144ada7e3831cdd4 SHA256: ad695ff831de15546f9fddcf35c4e387ca35f30c9ae9b460972fcb24a384e5d0 SSDeep: 6:TJHWY7j2LwwM2ZBi1g0XY1PP8pskocGRQhS1/fjXN:LSzM2ZBiPiPSxocGRQOfrN |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id[B4197730-1016].[randal_inman@aol.com].help | 103.27 KB |
MD5:
c4519e35da6da14a764284fca60ba3da
SHA1: 8f0664b29729eeb7da7d4e4cf1d3d09cd8326e78 SHA256: 26f9ca6d6aa77eed8bcbda3e293b8c59f74c89fee6310199801f75f39fc28ff6 SSDeep: 3072:ePimzZxs1H88wGJqOkJ4sg+6Nr+8oRNax:dmzZxs1cQIOT+uvoR4x |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id[B4197730-1016].[randal_inman@aol.com].help | 62.72 KB |
MD5:
d6da66a0bd44cf044b7c14244a317064
SHA1: 3f81ae94afe08af8a2e30a1ac8e61547cf14d8de SHA256: 24ea0dfde83578c2e7862f139448061968949101f232c519dd67bc742b2d5cc5 SSDeep: 1536:ykF7QUBIrM9nQ0XBIVZUaB+Fs5FDfL6ti5CvokIko6E3fIg8oHw:tF5BIrcQ0RIVfk4fR5CvdeAoHw |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id[B4197730-1016].[randal_inman@aol.com].help | 142.05 KB |
MD5:
69add26ec617e881c7452c976f4c8fca
SHA1: f79f88563e721bc341b998b7c45a455b5ed00301 SHA256: d95f2252c88ab6d4c81f54d330fee1c6a54a1cf13906e938eaa4d7703c44145b SSDeep: 3072:hdQhip1cIn6y5StMIEfpAWToh+XLqrx6Iwpcqd7EpcM:hdQhip1uKjp1A+XL+Mvppde |
|
|
| \\?\C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id[B4197730-1016].[randal_inman@aol.com].help | 2.84 MB |
MD5:
9e537f00804c023a0934b1a5b6c27763
SHA1: 81afc24ea04a97a90fb40429ccf5a8931f95f36f SHA256: 0ca737ceee04f7c76b47dda700b90e5eecc4e760585826d98b955d874714e550 SSDeep: 49152:WV4YaGoDumT1r7AdXZy9KU2KUYxs35DKZ3OIK74Tp3GtcVasUulp:WV4Yab1PAdXZzKUYxs3pKZnKkxgsBlp |
|
|
| \\?\C:\Program Files\Java\jre1.8.0_144\Welcome.html.id[B4197730-1016].[randal_inman@aol.com].help | 1.17 KB |
MD5:
37f2ba8e996be5a9ee0cef762189be19
SHA1: 3ed6e944a2ec2405d0ccaf3ffa8f852785997853 SHA256: 1331ec06d6cef651b134289a6aec6aeb6ed4d002e9c3f89b04d9ec8b6ca45e9d SSDeep: 24:+sg8Hg3Dunv4Co7+Cc1qbfnwRRBYNya9hH2GSH6PTPwnZ+hCNL8oCe:9nvVoHcSfyIya9hWOBhCt8oCe |
|
|
| \\?\C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id[B4197730-1016].[randal_inman@aol.com].help | 546 bytes |
MD5:
154b521cfc3f6dc085aec6749ad237aa
SHA1: 188aeeb5dc2406d678a4d597d594abd574320b64 SHA256: 90d547d5cb795d42d7194f2ae75ac127ec28bc565ce1ee83388d62f34d940d40 SSDeep: 12:Am8rvhGVu/w8ZhyPQc8Umjka+OQFMt3qGiPSxocGRQOfXM:D87hGU/G8UmjkTFE31oCL |
|
|
| \\?\C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id[B4197730-1016].[randal_inman@aol.com].help | 170.69 KB |
MD5:
d6c91ce37466f5c4e4ebb85780a5fdf0
SHA1: 4015474f17781c9e4c1f921fc75b4673f4c44c71 SHA256: 1b3b248fb636fe1ab85f26d338013f50bd5ff4c3d41d7b539326893aa6d1f30e SSDeep: 3072:XrUjXlgrJt5yMBXkqT9flP3m6NFusIMe9nSTCg/+wcuM1/vysx1YiW6AJ2D:CXlaJDBXk2d3m6vusIMeceqcV/vrx2if |
|
|
| \\?\C:\Program Files\Microsoft Office\AppXManifest.xml.id[B4197730-1016].[randal_inman@aol.com].help | 6.42 MB |
MD5:
1fbca368ce8189648ec7ba9c74f4532f
SHA1: cd131e9e87f6943f60a6a0f33e110cec0369039c SHA256: c654ef64bc7edf3192219fe1437f2adac1e6fc04e85937f00c980260e7ff6d8a SSDeep: 24576:54vzz1Y5Zj9Y6AOwaWVNWWHHzRu1k/L9chbUF/Tx7mWqn3gVtiBwGFwRusBwlNS0:5qk3NIX3NIIaQWRlAbavsjpyB |
|
|
| \\?\C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id[B4197730-1016].[randal_inman@aol.com].help | 92.50 KB |
MD5:
3474964b81cc337ea15b153f0443be9c
SHA1: dfec5e19d5f22af8962f490e7743ef7ae1bce1b3 SHA256: a2dae7445e73ae3791fea3aae24d54d6c14b3e85d9c3c480c9bccb7329b1a472 SSDeep: 1536:Q4yZje4j5r7k8kk4pfnnzNk3xg1sQZHXphYA09KB36yPa0qZMpKHD4g:QtjJ1r7kbk+fnnzO+CQ1XZy02Mp7g |
|
|
| \\?\C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id[B4197730-1016].[randal_inman@aol.com].help | 35.74 KB |
MD5:
f743a90b48987603fd71dba7021562f5
SHA1: 5df6518e7aee066ec6186f17896800472913c3e7 SHA256: 9a264fc1591e73011572c8eb91be408549ac96d2fca096b2a9650c4983cf43d5 SSDeep: 768:LvNNNS8fQBzqtY3QZzFvAnA9bvOhGg5xYMKQ8JBwR4ks0CSwcU++:bNcgphZOhrYMKQ8JWykx+ |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 378.60 KB |
MD5:
68eb58b6b4bf69f51ec99a7881fd38e1
SHA1: 0189876acd366b0f2726763480081b8b38d9b08d SHA256: 583a2cb2b2c293ee298bfc8981a9e9d4051ff31f84f482440068dba0098274e9 SSDeep: 6144:EpHYnCBV/wOkS7282jyo/PyiuYrPaYnkwosBPZo1yKKAdyYaxpOXutzB1T03TLQS:EpHYnLlE2PPCYrPTtoQCyKKAdyxxpkuK |
|
|
| \\?\C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id[B4197730-1016].[randal_inman@aol.com].help | 5.61 MB |
MD5:
221599fa17f6b5b510f8c82794fbb8ad
SHA1: 332db58fc0671f38d4098dd31a8cd36488a3ec97 SHA256: 4058f3160b26841c6c545918592d1f2eaa9e2834d56f385844a9e9d160d83cf0 SSDeep: 98304:Ef0pKGBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDKuhgphC6oHsK:27GBHTK8KXZ4UuY1kB1iKFKuGTC6oHJ |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.81 KB |
MD5:
4c237e8f339b90ec41b70e16df7a469d
SHA1: 059e97b69f6b610ec50c3dd0067851efa22ada8b SHA256: a2a2958f982b89a78178284c697009b3e0e0f106b6c7619f4e2cc1126a2660e4 SSDeep: 24:+yHCJZIjhoptU8E5ZDJNGK3E0twv8FGJHqmogFGkGnAmADkITqxEs/E1BDreoCL:+qKueptLklJNGD0CgGOB7A4EsaeoCL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 782.42 KB |
MD5:
4c6a6344331a3f98bf448a01e2717f14
SHA1: 9360676aa54138f7851127254370b0ba537a39a6 SHA256: 28840428f30ca3c79f27c4eb17da78a2d9433f4210bf52e5e27777f29959f260 SSDeep: 24576:0Fq8PdtxzKTwMmm1Dec+c3oIoo4BNfjWle5pYn:i3b52wiDejcFx4BNfyE5pYn |
|
|
| \\?\C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id[B4197730-1016].[randal_inman@aol.com].help | 2.79 MB |
MD5:
6607b6db97217b1c5d11f3b9e2734f1c
SHA1: b1cbc02fb091ae3d701f491b943cadecdb32f692 SHA256: 74dc069e2e5b9111e418d1677cf3a1759f97472ff33bef23ae11a8d99986d645 SSDeep: 49152:oJ6tDuv7GuMRau8yuXQFKUYcs3HVKf3rhKH8MleYaWt52tq3JR2z:oJbGnRau84KUYcs31KfFKcMlDXEtcoz |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
89ccfcbe4a852b533fb34e940898a8b9
SHA1: c1c9907925ca27b6416f86630d1b7a22583d8c23 SHA256: a74c5fc317e98cc12e00b3b7a205947572d32d070d7ffdf148e87ce66aa51be9 SSDeep: 48:AmlgCz0D1yP0j/oHa2GNi4kMGtxKkf4oCL:NgS0RLj/oHGNx5G+kAo2 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 485.21 KB |
MD5:
dec5900bbc244e4efd020bd7fcf3574c
SHA1: b5f4520c264a71215697bbde109d9402a99f4104 SHA256: e92bad9933b67a0d650f6d047baa64731436a9692d0060a18279242d477c1e68 SSDeep: 12288:Tt3n/l0YDgB7tp3l7wC3Oq++5qQ5q8B0ML+PKZGtDZy:TpfgB7zJwBWt50Wwny |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
3eb345ae95f24dadaf848f1e9f36294c
SHA1: a1ae4dcf9ad197ac3f2ba87031668e6380cf381a SHA256: 6ceb94adcb4575fc9a3d7399b7cee323397b91afaf0fdc6fc3fdac3bd1cb29d8 SSDeep: 48:FmsJwGpiO+wzoDodOYd3jnnWoXu3ZcLoCL:FmsOo5ysjdTnFWIo2 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 248.10 KB |
MD5:
096ea30337493d81c06d721c82cc4c22
SHA1: 8355363e8a0c32d27388a3ecd5f8c018e31dc926 SHA256: b12b310335c14af49f2172c8efe5bb0d8694476ab5b49a1aeced3c187a8cef0e SSDeep: 6144:0tsu7F7FIzhBQqhjkH+8CTW4UzGib7397D9f8pMiV39gCg:0thF7ezTK+8YW4iNb79m6iV37g |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
001422f54278383e92218d35e106fd18
SHA1: 778d28c465e2e19d35d954e6cf3ee9f49c3f881d SHA256: 3de57cd3190f7334d3d96552ec64eb2d3341bdebe2412db7224f126d22d23d19 SSDeep: 24:L8zImb9Qdk3NJH++aA4pShHwk1m8yFu7dvebXIRAzOTcTGdwr/KU/PMkNGBbjeo2:L8zImfCfqhOu7dMHz8UZ/t4eoCL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 19.31 KB |
MD5:
3123d603087c2fee4716142d23ad81d8
SHA1: 72976237926fcba02a006c37aacd9604d79ca1a6 SHA256: 0d0d602d2bff9d9a0d1667a8b44718dabb69f26ff90b57b826528120f01d4d21 SSDeep: 384:Y0bo7axG/W2TP4nHAWuXS3vO0FEKl8TkZGb66+KOuZfZ49wyJfrx8OVa9yyYw9d2:Y0bdW3UGWYkZVOY9wydrb09xJ9g |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.07 MB |
MD5:
87cf32682d8e974cc9267d5ae6d4d834
SHA1: 7d3f08c8972952e3dff92a7963c56cc29cf7097c SHA256: cdf494c5f563eaf25be7fe9b6ecc081fc05f2344fda986fc9722450f7fe4ec54 SSDeep: 24576:0fPsXLAA/PHOfH2TIEDWedg5WrNtVXLWS9GUd7dc0tAnz:0nMAAnuf2bdgwhX7paH |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 745.80 KB |
MD5:
82b358f25771d6a10fc0ed081fe4adb1
SHA1: b2c16217b7a3939bb668b10b5bf4a7c25cd82169 SHA256: 7cbddbe87c804dde2b944384c9569d8a685f42689744f9d0b584c437e9803aa0 SSDeep: 12288:XVi9xZa9RAqDmwczW0r4HxUHMHA6R7gH5YsS6da6e8v7OTKJO:XVi9udmzzWG4R5HA6cdxqKJO |
|
|
| \\?\C:\BOOTNXT.id[B4197730-1016].[randal_inman@aol.com].help | 242 bytes |
MD5:
189ec10f9a0a9448dcc63d625eeb2ca8
SHA1: f9d30ad6bbff42c83062bc2b3bdb376fe6c86665 SHA256: aa8ed45aa8fcaf56ab51a4e2e17b0f2b7c95c3abeee105fd2f103c468e684bb1 SSDeep: 6:PXL5JIMWsCUo/FU7Cf5Dpj0gaWVXsnVXjHbUVBdH5KA:jfWsCEMth1X+X7QPV |
|
|
| \\?\C:\Logs\Application.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.27 KB |
MD5:
1c24c4f2a7281207fe9c3e87ab11510f
SHA1: 9124cf59e1a23909b554f6a0ed7a2176a0fe4583 SHA256: b418e4a21f99d1511012fb8e717bb08f94e772a407232db647a3d1e5cc02b9d7 SSDeep: 1536:NoZ3TIOcgrd/UJFJOP3AXqVVjWl5OlPjVqWG5O1rC/Q6bFeq:zb6cJF23h8LOdjVR6bFeq |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
7ce0c1328ef805a123f38c5aab57908c
SHA1: e86b01100e2d478c32815a112141cf606b305faf SHA256: 120aa94fae7ad8926a4838c86863d8c3b6bbf01df2c7dcb06d947e90c426fda8 SSDeep: 24:Od9EWmc8piGxBgQMZm3DU8UEkoWxF8KlZ44244NawhcK53rhjBrdoCL:cEWmcA/UNWDUU+Lt4NaGV5NjvoCL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
9014b3026f50ffc92323bb809d43bef0
SHA1: 4205b1cbc594b297be6c491ac1e819b59f66de17 SHA256: 7777203cfa731b02cbbe7c12df86c2f6136260b8a61a12f00d2829865c97e1be SSDeep: 48:iw4ndA7j8hF++6VYvdkBuKPWfErJqnHSbuoCL:9j8T+BVYvdkBuKPWZIuo2 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 2.42 KB |
MD5:
2e1553a5ba6e12d209dfcd536400e1be
SHA1: 36cec0f8222aea9dacc964793cc14676c022a6a9 SHA256: cfbe1a77435083c0f6853e5e12b16a24e3ad070db4b55af454e3db77b5756a51 SSDeep: 48:DjQPqM3/UTmmGdhStwTZrfqiEbi8k6iC8XyoRYZsv6Ny6M00olYoCL:DwqM39m/Urihi8rAi2+I6NyL0hlYo2 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 2.42 KB |
MD5:
706cafea58908699db0f55be1121b799
SHA1: a81c5a2d759ef7cbbdf454961589d542510b709d SHA256: 653bfe720093272b10d865f1c19f7d9b60d9eaf6415548ece02cd36c2de82207 SSDeep: 48:1swFb/VSHwjr1MSsJUKOjLMNEIneomPrQPqZ699sqdGcXw703KN8qoCL:yqLjr1YJUKmLixehrqFkUvqo2 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
19496811d12483410058b378e22cb06b
SHA1: 0f818321786152a526db3f166dbfdb50f47c94be SHA256: ed2ab0cf42c3867626b20a307b230acf18cfe5b266972db4e16db7c00016704e SSDeep: 24:ORJ2D2xbJ7zJO2QVk7YiBBjMvGrbLtvrP33DkYdAcFmXoevg4/Ta04u+XeoCL:YkiF7lO2vYih3LtvjTHu5XJvLbaXeoCL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 211.14 KB |
MD5:
af7bdeaff9730aa9a76de4dc1ede819e
SHA1: 8080c261dffced3159cc591c85d73630d352eafc SHA256: fce7331f139590d47ceb261f185a8ec11ec0d28ccc222f5bac4085bae99758e2 SSDeep: 6144:qetSRuzVyFg67JhExXzCBRY7fAVP4Ih+Rk9dNLj8P4ucEknWzm:qetSK426PQCYc54IHE5u |
|
|
| \\?\C:\Logs\Internet Explorer.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.27 KB |
MD5:
1b12c596144bc6ada16cd9ac2d454c8f
SHA1: ee83cf76fddf47028bc6f2df7e65a00c5ed752a0 SHA256: bd8e7077729ee97368e0a45e83366678506dd427ad858db9cb9a1531e9b0fb04 SSDeep: 1536:LessxBF+w/GXKy3kxjkvgJjJinnmZ1sNAWhgx4HN:3a5Oay3ekI5AkQAWhCoN |
|
|
| \\?\C:\Logs\HardwareEvents.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.27 KB |
MD5:
15fc9f780533c000ed635afad1bd29ed
SHA1: 3854830b82d6231a2261bfe24e82f063a0ac38c3 SHA256: 672d5e1756a9431c63e3a1729922714cde7af8a1e4e3ef25fa8b142687d3ebe8 SSDeep: 1536:FBSIl/O9MRXBxJsEPgvFKDECsKSBZerYTSG5AJD+:Ttl/O9Ix/Jg9KYNTerY2qAJa |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
16de06d837cb481dd92ae00efe401b26
SHA1: 91480627e7ac05176fa931a5e7f753dd32965cb6 SHA256: 531ee7429b25a7d44274571bf5462cf75f25a5f797807249d4d3ee1cc9c048a2 SSDeep: 48:jJJd+wUof0W9hIaTQ7/KANSOX8hIrYsNoCL:R0oM8IaTK/tX8hIr1o2 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 335.61 KB |
MD5:
6c82a7360572a56c9df688edbd2330e1
SHA1: 32e34413606ed8b0d321a075b8f8b2e77c631be5 SHA256: cac6e73d560d03b43c623d6843bb6ec897455b22529a62d6e16934bb3ea9c590 SSDeep: 6144:97nHrahtBXpQna8K4KmNp/wD/NQ1XGkevEV22nWxLzzhcvfB06MoLjS5f:8htBXpQnRKQYQJGZvELnW9tca+e |
|
|
| \\?\C:\Logs\Key Management Service.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.28 KB |
MD5:
68c3f26bb17da8033d9f6f633b996433
SHA1: 059acba9a8a36cf77e89e637cdbf909aba5d0e04 SHA256: f01c71a6d56f619bf35e6d4037d8223a0f617ec9832619af80ef44b55aff83fa SSDeep: 1536:fBtnFM60x6WUdpnlXCSdGORLseIzjfhj8PVLsqGIzZqnAqJqPjwc:7FM60x5Udpn3dRRPIHZju17zZZq+jX |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 14.89 KB |
MD5:
826a64c6e61ae52e9cb1d80d9250a862
SHA1: e6431556bc7e67cdf8949589762f2c33bb6770e6 SHA256: c4084d35d19b7303a55fecb073df1a03bc2da9cb0cc6a4034c55326d732be338 SSDeep: 384:QGD7CkIUHkqAGhUjj2/Uv0r+aD27hmSIcpg2:FjwGh0jsU86ayhIcp5 |
|
|
| \\?\C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
8255a09a3accbcf38c900f095193b43e
SHA1: f3fdffb8b0dfc15877b3692e98b95d7b82f8ea65 SHA256: e6291f656b411e9c608dfe904cf3f2ce3eb505628d2d02c5471ed290bee00a5b SSDeep: 1536:2OikZDPCrDlsPw80UjqemnJjFpLcpHIxRgyshD1ePE8sfdxTkK:yKCrZ80yqeIJcpoNsZiixTkK |
|
|
| \\?\C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.38 KB |
MD5:
da6c4a333e0783cc474ebf1aa1ff3af4
SHA1: 727061bebd8fef82aa7ffe2b27e6d6a0e26e52c4 SHA256: ff689d77dc94fd66eb948ebf413010adb9f6b2b003db328ca0b442b34ae667a9 SSDeep: 1536:Sp3NMUAJZfmpuM58cxIbVP37Z5JLwuMH8f6:SIUefmpvKcGhLZLwii |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
bfeca1e3c710f0814bb13b7c5b76058e
SHA1: ab95bff927db45730ea0459bcf3db7e0ed0f922f SHA256: b2d5436304092b9077f3e79fc5d5781f081d5bcd5bafe202553acfe2f20bf046 SSDeep: 1536:102cTYNtxNZSKYRWbCoeDj7wRMPfMHBl1PjR8ReOaTdx:y2U6piw4j7GMsHB+49 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 63.80 KB |
MD5:
588c275b6e42b700d5a8b78663faf84a
SHA1: 8acda76a450ca55234000d7308a9602a5c82da5a SHA256: ea5486009379f89ce4d620400e19464a3173285d3d6c6fc0b37dae5ceac012fe SSDeep: 1536:eVTu62J6Z0xectxKu3vwzaOR6LJGO5i1diPQ2ZNGZ5:e4J6CxecSu/a9UL5YdaZNGv |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
14e4c90cf602317302f7e3fbcb4b6029
SHA1: 86488fefb29021fa823810edd61a0c0336ce7d81 SHA256: a45657d008a22c0e3d1dac32173912f579d37cc59fac1254cc40c5da24ccf322 SSDeep: 1536:13v0gv6ZMwttbd9FmrJWm4eI3XiWJ00oQSGYADaYv3XaugvuRpJG:5v0dh9skmztWa0jS3AWg3Xax4LG |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
f0cc4b0a8c0be2973a1459aa04eef10b
SHA1: 5bc64661b8ee767e5e99366b00f908a6ef021f0c SHA256: 5cf69f2b8a724f0950c939008864a70d35307f45fd85da7a387bebd7b6664b86 SSDeep: 48:T5epvdG5kdLVj48h24T9ugnhhjva1jHsKXoCL:6ACV088IYghhijbo2 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
6bb1c380c1ce6d753088432fc6993b9c
SHA1: d3da559e0ece48ffb352839b6f63bebec4ef7e28 SHA256: c9d1a44ef2ad67aeabbe49919182f87f5b25c4e8456c8aaf2fceb7e4c3781ac1 SSDeep: 48:5OsZp6idDnrE4qG004sYvrHHIOYYEnQooCL:5O8p6iNng4qG004sYvrHoO6Qoo2 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
825cf796e386a62383837de214f89de3
SHA1: d76b6ad009830ecd2206b84cf98c4e4460d62918 SHA256: 748a0375fc2960da53f652b706dfe5cbf79db244edb848e3de1185a102c64019 SSDeep: 24:cFIgqltK+WSMNtYzDnPrSvD71fG53VuNP5FrawpH58HagyegoCL:UMK+XMDYzKv1fWVWP5RBJ56NgoCL |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.35 KB |
MD5:
27b27d32ddf7068b206fed900352256d
SHA1: f7e991e3ea070390505841b5e93b57b150310e40 SHA256: 8cde70d1345cd363a64ae6a2963509427f64caa3e88f17377f284c9965c9e18f SSDeep: 1536:UnUebejxtW9Ce0JDwSgCpdnmKcK8Pt5U0:+UewF2Odnm4AA0 |
|
|
| \\?\C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 1.00 MB |
MD5:
658b30a2faeb6fac921de03c90102676
SHA1: edf77bc0a6eeae5dcf1042c39c73d70bc4df4e71 SHA256: 42191697e3f4fad4aded9c6896e27ab9305fb232713b149e55ee804ac1b91166 SSDeep: 24576:Kko/uq2wF1qJDADL/XRLpVDUvotUDRwB1q8dzbn:Xov2wfqJEDbbVAvooo1q8dzbn |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.35 KB |
MD5:
f6e7bb9ad9a3bf6083c8000f28c3add1
SHA1: 5090d23a772970828e9bce5d6d39727bce6e5cd4 SHA256: cc5adbfb02504f2c99018ed0a353d46c66397001bfee9040b5a10f9fc65b31a2 SSDeep: 1536:VN8+GOaOGn+gd1E00T4o4lDe9UdRAvjPOgS0UPVcsUM6gf+ihD1XTD5:VZ2F+gdyTIlDe+RAvjbSl1bjV |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
f43c39909b7717d720a690ba1b8d9939
SHA1: 44e8cbb6fe62b74a8b34ea7dab1fcd13eb5b3b2a SHA256: 65463b2b0647ec7fff17296598c8334c9b49d914627876c57eedd67dda62d43e SSDeep: 24:MlHv6UvJKTwXqGIFqjUKqNCqyOIK54aTsV0gd3l4N/EOhTexmZgjoCL:MxiUxcThFqj2c/KZsbJ6N/EORKmujoCL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 9.33 KB |
MD5:
4fa833d0803f5e599aca988251607b23
SHA1: 299b906339dbb71c7738323bc3ea18b2300cc3f5 SHA256: 956e882e1e64c5a7eef75208b2d29c3e7a59458abac152c7bdb93568c145bca5 SSDeep: 192:Kz8rIkceoERArMOZ6qGrpZ6tCauY73gGLoVSz5YFnF7ao2:KdIRHOhGrpZ65TgGLNtinJD2 |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
4d240bc66fec33243ae13ebd0679ab58
SHA1: f8c00e773b1c7c0b8d7366d5a671244a4d2d0d02 SHA256: 849e3e9d778c85fb657bfc630dfe2616083c5c328ab0f8a96eb2c94e2a0e6fef SSDeep: 1536:aHkNiTBIq7FcFl3rn0hAJ0mta2Wl9sjOzjb04xN:aHDTBuFlQ2J0mzWliji04xN |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 390.49 KB |
MD5:
0329ac756cacd26f531137c929ee663c
SHA1: 2360415ce4005bac63c24113d4e326a118ad1458 SHA256: 97f42c4283011f39b45c74063435f08cc8d8abc70f34259bc0477c53e24e1ceb SSDeep: 12288:kXymMdr7THl+mZo6v9fzPTFU7pv5PLKKh5WaHh:kXidjbLFTFK5TphB |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
357dd3bad9a26ab5a2c5c7f85ff1c4e8
SHA1: fb11d8dffe19046d3a8152aa4dbc9babd9f7b543 SHA256: eeabe4d31a1733d74d57881cf8cac5cbfd2128282250d32f6adeceb2184931ce SSDeep: 24:b1ZMQ4Fpl7nygjLKVtP4jM/R3tVc7tWggqd3yjrBA22O4YeZsaFe/ooCL:bA3Fpl7LLK3jlcJW63k6/YIZFe/ooCL |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
dcd28113eecf1785bf89d32b2cf025b4
SHA1: fcd5cc02de4bab86e7aeb819cf1742068b2affec SHA256: b8ee08be02f9c0217012eb6238e63908ab53c6963de273157d6d7f5f4722c5b8 SSDeep: 1536:IXJA3R8VMGziS2yXB5nsynXrklsZMHd36GrT6:iJ0WMkVHnsydMHd3lrm |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.74 KB |
MD5:
da01dffd1d15f8fb6d4a926fa9cb2808
SHA1: 133fe4df3ecc5417d4b5b1408edb159ba97823c8 SHA256: 63c5d540e5f40982910d0d51fbed108801a228d825b042d945332c1cbdccd034 SSDeep: 24:mdtorg7oIpyIOyUBOfH3EW2yc0UTrkWyn03T1SyFryNiplzyxmXD+RFaSoCL:MF7op9BOfHhVqbDcyFrykOxb3oCL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
4c63f8194521dd04e7ab1dd813d7f219
SHA1: d0364c46620fc054eb7113a163b2e1219da8d74f SHA256: ecceabb35580b13576cdfdcd3eb0573667f5f44bb3f0c742c7200ca00f2ffe91 SSDeep: 24:g9sMEvaLLCfzHoEbdheHKbzQ5mtKsBObDY4EhTn/+cJjdTzX0P0ROKoCL:gurv4LCfzHT/XQYKYmqnGCZ7RVoCL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 3.99 KB |
MD5:
818c1153f8e52cc7664b8b03df4f1b9d
SHA1: c4693e82e491632dc8b738c246df0b0a8401d022 SHA256: 8f5fb57308cff5e0b138c27384b98adbfb2158066ff40652f20ae0470fb28198 SSDeep: 96:o1oR/3ugM80R00eU5nuhdfP49MjmZ/JPe8DplX90Zqpeo2:o1YrY00Rl9deq590eeo2 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
ecc015ab70e4094fa47a252e587e6eca
SHA1: 9b1c74dcda86a4bd34d999344e686a85db5e789e SHA256: 396f91203fef880d14a85f51f3fdbf6bf1887148d150ab3f7da494726c172ff0 SSDeep: 48:8ttr6dbmRAEFc4lQNmLf2QclT1w0DPledl7foCL:sSEm4lkmLf257wEPsdlTo2 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
14ecf2ecb206b00f55f884f410f3c846
SHA1: 85b0ddaa7e8917003a7090ae6d588064a09247d9 SHA256: ce6d802b2d9a2127890756473b123b20d3918c4e4fe24e2339410cb75342afcb SSDeep: 24:ThIAbFkMTTGnbgWTBYgb+RfPFacc7uOihw/VnmxkBEv3QmUeEi7itJUoCL:Lkk2MtDsDN0w/MOBEv3VikoCL |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 515.91 KB |
MD5:
da190a7f51513edb04c62da79155813a
SHA1: f2e48544e8764a829559e4df1b2d507ea5e6aca4 SHA256: f8aa2b643d6517bff2fe40d61318347277a188461f741a3bb23fcaa26c35d6dd SSDeep: 12288:Jyk4Mj4is5hpfBx6EG8W95KMY0UammcgPbZb47dQzECFrJN7Org:Jlyh3x6V8iKamJGb2KzL/Narg |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
d3a4ecdc9b5a276d74901e5d841d84fa
SHA1: e7a5e16309374cefe20783e581eed271b774d63e SHA256: 9c4e4b7278e517f7cd498201031803ceedb968bf41f8df7086535269c063711d SSDeep: 1536:tWLVogaXi3m/CbxTXlN2m/5ffoOcFWN3SfgSMaNVp3npjbtjE7:Qp1aX61xTX32m1vcFfIoNTnY7 |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 1.07 MB |
MD5:
dc5f56b2063d5a1b702a468c7cee08c9
SHA1: 84559312efb92ae585592454321b04ea56a95935 SHA256: 4a7f0721b75485844f6733283a88d9c842f617d06544181f08c4e20e07ee6dee SSDeep: 24576:46HuaYSH6lbwIYpwM/Bt2drA3gQCOB9Qs/SECwIoLgZX:ruBu6lbCwMJwrA3g7OBAsICg9 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
9ba079065d106a58152b4f6c8a9f33dc
SHA1: 9de8ff5c67b52c0732fe19309c7b6955d01bdd85 SHA256: 3480d4b321751b61d9f26eb0bd1fc7dd6dcb7747b0e7efb55a75ac67e7e2ca4f SSDeep: 48:g7OpaCZN+lL7awWUkr4Ms4XF570I0FoCL:gZqN+57abUk0MHoIio2 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 1.55 KB |
MD5:
da481698c0c8730e8a732766b056bea1
SHA1: be4a3767d9b43b200202264ddf86736e6f5d1298 SHA256: 1e3eaca1d142b0c37279dcc62be71baa3b4cba52bfd6530cbd38847f6ca01e8e SSDeep: 48:RbP5mb9VrsalnVEk3zNvAN9NM+VM3XRNoCL:xP5mTrsaJVEk3z0N7VWBNo2 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id[B4197730-1016].[randal_inman@aol.com].help | 2.82 MB |
MD5:
a8917caa32820a36061b6b4f2266140a
SHA1: b4c412a45d1dd1e6609943509ac00d1f90c6756e SHA256: 747be93c8350ebb6fe64c463a14948aa4d7eaa85ed8e92f5fa647d211655a214 SSDeep: 24576:4zHClg28AWsJ+orkWFazeFN2wDXv3jgfEbX+:4zH4guWE+zkNBDXv3jgM7+ |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 2.82 MB |
MD5:
53f2601f4255c67f93d2f252cda096ce
SHA1: 8668125f1ce9b2a19610e14acf735262f1567955 SHA256: b0164f600f2a8ab6f29ecb93ea806453ccb1d738df361092818e9d4bfaf86499 SSDeep: 24576:b56chyx8+0/iB5EVoAuN1W1N2f3mTUpxi2Lb2LhQ0FwtyZU:969v0ac+7w1N2+qb2LaeCyZU |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | 3.61 KB |
MD5:
7c8aed42b6073b33fade3a4684f7dc45
SHA1: e6a661a8d534d7d0b1bbabf9a1fb4d2896a9f921 SHA256: a5c0cd458cfe16d3a4218a9a54a390c2311459afb7032eeb5636446a67d31c7c SSDeep: 96:65+YwYJpCMY5HzY5jd0DLmYwR3H1WunMSn4o2:c+YwYm5Hcv3MoMS4o2 |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id[B4197730-1016].[randal_inman@aol.com].help | 9.88 KB |
MD5:
fc847ced79a7c9245ec3c8e6857cfdf9
SHA1: a1cc40f9df96ca7ad5adb29311a32c074ceeccba SHA256: 3794879b4d2e2b7e9c0780d9268ff8fdeeca9fd85af6a0c6f831730e62170d49 SSDeep: 192:r2xTluF3nfhY0mQD4J9WOao+XRbOpHYYEM3196aENEMuhRMM9qom:r2xZynqWO9Mo+XRbOfDHYam |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
824f4e710ff62305b64cc334fd01b646
SHA1: 008ae45760359fe20ba120d82ea4869c073f15e5 SHA256: 4bf95373d99eac9ce7decf7699c39d38adfa9fa42e2382a83f64a1f8162cb164 SSDeep: 768:0H5hokr892I3gGLQSk8rAKHakPJl2hSpGtLi/Eg6cxq5Bt2XQEcvmLwLsO7IdMUt:0ZhqEI3FLKKpP5paiWcxqbkt3FYEeoX1 |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
ded10daf256bbecb64fab7ebed1afc06
SHA1: 45a1c838ddd0f12949c2cb1e3887cc2d758bab2d SHA256: 7b532330b7b86282a2034b3e5812f4bdc98ec0a67e5a513b3bfe80efdf5d7ca3 SSDeep: 1536:fBfMlBYFpttSUOy9B0JBMfllixep83K/NXcv1s/xF2NJ:fBfeq5tbH0Oi683Kevm2NJ |
|
|
| \\?\C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.36 KB |
MD5:
3747db8bd2776cedb7d040aed6dd1500
SHA1: 8c28aa95d021926196f11923e7864877aac120ef SHA256: 2f34fe2bdf3d807aa88013dac6039f7054eebc0d70ba6fa85746972ad7f488d0 SSDeep: 1536:gka9Ng2u5uTCVhj7u/m4tkD7xZYM9XQY9Vcwop:vgNgNM+V57u/m4+75gYs7 |
|
|
| \\?\C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
c238bce21af6e7df8ae634124f928199
SHA1: ad9d3d07ae8d9f270c16a0aafe556b570d71901b SHA256: ce0040982fb65d4f99ced0917eef6e475d297cb9ee6b0c528da2c76a3923eed5 SSDeep: 1536:MHVuTiZvAM1PrL3DkJIZiIw9f38TtjjWkU73WYNLKg0IVT3cHJSf0:8RZdpzqTjMTtjjm3LKg0IVT3g |
|
|
| \\?\C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
922bea7dae3a95320701cd898ff8ffa4
SHA1: cd73040d8447f47125d546005adc4be117c12bcf SHA256: 7b29df7b55df7f9d26e10ba1ca80835cb704676fe9dc6a7dacb271e4049baf8b SSDeep: 1536:oCgrJJrZ7E1ZZbJZbsvNufzh6o/jKkZK/3fGY:eRELZbJZyNuLhXLKkG |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id[B4197730-1016].[randal_inman@aol.com].help | 642 bytes |
MD5:
58bbcb56d581fa68882317fbe4a81f2a
SHA1: f80651c8810080a869888a44873c80834aa4e23a SHA256: c6f2735e601725ccbea0d294ce1fdeaa02159a04408fe0801d249e97247d4cbb SSDeep: 12:2Mvmjy6IuBd4j1vRrmj+kmzraQcq2DHZ/3ug5YtrFRf/giPSxocGRQOfXM:1vmWur4j1Rgm6c2zZfubp/OoCL |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 9.06 KB |
MD5:
e37163474710c160ecc2f0adea27f218
SHA1: e68f6e482c71fb16bd29368050e50835b3503a27 SHA256: 8c5786d8a45e6fbbb9fbb01eae4adc232b9bd347abcfdecfceb32a50d2343657 SSDeep: 192:zWsuSCUpf9JRX/pqg7cjd11rQ5TaoQ7+4VYt1SWoj:zx7pf9JRhevtQ5TzQqyZj |
|
|
| \\?\C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.35 KB |
MD5:
4defb02af7a4785527dd24f79ef7a4b6
SHA1: fc2b31cbca6df719161326efe8fc0fdf68e3380f SHA256: 7d4d212ac9f1319b913d9d9dd9662bc6c7a97713beb2fcf870eb68ff57a41640 SSDeep: 1536:AC///NLFGm7XP/ZZFg1I/lltqLrLxEu7tyTodSM8lUA7sw0:BLhjRqLrLxEuhyToXFA7sD |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 7.30 KB |
MD5:
edc80e1a7265b9c4042062de7f96df75
SHA1: 00aa449dd94580455da00121dafbd4104a2cd783 SHA256: 0f870d93f817972b40ce230e147cf8f63c713beed9bada681be367023291e1c5 SSDeep: 192:rkfcyEXNnd7pc1R+ZKAjaAPj6QH8ljwG7Btc0Isp2Soj:rki9dWGNPeIGMYjyj |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 14.77 KB |
MD5:
f175a3599f722d26cfb9c51720dd784e
SHA1: 80da79173e85b63cc79c2969e7008350e9b59712 SHA256: e41859d70cf946b5bf724efdb07dc667d25f6fd31d3e953d2d1a6f4049d1ef5e SSDeep: 384:3Rd7otcPfnwePmZr+fPvbHROAe5d19t4a1zoBb2Jf2wvi3j:wEPhDxe19t4wUBqRWz |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
d040f64c56127a7037203cae7ad5185c
SHA1: 2acd6ced03fdce2d2e45f74ca443d8c3d93d50d1 SHA256: 49ff331e3761396806652d0b9c82931caead2cbcf80b3277ac9e049a6afed0ec SSDeep: 1536:wUKqSKO0eJVOI6To7Gs/fpxyZGMUBNxJRIAB8pr7aVwJmnEAAcvF439:wUKqSKO9VDzn46BNF3krzAEKN4t |
|
|
| \\?\C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.36 KB |
MD5:
9d3ca33d8283b371808115f889f76d39
SHA1: 9723b5006b2a9fad26997b05710fe6581d05eb8a SHA256: dcbf7b430750bc75bd8e1581265a24e8df6e60131a077388dcf8278002cac113 SSDeep: 1536:Hpyj0HRKeHr2YqT4eBWMT2IjnXCyPWuvQEvkv10OaliLgN:HFH5278eKIjXTWuTvqiO4i8 |
|
|
| \\?\C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
7aa97ce1ee43368ec2e03f5976b3f99f
SHA1: 14b4870282ad3b17686a2ab0672ca61ebe339f11 SHA256: 12158ebe2834c27a2242c4c832e4b08d0ba6d4b2530ec2e74db8b636b9168dff SSDeep: 1536:h7038nc1ukIlBv+hi34qXDHGiuGNGSEOUxnSq1PZqnQG3/:AeUI/v+434aDmidGS7C1PZZGP |
|
|
| \\?\C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
73264f0524c9f383072bbaaa80a5333c
SHA1: 23bbefd57182ddc70baaf65ec3366b7d351272bd SHA256: b6053366f3a5cf8715760b1c9f8715b75d099a84e0277e650a169d2400ea05b3 SSDeep: 1536:zI+KdV8SJBC0UyxQkJ/42VYOetinUvODyY9FQ7L:zIxBC2KIYV4UvOG |
|
|
| \\?\C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
24d47b04aef8dedbd67f490441b0a07e
SHA1: 08f3a56618c738586b07379b7b45f4d89265b377 SHA256: f41631b7377352f3a1f5bc504bae56a81b38fe9c75eb465f301d74808a632e71 SSDeep: 1536:LDecltHnIsw6ij3Ei2VdaYDPPKKpJCrCfB58q:XFHndgXuW7rg53 |
|
|
| \\?\C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.35 KB |
MD5:
83197634912d18f5707e2a47e4bfbbf6
SHA1: 745c6d7ca6871b50d84dd4b365315aa2e13076b2 SHA256: d2c7150f996c6228ada2ca69b54da777f1258619950f0b82f99d5d2db6ca89cb SSDeep: 1536:InG8WBFHIZ86LET0VlFqNRV4GhDJyD7qsWI199:H1B+Z1EYVlFqfV9y7FL |
|
|
| \\?\C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
8c9188bf938250c7dbbb63bdf23eb2b5
SHA1: ac769baa2fd266be524c54159d47f34c7f4ebd8a SHA256: 51283a8c2e60e557e97f0fcef06e3302aff616acb27750d78ea0caf1f12723ac SSDeep: 1536:kQIkh6b/v5kNyrBrE80mEXDQ/oH1OjA9RmdpZLSispdy9Z0TZ9SgUUyzo:kBE8B1rE88BH2A9Ot9wZ9S2 |
|
|
| \\?\C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
7bd19c47fe48775cf24a62ec6b00f3e9
SHA1: 4eda99550251756d4abf4473e1673fa84291e326 SHA256: 273241dd7027474352c326df1acda14fd29f0450b8a958840cec97ed1c3021e5 SSDeep: 1536:/pPbOQh9x5scJUS9E2oUxSfFY1qkeUIf7hV9reDw7uFSW8hJipRS:VbxP79JUSy2oUSFYAUI8DgW8Z |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id[B4197730-1016].[randal_inman@aol.com].help | 9.88 KB |
MD5:
8e7bada38861853a8fc51061c856b723
SHA1: 4bab6c68446ccb795b7b3e82e1962d2a83a55c2f SHA256: fb4778096416895987194103674e5318ae017f9586e3369abfe7110eb09ff5d0 SSDeep: 192:7aT08Bpbc++GEfA4G1x9EuDlamyTwxQs9z59X6TzZZGwzgEMPP0WAz:f2bf+1A5h5amyEJ9zQzmgMkz |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id[B4197730-1016].[randal_inman@aol.com].help | 642 bytes |
MD5:
49f489f5b515ee6cd4702997e501bc9a
SHA1: 4605b1a89a224bb0a3c7d83c15dd3e1af53076d1 SHA256: 606340371d7f77afad6b8a4a53f790bfb14c470dc482193c78b87266b516c57c SSDeep: 12:gZ2dPJNHVkJxjXu2ggJtq/xKwUTN4Q1BfsWwUt5TUNUxSLGJJ+b:gZ2dklrJt8xHGBfTYaxSCJJ+b |
|
|
| \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id[B4197730-1016].[randal_inman@aol.com].help | 2.82 MB |
MD5:
5c97063de52d901a18fc632ed308cb10
SHA1: 263dd6d9604e2a1f75c7306f5c0ea6d77a47fed8 SHA256: 45cc5a3f560007c3f97a2ba5ff9aa0984edd241d69688b5eb221289482ecbcd0 SSDeep: 24576:ClAnFcIamkROWE7C3SX1CUZs1zgScajS02p2F:C+FcIamkNE7C3SXnmDcajS02oF |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 9.06 KB |
MD5:
ddc571c8e244412f1ea9632ac1cfb5cf
SHA1: 31c71f6ce4ab4236fbb7b395ea530328a41fcad9 SHA256: 3b1c9f0d367d99f63e8775a8538cfccffb6a27f98cea7b4e2e570eaa0b64a281 SSDeep: 192:p187RCdf2StSmb8EuiG4U/YnAVlXvsUL6U6twBDywHJb+r2:p187Ra2O0EuiGRjVlhmtwcm0r2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 7.30 KB |
MD5:
0851c2266c0551cc3b9a2bfd2dce66bd
SHA1: 00b387b53b4334da9f6a756b5e9c89834b2df3bd SHA256: d919e2713e11d65d288a436c8bbbc84454188872ae9ccfe81afb16858fff2ef6 SSDeep: 192:wBL7qUKylHR/VI5yiGoxZduUmmvB7alayJHWiJ9viEd2:k7LlHdVANLB78JpHn2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 14.77 KB |
MD5:
de3f4b6ee3dd609f7704103681aeb59c
SHA1: 9e9bc9b3aa931d86344e066d2c13ecec837604c3 SHA256: 89145f68d11c9e7d51a5c19ddb5f3315f14246f0de9d02ecf86c2b4baf3c051c SSDeep: 192:icKIRJc4mTKFUmbT90wZ6WUkNYNO28HNu3klkO6RZpDwovBr8ghtGRXQfBW1/coi:uaiz9tbEY4fZSOwygh0RXgW1kCqM92 |
|
|
Host Behavior
File (2986)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | \\?\C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\GetCurrentRollback.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\GetCurrentRollback.ini | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\preoobe.cmd | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\preoobe.cmd | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\preoobe.cmd.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\SetupComplete.cmd | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\SetupComplete.cmd | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$GetCurrent\SafeOS\SetupComplete.cmd.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$WINRE_BACKUP_PARTITION.MARKER | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1025\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1028\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1029\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1030\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1031\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1032\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1033\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1035\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1036\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1037\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1038\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\SetupResources.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\SetupResources.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\SetupResources.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\DisplayIcon.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\DisplayIcon.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\DisplayIcon.ico.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Print.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Print.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Print.ico.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate1.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate1.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate1.ico.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate2.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate2.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate2.ico.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate3.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate3.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate3.ico.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1040\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate4.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate5.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate4.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate4.ico.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate5.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate5.ico.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate6.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate6.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate6.ico.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate7.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate7.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate7.ico.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate8.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate8.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Rotate8.ico.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Save.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Save.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Save.ico.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1041\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Setup.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1042\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Setup.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\Setup.ico.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1043\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\stop.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\stop.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\stop.ico.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1044\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\SysReqMet.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\SysReqMet.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\warn.ico | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\warn.ico | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Graphics\warn.ico.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Core.mzz | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Core.mzz.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1045\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1046\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1049\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1053\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Core_x64.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Core_x64.msi.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\1055\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2052\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\2070\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3076\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\eula.rtf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\eula.rtf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\eula.rtf.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\LocalizedData.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\LocalizedData.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\3082\LocalizedData.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Client\Parameterinfo.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Client\Parameterinfo.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Client\Parameterinfo.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Client\UiInfo.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Client\UiInfo.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Client\UiInfo.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Core_x86.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Core_x86.msi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Core_x86.msi.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\DHtmlHeader.html | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\DHtmlHeader.html | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\DHtmlHeader.html.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Extended\Parameterinfo.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Extended\Parameterinfo.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Extended\Parameterinfo.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Extended\UiInfo.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Extended\UiInfo.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Extended\UiInfo.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\header.bmp | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\ParameterInfo.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\ParameterInfo.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\ParameterInfo.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\header.bmp | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\header.bmp.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUi.xsd | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUi.xsd | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUi.xsd.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SplashScreen.bmp | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SplashScreen.bmp | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SplashScreen.bmp.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Strings.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Strings.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Strings.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Extended.mzz | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Extended.mzz.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Extended_x64.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Extended_x64.msi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Extended_x64.msi.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\UiInfo.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\UiInfo.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\UiInfo.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\watermark.bmp | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\watermark.bmp | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\watermark.bmp.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BOOTSTAT.DAT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BOOTSTAT.DAT | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\BOOTSTAT.DAT.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\updaterevokesipolicy.p7b | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\BOOTSECT.BAK | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\BOOTSECT.BAK | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\BOOTSECT.BAK.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\updaterevokesipolicy.p7b | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Extended_x86.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Extended_x86.msi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\netfx_Extended_x86.msi.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\RGB9RAST_x64.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\RGB9RAST_x64.msi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\RGB9RAST_x64.msi.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Content.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\RGB9Rast_x86.msi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\RGB9Rast_x86.msi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\RGB9Rast_x86.msi.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Content.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Setup.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Setup.exe.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupEngine.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupEngine.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupEngine.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUi.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUi.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUi.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUtility.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUtility.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\SetupUtility.exe.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\sqmapi.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\sqmapi.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\sqmapi.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adojavas.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adojavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\desktop.ini | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\desktop.ini.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\README.txt | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\README.txt | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\README.txt.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\Welcome.html | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\Welcome.html | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Java\jre1.8.0_144\Welcome.html.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\AppXManifest.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\FileSystemMetadata.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\FileSystemMetadata.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\AppXManifest.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.HTM | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.HTM | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.VBS | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.VBS | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\SLERROR.XML | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\SLERROR.XML | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\BCD | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG1 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG2 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bg-BG\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bg-BG\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\bootspaces.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bootspaces.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\bootvhd.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bootvhd.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\da-DK\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\da-DK\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\de-DE\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\de-DE\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\el-GR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\el-GR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-GB\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-GB\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-ES\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-ES\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-MX\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-MX\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\et-EE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\et-EE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\chs_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\cht_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\jpn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\kor_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgunn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgunn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgun_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryon_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryon_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryo_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgun_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjhn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjhn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjh_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjh_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyhn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyhn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyh_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyh_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segmono_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segmono_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoen_slboot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoen_slboot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoe_slboot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoe_slboot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-CA\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-CA\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hr-HR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hr-HR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\it-IT\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\it-IT\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\lt-LT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\lt-LT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\lv-LV\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\lv-LV\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\memtest.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\memtest.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Resources\bootres.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Resources\bootres.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Resources\en-US\bootres.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Resources\en-US\bootres.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ro-RO\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ro-RO\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sk-SK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sk-SK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sl-SI\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sl-SI\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-RS\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-RS\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryo_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\uk-UA\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\uk-UA\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\bootmgr | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\bootmgr | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\BOOTNXT | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\BOOTNXT | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\BOOTNXT.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\hiberfil.sys | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Application.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\HardwareEvents.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Application.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Application.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Internet Explorer.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\HardwareEvents.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\HardwareEvents.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Internet Explorer.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Internet Explorer.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Key Management Service.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Key Management Service.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Key Management Service.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Copy | c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\shaofao.exe | source_filename = C:\Users\FD1HVy\Desktop\shaofao.exe |
|
1 | |
| Copy | c:\programdata\microsoft\windows\start menu\programs\startup\shaofao.exe | source_filename = C:\Users\FD1HVy\Desktop\shaofao.exe |
|
1 | |
| Read | \\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini | size = 1114368, size_out = 129 |
|
1 | |
| Read | \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini | size = 1114368, size_out = 129 |
|
1 | |
| Read | \\?\C:\Program Files\desktop.ini | size = 1114368, size_out = 174 |
|
1 | |
| Write | \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id[B4197730-1016].[randal_inman@aol.com].help | size = 144 |
|
1 | |
| Write | \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 4144 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 4784 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 4464 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi | size = 94736 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml | size = 96096 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id[B4197730-1016].[randal_inman@aol.com].help | size = 656 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\desktop.ini.id[B4197730-1016].[randal_inman@aol.com].help | size = 176 |
|
1 | |
| Write | \\?\C:\Program Files\desktop.ini.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id[B4197730-1016].[randal_inman@aol.com].help | size = 1424 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id[B4197730-1016].[randal_inman@aol.com].help | size = 14160 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 8592 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 15280 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 7808 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 12256 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 176 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 160 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 176 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 160 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 160 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 160 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 160 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id[B4197730-1016].[randal_inman@aol.com].help | size = 4240 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\README.txt.id[B4197730-1016].[randal_inman@aol.com].help | size = 48 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\README.txt.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id[B4197730-1016].[randal_inman@aol.com].help | size = 105504 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id[B4197730-1016].[randal_inman@aol.com].help | size = 63936 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id[B4197730-1016].[randal_inman@aol.com].help | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id[B4197730-1016].[randal_inman@aol.com].help | size = 145184 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\Welcome.html.id[B4197730-1016].[randal_inman@aol.com].help | size = 960 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\Welcome.html.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 288 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\AppXManifest.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 786706 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id[B4197730-1016].[randal_inman@aol.com].help | size = 174544 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\AppXManifest.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 262144 |
|
3 | |
| Write | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id[B4197730-1016].[randal_inman@aol.com].help | size = 94480 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id[B4197730-1016].[randal_inman@aol.com].help | size = 36352 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 387360 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1536 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 800880 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 496528 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 253728 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 19456 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1114368 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 10576 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 763376 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 2160 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 215888 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 343344 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 14928 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 357360 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 65008 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 9232 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 399536 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1456 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 3760 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 527968 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 1264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 786722 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 262144 |
|
3 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 3376 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 9840 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 384 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 9040 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF | size = 69648 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF | size = 338 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7232 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 14880 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Delete | \\?\C:\588bce7c90097ed212\1049\LocalizedData.xml | - |
|
1 | |
|
For performance reasons, the remaining 1944 entries are omitted.
The remaining entries can be found in glog.xml. |
|||||
Registry (20)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
6 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
2 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 14619536, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 14619600, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
2 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 0, type = REG_NONE |
|
2 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 14636128, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 | |
| Write Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | value_name = shaofao, data = C:\Users\FD1HVy\AppData\Local\shaofao.exe, size = 82, type = REG_SZ |
|
1 | |
| Write Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | value_name = shaofao, data = C:\Users\FD1HVy\AppData\Local\shaofao.exe, size = 82, type = REG_SZ |
|
1 |
Process (1223)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Users\FD1HVy\Desktop\shaofao.exe | os_pid = 0xf84, show_window = SW_HIDE |
|
1 | |
| Create | C:\WINDOWS\system32\cmd.exe | os_pid = 0xd08, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE |
|
1 | |
| Create | C:\WINDOWS\system32\cmd.exe | os_pid = 0x7f0, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE |
|
1 | |
| Enumerate Processes | - | - |
|
1204 | |
| Enumerate Processes | - | - |
|
15 | |
| Open | c:\windows\explorer.exe | desired_access = PROCESS_QUERY_INFORMATION |
|
1 |
Module (35)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x75e90000 |
|
14 | |
| Get Handle | c:\windows\syswow64\advapi32.dll | base_address = 0x761b0000 |
|
1 | |
| Get Filename | - | process_name = c:\users\fd1hvy\desktop\shaofao.exe, file_name_orig = C:\Users\FD1HVy\Desktop\shaofao.exe, size = 260 |
|
7 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x75ea4ae0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x75ea4b20 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x75ea4b40 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x75ea4b00 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30 |
|
7 | |
| Get Address | c:\windows\syswow64\advapi32.dll | function = CreateProcessWithTokenW, address_out = 0x761c0c70 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Wow64RevertWow64FsRedirection, address_out = 0x75ea6b50 |
|
1 |
System (60)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Sleep | duration = 5000 milliseconds (5.000 seconds) |
|
1 | |
| Sleep | duration = 1000 milliseconds (1.000 seconds) |
|
42 | |
| Sleep | duration = 500 milliseconds (0.500 seconds) |
|
14 | |
| Get Time | type = Ticks, time = 136750 |
|
1 | |
| Get Info | type = Operating System |
|
2 |
Mutex (38)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\1016B419773000 |
|
1 | |
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Create | mutex_name = Global\1016B419773000 |
|
1 | |
| Create | mutex_name = Global\1016B419773000 |
|
2 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
4 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
4 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
6 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
3 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
3 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Release | mutex_name = Global\1016B419773000 |
|
1 | |
| Release | mutex_name = Global\1016B419773000 |
|
1 | |
| Release | mutex_name = Global\1016B419773000 |
|
2 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #2: shaofao.exe
107
0
| Information | Value |
|---|---|
| ID | #2 |
| File Name | c:\users\fd1hvy\desktop\shaofao.exe |
| Command Line | "C:\Users\FD1HVy\Desktop\shaofao.exe" |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:00:47, Reason: Child Process |
| Unmonitor | End Time: 00:04:05, Reason: Terminated by Timeout |
| Monitor Duration | 00:03:18 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xf84 |
| Parent PID | 0xdb0 (c:\users\fd1hvy\desktop\shaofao.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
F7C
0x
A80
0x
5F8
0x
84
0x
E00
0x
C9C
0x
EA8
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| shaofao.exe | 0x00980000 | 0x00995FFF | Relevant Image | - | 32-bit | - |
|
|
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| C:\Users\FD1HVy\Desktop\shaofao.exe | 71.00 KB |
MD5:
7de40ec678584a92ddeecb01764be5fc
SHA1: e4cc3aec8bd71c8225348ac8a0e1d951662520b0 SHA256: cb82fabfd6229fecaec9af902aab091cf1431e529f625a416424c383e993afd9 SSDeep: 1536:5kGB8nHbKUvryElSpi8jCZGcqDKlKnr8dMXlnQGFD2co:5FBMHRvrAjCZmKcnr86QG9/o |
|
|
Host Behavior
File (6)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open | STD_INPUT_HANDLE | - |
|
1 | |
| Open | STD_OUTPUT_HANDLE | - |
|
1 | |
| Open | STD_ERROR_HANDLE | - |
|
1 | |
| Copy | C:\Users\FD1HVy\AppData\Local\shaofao.exe | source_filename = C:\Users\FD1HVy\Desktop\shaofao.exe |
|
1 | |
| Copy | c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\shaofao.exe | source_filename = C:\Users\FD1HVy\Desktop\shaofao.exe |
|
1 | |
| Copy | c:\programdata\microsoft\windows\start menu\programs\startup\shaofao.exe | source_filename = C:\Users\FD1HVy\Desktop\shaofao.exe |
|
1 |
Registry (19)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
6 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
2 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 43586448, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 43586512, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
2 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 0, type = REG_NONE |
|
2 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 43603040, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 | |
| Write Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | value_name = shaofao, data = C:\Users\FD1HVy\AppData\Local\shaofao.exe, size = 82, type = REG_SZ |
|
1 |
Module (14)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x75e90000 |
|
4 | |
| Get Filename | - | process_name = c:\users\fd1hvy\desktop\shaofao.exe, file_name_orig = C:\Users\FD1HVy\Desktop\shaofao.exe, size = 260 |
|
6 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x75ea4ae0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x75ea4b20 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x75ea4b40 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x75ea4b00 |
|
1 |
System (28)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Computer Name | result_out = NQDPDE |
|
1 | |
| Sleep | duration = 1000 milliseconds (1.000 seconds) |
|
24 | |
| Sleep | duration = -1 (infinite) |
|
1 | |
| Get Time | type = Ticks, time = 138000 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Mutex (28)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\1016B419773000 |
|
1 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
12 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
6 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
2 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #3: cmd.exe
189
0
| Information | Value |
|---|---|
| ID | #3 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | "C:\WINDOWS\system32\cmd.exe" |
| Initial Working Directory | C:\Users\FD1HVy\Desktop\ |
| Monitor | Start Time: 00:00:52, Reason: Child Process |
| Unmonitor | End Time: 00:04:05, Reason: Terminated by Timeout |
| Monitor Duration | 00:03:13 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x7f0 |
| Parent PID | 0xdb0 (c:\users\fd1hvy\desktop\shaofao.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
CD8
0x
E98
|
Host Behavior
File (140)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | C:\Users\FD1HVy\Desktop | type = file_attributes |
|
2 | |
| Get Info | STD_OUTPUT_HANDLE | type = file_type |
|
8 | |
| Get Info | STD_INPUT_HANDLE | type = file_type |
|
3 | |
| Open | STD_OUTPUT_HANDLE | - |
|
19 | |
| Open | STD_INPUT_HANDLE | - |
|
54 | |
| Read | STD_INPUT_HANDLE | size = 1, size_out = 1 |
|
47 | |
| Write | STD_OUTPUT_HANDLE | size = 38 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 2 |
|
3 | |
| Write | STD_OUTPUT_HANDLE | size = 52 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 24 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 47 |
|
1 |
Registry (17)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 4, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data = 9, type = REG_NONE |
|
1 |
Process (2)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\WINDOWS\system32\netsh.exe | os_pid = 0x8e8, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Get Info | C:\WINDOWS\system32\netsh.exe | type = PROCESS_BASIC_INFORMATION |
|
1 |
Memory (1)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Read | C:\WINDOWS\system32\netsh.exe | address = 846640644096, size = 1952 |
|
1 |
Module (10)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | NTDLL.DLL | base_address = 0x7ff931f40000 |
|
1 | |
| Get Handle | c:\windows\system32\cmd.exe | base_address = 0x7ff65e560000 |
|
1 | |
| Get Handle | c:\windows\system32\kernel32.dll | base_address = 0x7ff92fdd0000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address_out = 0x7ff92fdea990 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = CopyFileExW, address_out = 0x7ff92fdee830 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address_out = 0x7ff92fdee300 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address_out = 0x7ff92f1b0a40 |
|
1 | |
| Get Address | c:\windows\system32\ntdll.dll | function = NtQueryInformationProcess, address_out = 0x7ff931fe56b0 |
|
1 |
System (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Info | type = Operating System |
|
1 |
Environment (16)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
5 | |
| Get Environment String | name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps |
|
2 | |
| Get Environment String | name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC |
|
2 | |
| Get Environment String | name = PROMPT |
|
1 | |
| Get Environment String | name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe |
|
1 | |
| Get Environment String | name = KEYS |
|
1 | |
| Get Environment String | name = PROMPT, result_out = $P$G |
|
1 | |
| Set Environment String | name = PROMPT, value = $P$G |
|
1 | |
| Set Environment String | name = =C:, value = C:\Users\FD1HVy\Desktop |
|
1 | |
| Set Environment String | name = COPYCMD |
|
1 |
Process #4: cmd.exe
167
0
| Information | Value |
|---|---|
| ID | #4 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | "C:\WINDOWS\system32\cmd.exe" |
| Initial Working Directory | C:\Users\FD1HVy\Desktop\ |
| Monitor | Start Time: 00:00:52, Reason: Child Process |
| Unmonitor | End Time: 00:04:05, Reason: Terminated by Timeout |
| Monitor Duration | 00:03:13 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xd08 |
| Parent PID | 0xdb0 (c:\users\fd1hvy\desktop\shaofao.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
CF4
0x
36C
|
Host Behavior
File (118)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | C:\Users\FD1HVy\Desktop | type = file_attributes |
|
2 | |
| Get Info | STD_OUTPUT_HANDLE | type = file_type |
|
8 | |
| Get Info | STD_INPUT_HANDLE | type = file_type |
|
3 | |
| Open | STD_OUTPUT_HANDLE | - |
|
19 | |
| Open | STD_INPUT_HANDLE | - |
|
43 | |
| Read | STD_INPUT_HANDLE | size = 1, size_out = 1 |
|
36 | |
| Write | STD_OUTPUT_HANDLE | size = 38 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 2 |
|
3 | |
| Write | STD_OUTPUT_HANDLE | size = 52 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 24 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 36 |
|
1 |
Registry (17)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 4, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data = 9, type = REG_NONE |
|
1 |
Process (2)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\WINDOWS\system32\vssadmin.exe | os_pid = 0x714, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Get Info | C:\WINDOWS\system32\vssadmin.exe | type = PROCESS_BASIC_INFORMATION |
|
1 |
Memory (1)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Read | C:\WINDOWS\system32\vssadmin.exe | address = 964672815104, size = 1952 |
|
1 |
Module (10)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | NTDLL.DLL | base_address = 0x7ff931f40000 |
|
1 | |
| Get Handle | c:\windows\system32\cmd.exe | base_address = 0x7ff65e560000 |
|
1 | |
| Get Handle | c:\windows\system32\kernel32.dll | base_address = 0x7ff92fdd0000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address_out = 0x7ff92fdea990 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = CopyFileExW, address_out = 0x7ff92fdee830 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address_out = 0x7ff92fdee300 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address_out = 0x7ff92f1b0a40 |
|
1 | |
| Get Address | c:\windows\system32\ntdll.dll | function = NtQueryInformationProcess, address_out = 0x7ff931fe56b0 |
|
1 |
System (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Info | type = Operating System |
|
1 |
Environment (16)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
5 | |
| Get Environment String | name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps |
|
2 | |
| Get Environment String | name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC |
|
2 | |
| Get Environment String | name = PROMPT |
|
1 | |
| Get Environment String | name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe |
|
1 | |
| Get Environment String | name = KEYS |
|
1 | |
| Get Environment String | name = PROMPT, result_out = $P$G |
|
1 | |
| Set Environment String | name = PROMPT, value = $P$G |
|
1 | |
| Set Environment String | name = =C:, value = C:\Users\FD1HVy\Desktop |
|
1 | |
| Set Environment String | name = COPYCMD |
|
1 |
Process #7: netsh.exe
36
0
| Information | Value |
|---|---|
| ID | #7 |
| File Name | c:\windows\system32\netsh.exe |
| Command Line | netsh advfirewall set currentprofile state off |
| Initial Working Directory | C:\Users\FD1HVy\Desktop\ |
| Monitor | Start Time: 00:01:06, Reason: Child Process |
| Unmonitor | End Time: 00:04:05, Reason: Terminated by Timeout |
| Monitor Duration | 00:02:59 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x8e8 |
| Parent PID | 0x7f0 (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
E0C
0x
6DC
0x
FA8
|
Host Behavior
Registry (9)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Get Key Info | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 |
Module (19)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | api-ms-win-appmodel-runtime-l1-1-0.dll | base_address = 0x7ff92e3f0000 |
|
1 | |
| Load | IFMON.DLL | base_address = 0x7ff911d10000 |
|
1 | |
| Load | RASMONTR.DLL | base_address = 0x7ff911570000 |
|
1 | |
| Load | MSVCRT.DLL | base_address = 0x7ff931a40000 |
|
1 | |
| Load | C:\WINDOWS\system32\MFC42LOC.DLL | base_address = 0x0 |
|
1 | |
| Load | AUTHFWCFG.DLL | base_address = 0x7ff912410000 |
|
1 | |
| Load | DHCPCMONITOR.DLL | base_address = 0x7ff912400000 |
|
1 | |
| Load | DOT3CFG.DLL | base_address = 0x7ff911c20000 |
|
1 | |
| Load | FWCFG.DLL | base_address = 0x7ff9111c0000 |
|
1 | |
| Load | HNETMON.DLL | - |
|
1 | |
| Get Handle | c:\windows\system32\netsh.exe | base_address = 0x7ff7ee140000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\netsh.exe, file_name_orig = C:\WINDOWS\system32\MFC42u.dll, size = 260 |
|
1 | |
| Get Address | c:\windows\system32\ifmon.dll | function = InitHelperDll, address_out = 0x7ff911d11310 |
|
1 | |
| Get Address | c:\windows\system32\rasmontr.dll | function = InitHelperDll, address_out = 0x7ff911585850 |
|
1 | |
| Get Address | c:\windows\system32\authfwcfg.dll | function = InitHelperDll, address_out = 0x7ff912411430 |
|
1 | |
| Get Address | c:\windows\system32\dhcpcmonitor.dll | function = InitHelperDll, address_out = 0x7ff912401610 |
|
1 | |
| Get Address | c:\windows\system32\dot3cfg.dll | function = InitHelperDll, address_out = 0x7ff911c21100 |
|
1 | |
| Get Address | c:\windows\system32\fwcfg.dll | function = InitHelperDll, address_out = 0x7ff9111c11f0 |
|
1 |
System (8)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Cursor | x_out = 300, y_out = 522 |
|
1 | |
| Get Info | type = Operating System |
|
6 | |
| Get Info | type = System Directory, result_out = C:\WINDOWS\system32 |
|
1 |
Process #8: vssadmin.exe
0
0
| Information | Value |
|---|---|
| ID | #8 |
| File Name | c:\windows\system32\vssadmin.exe |
| Command Line | vssadmin delete shadows /all /quiet |
| Initial Working Directory | C:\Users\FD1HVy\Desktop\ |
| Monitor | Start Time: 00:01:06, Reason: Child Process |
| Unmonitor | End Time: 00:04:05, Reason: Terminated by Timeout |
| Monitor Duration | 00:02:59 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x714 |
| Parent PID | 0xd08 (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
868
0x
4A4
|
Process #9: shaofao.exe
27763
0
| Information | Value |
|---|---|
| ID | #9 |
| File Name | c:\programdata\microsoft\windows\start menu\programs\startup\shaofao.exe |
| Command Line | "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\shaofao.exe" |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:02:58, Reason: Autostart |
| Unmonitor | End Time: 00:04:05, Reason: Terminated by Timeout |
| Monitor Duration | 00:01:07 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xce8 |
| Parent PID | 0xa40 (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
CEC
0x
CF0
0x
CF4
0x
CF8
0x
CFC
0x
D24
0x
D28
0x
D2C
0x
D30
0x
D34
0x
D38
0x
D44
0x
D48
0x
D4C
0x
D50
0x
D58
0x
D5C
0x
D60
0x
D64
0x
D68
0x
D6C
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| shaofao.exe | 0x00B60000 | 0x00B75FFF | Relevant Image | - | 32-bit | - |
|
|
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| \\?\C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.30 KB |
MD5:
5220f0bc348eb729556ba1ff0e15b192
SHA1: fb35036ce8e967a51a950dca2ed9460454835a1a SHA256: 63eb26ad68ae0741fc0d8b6ebf134c9805d6c0d6967727dd4b2388895bc225fe SSDeep: 1536:DWBW/nxyNYAXA+3ulW2ZD4Pu62VL2z8zAPRFMUXkvTC:RwA++lWs0G6m2z5P5km |
|
|
| \\?\C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
1e7798a1966872be8be6f1212851d229
SHA1: f3b031e8884fc3ae1f16a80aacf379ddd9d71e31 SHA256: 292b5a921a3a32d7d47cbdadea35688e642b05051475362d2205fdd8224a297e SSDeep: 1536:c8wljcqeDJrNDezzsWHEzeOesoLCVhgJdip0tNCo:bMjcqedBezzxEaOesQCV2JdiECo |
|
|
| \\?\C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 1.00 MB |
MD5:
70f4ba88037d8ae50d07bd9d1751ffc7
SHA1: 2502a84a8f5501b3a556dc4abbcfb6798d71063d SHA256: 91eea577da6c53f7810bbda6543a06ef1b73fef294e28ee4191645aa79ae546c SSDeep: 24576:skibyN6Xn2t4a3RmfBsPxMn98lQ4q8+74Zd:nibyN6Xor3R2CxUCltd |
|
|
| \\?\C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
2e185b21ced3ee18272094d9399b938a
SHA1: 693c42acb557ab5acadd08755a5b06dc11d54108 SHA256: 7deae0dbe3b6dce89358ca561beae87f9f7d727b1c70f42a6a95b1ebaadcdbd4 SSDeep: 1536:1A0EomOHu7cVBLXht7wV/6gfIUq/uYWHOLsWLDnP4/gxCId7c:1REDOHu4BLy/u3WisWLDnBxFdI |
|
|
| \\?\C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
0f7351446d6cb5feea9e79ecb8cca26d
SHA1: b10999704651248de13cee067d53d74e09d76b45 SHA256: 293abc071635bb95d408e8433c5d9a6c9c72f486bffedb6c0a6efed385719e2e SSDeep: 1536:oKKGn0PCvJA/oivpMzfOOkwZW5o74zS4qZyWW88V1Q:o1GnyCvJOxcfOOkw85o6SlBWL1Q |
|
|
| \\?\C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
79b58119a490e650d7cff988ebbd2a60
SHA1: 41359043624b0fe6108fdf3570b0931d1a68609c SHA256: 30c2b809963bc44490e9e699e18afb5325c089c2a04e088024926d4b87c4f96e SSDeep: 1536:X1zHyYZ5aBC5LqCztCuXXxa3gZpWHiQ51gswYgJxYDPYwlt:lVZ5mCxXk3gZwHp6saJxYDPfn |
|
|
| \\?\C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 1.00 MB |
MD5:
ff7de52ba7343a1dc5ab7fba989ea158
SHA1: 0765ffc116d9207621196619ee2d565b16111451 SHA256: cf87393d0516046f317c166308e0139c403fa2db568ae5c6ce59d521e183b6b2 SSDeep: 24576:tT4bdetVJIJvgXR0Z4PRH8o8lyeWLqB9fXhnXCh8K3F4H:tUdGJovk2Z4P18b4LLqB9pnXJEFE |
|
|
| \\?\C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
7c5ee6671f16dd659b2a13bbab644548
SHA1: 22be3756ddddfde072e6d4358ac4d3c632cfa2cb SHA256: 2ce40a8a301ef70fb6e16b559f7f6185b3422f2c19a5a202596542727049d669 SSDeep: 1536:HvKn3zVUtN8TgxIFSiLZGKYqFlwSrm7WG91hFv+1GMYd79L:SnSt6TgNGRQ9D1hRX9L |
|
|
| \\?\C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
14f3d344ff3cad7e8d936fa3d6c92311
SHA1: ec08b9cb03ddbed07b33fcff6a92030665284d69 SHA256: 2eee3c36256d3751ace5de7f9a46422d2164f84fbdba3da50c43ca48ccb998d1 SSDeep: 1536:W6sPtQwkslKkcD85878f+8XdKX8JdJiaxIFygoI5vcpzDAbiB2WI:HsP+wkslD5gVDIdJIF9HidUG4 |
|
|
| \\?\C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
e6fa523a985f106837909019f350ff3b
SHA1: b554f39abffa3666c004142d51d140c6ebcbb9b5 SHA256: 9f0d3c527ae1234dff77d31b1f0f25095a19557d54b710be16718d10621278dd SSDeep: 1536:Sb/7fAvAWGNSm53HGwpdkdI/3Y//ALk0D+poHfs1mwoV+0LEuAUiaFa3VBmWB:SL7YvcEi3t6FGqoHfN9lLowU |
|
|
| \\?\C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
48556d7d61a6b51a78d34da27a5330fb
SHA1: 83e35e8666e161802cca50b1d4b21c0f8861fdcb SHA256: d44acfc1c5685c638d7e6135ae375fb78861a431ea77d055e4ce8f0de4a9b3d1 SSDeep: 1536:KokMh+V0YW6LQnUEcnDmPRegqgKsl0oOyuFQEP:7dhv66UEcDmPRehvoOL/P |
|
|
| \\?\C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.35 KB |
MD5:
2398a3bc62a6162a1f5692b4e9fe17c2
SHA1: da84e8ec9238a5af93362408baa613bb77579293 SHA256: dbaf8fda606e013d73b211e9941af72d617dd5cce54805af614a4f154aa7479e SSDeep: 1536:O0HLLKVr+VrfrO+KPzMjPE/cz0+PE4EEc4zZ3KVpM:O0CVr+VJThNZb3Wq |
|
|
| \\?\C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
86026c8a2a9f6eaeb3818c4f5a818727
SHA1: 5708e1670cea9d3504ab8035c7792fc9af0b8732 SHA256: d5af0185b117c76f763676dda682ded753acb5359e4bb82efc0827e706953ad5 SSDeep: 1536:uWnOHqQOYrfNau9nGVyhVMa/jXmXpUfiJvWM4bcvO:AHqWrfNTBGAb2XpsiJuM4bc2 |
|
|
| \\?\C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
4bb30a0976c84d8af76688e18ef41a06
SHA1: 0d002ce6b727b66dfe8c2228f8939cd174828c04 SHA256: 4f196036a15ba7ab24c68e5cab440410cd1a5554d876bf726e2c15967a6de1d8 SSDeep: 1536:3BU2VDI4tN08aHjRKSCX+ZlPPWC4N8M8tmynUzmzV:3KQI4vjaDRfQ+ZlHsyvUzwV |
|
|
| \\?\C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
3632dbab3988d89e0b078a52953d087c
SHA1: 6083d112f1d9aabf43334cdccb8f3f9f3330754d SHA256: 50f89a9e05686e14d46d8c64f1ea56cd43b091406ea5a111c9e3fee45cbb6645 SSDeep: 1536:iMybYlGSyheWrHTMFao+WScb4WLJ7tmEqIBKHR8pTZqX:itOynzMFbBUWttmETBxA |
|
|
| \\?\C:\Logs\Microsoft-Windows-International%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
28035c0d11cc3e7d773e873fdce4df7d
SHA1: 34c75887fdda2615d0ec71bac3624aa4d011fa07 SHA256: c6226882adb617a2c8bf3012cbcf6309d41895c4848bc8ba61e59626d5d46ec5 SSDeep: 1536:ZpRLdPeeFzga7DR5sE6tk8RW6ULCw2DbP36tt4DyYujx6+3kr:3feeFzb7DR5sE6tfDb/6vth169 |
|
|
| \\?\C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
846d75b0aa339c461797491f9d91073e
SHA1: 6d84e0d2463e7b8f25785a927e422a235f630533 SHA256: a22e58db46c23ef8a990e7c880cd0123dc037d3a4da3e90e9a5517a91be97657 SSDeep: 1536:8ZqtqfHjk7zq2nYF+ET91MizzMJ13MbEITxOZQ/2SfR4ObO:8ZqMfDk7zqxo6ZYHCwQ/2wfi |
|
|
| \\?\C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
793422caccae4189e24cfbcca25323a3
SHA1: 4d96dc92946ab7db3c14a196cd7787063696ae7a SHA256: e2d60bd44546c3419a58f571de07e64072d4176e1e72c8828e4bac51d45c4d1f SSDeep: 1536:dNOR2QfA1/bOX1N8FEPKP1TT/OPszfTL3szxmfYYO5q9mSjEF:dbR/CX1yTPNnfoxmfYYOEmS4F |
|
|
| \\?\C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 1.00 MB |
MD5:
202c00c13e67933c6aefe32b7459bd57
SHA1: 5a655554b6be3f4b0e59f4ea95b3c8e058afd4a2 SHA256: ce35bd5c9dc894635d895a3a55103eb663cce352d44bca89e01d813a4e392474 SSDeep: 24576:VLeqdKTygWv61Ah9rKRYWg9OuvaZLMmQZQfYxUbdLlmjgQ+EFf:nKT261AhMRFQDaZLMDBxSlSf+EFf |
|
|
| \\?\C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.35 KB |
MD5:
2bb4ee28b3f10db3c479efbf25171c79
SHA1: 58d388812b635beaa04e14471cf23808e912ac55 SHA256: 6e30d6182170624ca71d9eb0400429397f1479696f7db154109f8dcdcb7e8835 SSDeep: 1536:AMVb+yvga+0Shxrhkq/etGCSR8BNpdxeJk5+OzInRCZ:AwZvgdhxdkyekCSR8bpdxeJk58R8 |
|
|
| \\?\C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
0cb0d569d1d4e4211c165afb6b1bb906
SHA1: 35a4878336846cc4bd33a94b6f9d89defc0d32c4 SHA256: b75f59a47063cd8502caa315a8ca87ae2a56f8543feabd17dc13d8cc8905937f SSDeep: 1536:bfY73vLhNPbW2AMmJHk7QixUUNNu8GRC8kRYFfBTvXmpBOJ:E7DhNPbWimJHkklUnDGRSKUu |
|
|
| \\?\C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
0306a5100cfa8fbe54ff45f54f686d07
SHA1: b6a7e4c5bb161a9cac9339e37b54c950568cb9ab SHA256: 0c58ee265925bcc743b1691d19d84a1279629cbb8681deaa43c8720bd737f3d3 SSDeep: 1536:gZzlee4otzVT2hM95phj70V8vXI0Br1fO6TJcTQDNI+:KzleKzT2u95oevrB5fO0JcTy |
|
|
| \\?\C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
17ea72592aeb6d178f8c7f207571d6f7
SHA1: 57e64d31fcc1b4b56b38c2b6adb3c7aa752b9581 SHA256: f5c2240ca03b071f7b14b8b98ec8985ddb6d54a8156c5ce36ab0480481b15dd5 SSDeep: 1536:9+z8zlpT687cWrBv09LVcyg53c8NWbiTddWlXNE6GorFRUwuGn:9ZhpT68VrBc5scIyiTbWlXNXVrE6n |
|
|
| \\?\C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
0cb02e87ee53ff907ea619891df3b280
SHA1: 1e667fed047837b1848669655cfa7f097a56027b SHA256: dd1d00a0579b561590ebee7c00310a6c7a178a88208b5894f8edb90d5d405770 SSDeep: 1536:8IgU4nxwe40el8/7CF29sbyjYRlCsDHIIsCFst9+QoF4OLxhnhL:l14xwe4r8j79QYalRH5Fst9AGQzhL |
|
|
| \\?\C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
4b7ab3bb6e18308f714f7a83cb7d4ee3
SHA1: 03f11790bf3ab3cebe0ebdf458d4e5f57edc982c SHA256: 046963ac2ca152e40bea7d08f53d2a2f1850b931a8a79ec462fae226d7623b03 SSDeep: 1536:m42pLKrrKDmCMrbs04l3Q9fjWCtpw3GwmUc+YlUzVsoV6SwfL4d6qa3GO4XgC:gpkr4mCM3s0SQ9xtpw2hUcihseEV3GOS |
|
|
| \\?\C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
2074b1ae513d10be20423cbb3867c1f3
SHA1: 70e7578570bbda4e15c97f92069908e9729fa3a2 SHA256: cee5589ec8ca1f205656a1be4d7b2561e56d3949191926ca880872a1610a6dac SSDeep: 1536:G05FAVYY3dVXjaxgaBwqNLbTDLnDhnrxUHWq9aG7Az0x2KN3f:rY73dFkg+wqFb3hnrWHRg7KrNP |
|
|
| \\?\C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.30 KB |
MD5:
bfb9ca3bba5d74b4f5b852be3dd11185
SHA1: a388336a23d8a13b9d31683b3b649e32a88056d1 SHA256: 8748f9557c051733d3fb85a6063f01c5a20b87e8c33877f43add6edb572b18db SSDeep: 1536:xrsaH+z5Sap/QTaUR9Xe811ZCkoCb5voKsT7gh8Kcx3Z6+R:xr8z5SMYLpe41QQWp708KO6K |
|
|
| \\?\C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
ebf15fcb254ec4fcfeb1fd1a07c86dbd
SHA1: 15b35c70f13f5e6336c3f70e28924d9c552267a9 SHA256: 682ce1c4bda92a62f3939a7c8f3c15bd092922b59a6ff0a6fe37c6d8bacae57b SSDeep: 1536:EZnLNhHVOqxVlCujJqQ1Ic0SqUIBugSVNyp526OTM/H29iJ:EZLr1OqxVlRJqQPqZS3yp5Rv29iJ |
|
|
| \\?\C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
56423db1f02629f0f0e1f5d449ffa5cd
SHA1: 741f8b683c1c46e7ba845850027c130dd5d4f1cb SHA256: 7ff1881c6ca5fcc8f58b3f716c0012501f64b705d4bdd9b3f681edc95bce7aec SSDeep: 1536:QF1p/3vsRh1zIvutr2vukYriCW6XRpJqBgNQiLzx3XhG:2/3KPzIverFJ+CW6XRfq+iiHx3XhG |
|
|
| \\?\C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
2aaee58c644e154d3bce790da8e40a82
SHA1: 5a8c4ce44f6afd9771e5e43b434103bca3d406de SHA256: e44ccf84a0ab75d382e9fceb24810acd1502760b86c8baf1f0a39fc3925bb6d5 SSDeep: 1536:UNWR+Q9epjr36q63TYzqd7G1A3NaFyoA4luWRHjiLeSAjI8wFUNxm:UIdqjz6dTtX3N+IQiK1twFuxm |
|
|
| \\?\C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.30 KB |
MD5:
c25dc6c76b45961cad958e7e3117aeae
SHA1: c2fc65eb66c7734cec080b4fdb9ef839d5b153ec SHA256: b8c6d8422515e14225845499af7c67dd7bac329deaee9668e91ac2cd551e89e9 SSDeep: 1536:UYd3DOJCNH43DbZjaeAAcIN2NMztOzU6cKTu3HAGfJG0Yj2qvhl43:Usqe4xOeABW2NeEzU6cKC3vhGj22hE |
|
|
| \\?\C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.38 KB |
MD5:
5f638c31352e57eca84cd28f59cdfd86
SHA1: 0db7a655573c09472c9999c2ef24cc3c5b5b2896 SHA256: 339f3ce924d1ad22acc00ff06c5c6a5688262987a54b13e9101b8ebfc0989553 SSDeep: 1536:Fgc/VFboxgct2VqVlFpkVFT7EV1j3Jq0yhf:J//boxgvqVlFp8EVbqx5 |
|
|
| \\?\C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
4bcf556b21cb9b7a7ab707e1915406ab
SHA1: 0caef58fa0c3c20af02ab81268df27ef40e88179 SHA256: 706ec2f67ec3d0bd3e34c5f6b776ba8c5ca1661e12255280eb940bf0809d783c SSDeep: 1536:lZOSWb5TVdbTDSAOZCV6u4Gbvmd2OhgGEW+lVZWvh+ZMmBPGD:fWbFaAO4UuDvozhREH/miMmBPGD |
|
|
| \\?\C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.36 KB |
MD5:
8f57a9ba338a0868ee847e908d3bef08
SHA1: df7b64c0de22e7e7c9d2db5424808012995d4321 SHA256: 2bb2e6d75ba9581e8a8f32e00333844db1a5cbd687acf1348d6697550d560d50 SSDeep: 1536:Vg+Y6fZSQBdfcYph19kpRNHmJUpyQfuHWPztkB7Mw8stvb:VHY6flXcQ9iRiUpyQGHytkFM1g |
|
|
| \\?\C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
5484c8e8d939894075b4cd76c6f2951a
SHA1: 47a04349bcd160976c49ee6d66df2ea16b95302a SHA256: b9388820fa5dbe1edfee9550e2aa8792f7869e9f00391248118fc94ad99ae954 SSDeep: 1536:2dHCLtKMG4S8bGPYeJK13i7BYunXgIsc6dKjTtyu6gb26tdgsCMqI:ECxxywNiB36Q0+gsCM1 |
|
|
| \\?\C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
e75d7c0aadc6ed8e10b80842496fd610
SHA1: 2a55fb2a2b1af9b724e70a259b0344f85e82bccf SHA256: de3e239f1aa9705a4b542fc7478e5f8825ed7c9fc41e0617a470787fcda90677 SSDeep: 1536:UgHDyeEiT2Lyvg+UcMbYgRHIIw9tMaKQepkHa1mJCpNwTSAR:UgjydyNCYgRHII+tbGkHa1mInwXR |
|
|
| \\?\C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
fddf82420e7495a27d02954d8680e0ef
SHA1: 40fa07b84eaeb5d82bd585dbd9ec64b56d71f084 SHA256: 2a5676fa4ff1652490bac12eb34a56c48e3bdd502afd5f3402bfaf875efd76f6 SSDeep: 1536:hBLL9RpaBTk43EWqksyE/quaVv7tYoSQ46K45auo4HU08ioHCNm:hBLL9nUeW2RKvxYoSnE5au8ioHQm |
|
|
| \\?\C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
bdf4897cefddce4457f72e442eaa1002
SHA1: 6bdfafa59793b9b2dc4a6be06ea5b1fb40e4c267 SHA256: 81f15eb064158c5b552481da5a6584fcbf21416674ee36649089f6fb044d12d1 SSDeep: 1536:AZ0BUf5hQwB2jKCBW/+IbENkMB7igESObwBoHHgoJvJkXue3JF:80BUrQw4jpW/+IbypBw+KHgMvyXnZF |
|
|
| \\?\C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.30 KB |
MD5:
25f5400ebd8a4f71aac27bacb1305a5e
SHA1: 928d7c955989e33ff503ea15b0111efee26f663d SHA256: d00111db07c5a53f83c76b4a2a1dad50aa80aa0f4a584fe5f87051d63c1cb2ed SSDeep: 1536:GvqQq/42bWXNOs6Y0JPxPeF/xdb+0jrDZy9/sRfTxsiBp:GZsWXLZ0ZxePdb+0jrs9an3 |
|
|
| \\?\C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
dfcac8eb5953ef1ab8b39a4406a84b6d
SHA1: 47540aaa71c5ed5caef305a8df0d91a08a579426 SHA256: 74cb5072bf4453a3ad7a35d28eb94c79c52963fc1b2bbce736cf54dbd79c2ed1 SSDeep: 1536:u9eEEJzOel9iw7eNuoht6q4p28JHFB48EnTgu94/l4XlIcGT:wefJzOIZYhWq4p2+1E8uiAOn |
|
|
| \\?\C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
858ef8f25a7776cddc908ad0e14b1146
SHA1: 5c73419e1ce1cc3f10a4b6580d43bd988eb67885 SHA256: bdf95f4e114c2b54f5020865ae5f26e7930260d99a5ec0c49ae5fdb9dff210a4 SSDeep: 1536:k3DTAEXZ07WdvP2egESfGZovFkQmALAAQiIXQntxngeSPqmi1pRS:iDTJp07WJQFdkQmALAZAnMeS6RS |
|
|
| \\?\C:\Logs\Microsoft-Windows-Store%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
f504c8f2d00c1f2fcaa40fb61a7c3f42
SHA1: d3ddc1be4c7afea40442a74d1841cca12851186c SHA256: f108033992d46a70071344380e4ef478b129b692931c162f090e9076dfd3a70d SSDeep: 1536:gK3yRdXI8xFQgjDvQAYbXhaz7QVW6arqiIEWeiW/WvoS+qVZkFi44nr:8Y8xugXJ+sn+mNWenWvpVVZkFiD |
|
|
| \\?\C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
078250503996b3378d5c2548a8a9ba66
SHA1: 2cd414e8d8537bf160f9d1b2e632b7c0610253c6 SHA256: c57e769debdbe544b8b4d5b397926593d43b7afd7bb5c27e64152016f785b9ef SSDeep: 1536:3Vycaoc3l7JDyxhFnXaUBxTgWkPDDXHBc/2f1AqDO2wfdOb:wJp3llDyxhFXfxYPHBfSQO28Ob |
|
|
| \\?\C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.36 KB |
MD5:
48b193627828240ae2036cf74932010c
SHA1: ad9ada80c39b7517d3e42e8d235fdaed4cda6425 SHA256: 89082a8cb9ba3d30837f767b5650ea0a4bf33c50890104c38ddd51cce1fc2805 SSDeep: 1536:654WthpiQodetNHG0etVQr+lG4plFVPKmI6ZKS/fz:6iWUr0NOWkG4pl3P86hD |
|
|
| \\?\C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.36 KB |
MD5:
8aa618eec47f45ac9fc19f1209d2071a
SHA1: 35c5cd27f67a6c5c79945f142656001df1af25a8 SHA256: 50801dbbc01de50261cc04ca653796f9ee1e84619551b360ea05a88ad466f732 SSDeep: 1536:rGkMWeWmQcIgs2TAYKOxNwyngMPZpD7cJSgkQ6rKHhn7:SnWeKGt7MMPZp3c/dn7 |
|
|
| \\?\C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.38 KB |
MD5:
449e9513f8855975a690b19bed257a28
SHA1: 9fc10a0f976f14fd089835eae514b1ba9b051dca SHA256: d69c7df6405ec0269785d5c138b75715c1ead6ce9dabc7e4598b7fb664325cfd SSDeep: 1536:a4gHLNEChc6GXSY9M2RIaUFA57xBkD6KH2LvdBIvB/mcZQUkuYv23:a4yhhc6KSY9Mctj59BkD6KH2pBIv11mC |
|
|
| \\?\C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.38 KB |
MD5:
186f063bd73a257b391e7bf8a66189c0
SHA1: 861bde912c22e28424e9f75322c6bafa8ea3eb96 SHA256: f6ed44fe8305e313258e3846c868e43c1692b430a89a2b6fbd65c7166f24fbb7 SSDeep: 1536:LzBKABYoHEXEm4M0/+J0v8vjAyZHVuYe8kbZcHhwF:LUWQt0WJ1vjZHVunHbZ0GF |
|
|
| \\?\C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
6308452811881190f9d80a483905d11b
SHA1: e7bb775225547f8f5f7a0ca2301cdacec09b119b SHA256: b2366696d89002069dc06ac89ffc4e05d64e26b172eddfbae8de24128ed7d5e4 SSDeep: 1536:2sjhH9+a7mSnRE2LuvF8uH9fAj3CKgJl7vwJS/UBgCVNz2qiblj9U0vvcYS:tz+annNIxH9fQ3CKueM/UvrzR+hdC |
|
|
| \\?\C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
348c9319533580874372061e84f7ffc0
SHA1: a662ad495be0d94d9817c139ab39d970092ff12c SHA256: 7a172430e371155c9115e251c114168eb4f1f345a38140a4340866e9dda5c248 SSDeep: 1536:6A8PZC9yhsMjE9FPo+hC56w+Vmmn/Tx6ILs0V5pCKmx:6TPBuMjE9ZlUInmm7xpLs0vpqx |
|
|
| \\?\C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.35 KB |
MD5:
667be64603fbe4ed316de3fd3ecc47fb
SHA1: 219de947f83b67ae76783782a34eb1b54318e5d6 SHA256: ec16514f85c504b07e7afcf05384786bef172c81cac0db4004b80637eec6d772 SSDeep: 1536:rYrKK0Y259vDpTUvhJKCVYKp27Yik50ScW1IQ4t98/7ZDv3N/J7ad2e:serH59vDpQvhoCVY22+0cIjt98xFh7s |
|
|
| \\?\C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
5f3dd03cb99ac378f479f9b50dc16acf
SHA1: e29277d83525afb0b5aeac74d3cfafa9fe7d50e5 SHA256: e37f6228e95c482f0e53fe232d6e99c65f8ce7bc01f64b4c1b47f2c5d0ca75b0 SSDeep: 1536:oDrR2gIn1gaa894UKDrn4ZXufeWJUozGylEHlteSsEs8LRK2ulv:oPR2gI1jzCraefeWJUozd8oMRK2Kv |
|
|
| \\?\C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.35 KB |
MD5:
0b0740efaf52ca0e86851dcfbe0269ab
SHA1: cea8b1e62d0e9ebe8c4b4325195f5e548a89849e SHA256: 88f35c1219f93017124e5d3c904eff3c93c16620f96cea4cb46a8347cf5a0359 SSDeep: 1536:biPWezZNgzitr8oQG+Cnxf20gE0g7lkYVKTfVhpRPP5Y3no5ASwsp5fJx0A:biPhZdt/QGHxlgi7lk5TtRX5oo5ASw0V |
|
|
| \\?\C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.33 KB |
MD5:
a734528d91e36070b682f8f7cf920ebd
SHA1: 3887976ecd8d610a7b93f3f2b6cce33756e5d45f SHA256: 4420a639312cb5e55e5c55670fe362bcf326f005319aa9a5d7df66126aff3b0d SSDeep: 1536:YXK3M85NEhhnmcd+6FEDchVNpzom+jCaYppbMbR/YA:Mt8kG56iDczrom+aA |
|
|
| \\?\C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
91098d57487bee030ddebda9dc165983
SHA1: e3f19a257ebf2eda41cb37ede145f7e395040638 SHA256: 2966830f9a17b936fb81cecf954b06cb2c948184e5303cb6c5559a2ed34dfb9a SSDeep: 1536:8Uj71NFPDC76RHJtrvX5yAC9X7LzE8jdm77sDTTzRnAaHjkj:bDFPDIiptzX5yAcPE+TTz5FDkj |
|
|
| \\?\C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
bea94a1b856dcdd54baf8a0879f355b7
SHA1: b2d31e7f378c9846e6303c376b05c4af864a705c SHA256: 07a2185b997dddaa09331a47ee49c888e0c4bd256b4806b73a4e5e632d4333fc SSDeep: 1536:4QVVT73SRP0w0YUT2I74/YTAjelVroPeFe73TwGtRnKfpzJKnAFGFlxr:PTj+8wrUO/8EYoPeFo8GtRnGpdKZr |
|
|
| \\?\C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.39 KB |
MD5:
e0d78592d08b714f1fff2afb3d857bc9
SHA1: a7f962891e9a451e84c8a4505680e648a6efd79e SHA256: 733464969a8fab7a8fd77867a0e1e3b924ca9f5823e446e7270042917df12c30 SSDeep: 1536:+Fy/q7Q3z2gtJWBV5FCNv4VMKgo61b2mW7r+ibQbDrrrTt:+gz2gtJW35FCN661bkXVb6rt |
|
|
| \\?\C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.35 KB |
MD5:
e7866875b914ae66db22692e51c45dff
SHA1: 1f77d1088a236d317c8a465ba44897a59b5ef0ef SHA256: 92309dd05ce441ef167cfe9695ff4f24e20de0e4e81d3b02c7cbe52ae754c8ea SSDeep: 1536:6ZxWv2MRMl9gEJeF6Bl0HukS8dZBDJHMBPXrh+v+1TJVhmF:6ZxPMoBl2t8vrh+YJVhmF |
|
|
| \\?\C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 1.00 MB |
MD5:
c859a29a2d18c44a2e54ea87f1ef2057
SHA1: 3b6ca8c92a88092130c234c1a3bae27291adfe14 SHA256: ef5cb0d2201eedbff0197f407949410bb50411d00b770a2a23fae850883df34c SSDeep: 24576:fC95S/pMDOMD/cOBSTcMOIWKdkc2Wjez/6CFqBcdqXpX6:fC95+pMKM98VOoiqjeT6sq4qZK |
|
|
| \\?\C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.31 KB |
MD5:
c214c2fa1ca9dce481c012be61e9bc08
SHA1: 3d8b83d2cb27b37469598db03a50c8f8a017f769 SHA256: 75fca20a2aa0030d86baa9513ac5549f2c96d69d9b9a27a94f630275e7546810 SSDeep: 1536:DA80tzS5yqIHGRRv7quMewZ38oUjSusDmi1KIbYesN:DA8wqImr7quMHZ74lrgx4N |
|
|
| \\?\C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 1.00 MB |
MD5:
fa76ba687a61ba5dc1d18d09c37cd3a6
SHA1: 867ee1148d48333e766d26dfd85bfbcda3df00af SHA256: ad6db3b43ce0b140c346e3ee5da0f21e0166e648bd59a4d79370e56966e264af SSDeep: 24576:JIDkjPrmM2tbjYqP3vE/gmBdVJQnWqBIB1vJ:2JtbjYeyXVKWCIBdJ |
|
|
| \\?\C:\Logs\Security.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 1.07 MB |
MD5:
6ebc41ca4c8b1f6e2319f932f6833011
SHA1: 9b08b5e09af8a0caaed2f696924c8137e6e48ece SHA256: 41ef44c8f22570269a26f9c73e941008001d3859c9bdff76d1f76a796841f766 SSDeep: 24576:7HV3h6MxpR16jQq+5pnha8iBheNZ8w600VDOOSa2ppphjMsdOjhZzWoFIR:7HWMx/1C+VbiXYMDWppho2OjvzOR |
|
|
| \\?\C:\Logs\Setup.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.25 KB |
MD5:
1409ecdd5461703a78bfd9c326dfd299
SHA1: 3319ff4e24ab7a2a11b11e706816f0b36210268e SHA256: d3405879be60708df3c39f853667990bbb51752e76db05f67c4fc7c137e3b6b8 SSDeep: 1536:rhlavCjwJ74/M7bG9+Cq1S/7KnaC6sa7Nwxgak7uaa:rhKCMJ742GUPSzKR6s4Saa |
|
|
| \\?\C:\Logs\Windows PowerShell.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 68.27 KB |
MD5:
8198f53ae16be4be9144717617960aaa
SHA1: 8cc5997e892efe1ed3f2aec2a7e877ff7bf01d9e SHA256: 215a3f393d9d4690c908e2c715573db38a2fe105150879e71562b51e531527a0 SSDeep: 1536:WdGZbBgv6zDEsQQoVdFbvECZB2ZlwqD43XpZP0POsppFRR:WgZtgvkDsQoR8Crtq433MOC |
|
|
| \\?\C:\Logs\System.evtx.id[B4197730-1016].[randal_inman@aol.com].help | 1.07 MB |
MD5:
3106efa841d4da376c4ae415946c81c4
SHA1: 48ce6c83be5f364930ce74d9d0c9604099229682 SHA256: f954377fd0162d423a1981ba2af298b8df3b1b6ba9214d870d70393c792a1618 SSDeep: 24576:NxgDXVMDw/2nttMmqAIXbujxg4ay+KGJ2R+GYlq8ax5cwQKi5rD33:KD/HRAIXbuj5ajmXYlq8NwmrD33 |
|
|
Host Behavior
File (2478)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | \\?\C:\$WINRE_BACKUP_PARTITION.MARKER | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG1 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG2 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bg-BG\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bg-BG\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\bootspaces.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bootspaces.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\bootvhd.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bootvhd.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\da-DK\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\da-DK\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\de-DE\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\de-DE\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\el-GR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\el-GR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-GB\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-GB\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-ES\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-ES\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-MX\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-MX\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\et-EE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\et-EE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\chs_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\cht_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\jpn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\kor_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgunn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgunn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgun_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryon_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryon_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryo_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgun_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjhn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryo_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjh_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjhn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyhn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyhn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyh_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyh_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segmono_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segmono_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoen_slboot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoen_slboot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoe_slboot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoe_slboot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-CA\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-CA\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hr-HR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hr-HR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\it-IT\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\it-IT\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\lt-LT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\lt-LT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\lv-LV\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\lv-LV\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\memtest.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\memtest.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjh_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Resources\bootres.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Resources\bootres.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Resources\en-US\bootres.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Resources\en-US\bootres.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ro-RO\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ro-RO\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sk-SK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sk-SK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sl-SI\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sl-SI\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-RS\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-RS\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\uk-UA\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\updaterevokesipolicy.p7b | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\uk-UA\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\updaterevokesipolicy.p7b | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\bootmgr | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\bootmgr | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\hiberfil.sys | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Content.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Content.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adojavas.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adojavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-International%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-International%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-International%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Known Folders API Service.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Known Folders API Service.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-MUI%4Admin.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-MUI%4Admin.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-MUI%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-MUI%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00448_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00448_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01178_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01178_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Copy | c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\shaofao.exe | source_filename = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\shaofao.exe |
|
1 | |
| Copy | c:\programdata\microsoft\windows\start menu\programs\startup\shaofao.exe | source_filename = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\shaofao.exe |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat | size = 69648 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF | size = 69648 |
|
2 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF | size = 306 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF | size = 1052688 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF | size = 69648 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF | size = 322 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF | size = 69648 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF | size = 306 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF | size = 69648 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF | size = 306 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF | size = 69648 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF | size = 306 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0086478.WMF | size = 69648 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0086478.WMF | size = 306 |
|
1 | |
|
For performance reasons, the remaining 1474 entries are omitted.
The remaining entries can be found in glog.xml. |
|||||
Registry (19)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
6 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
2 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 21976232, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 21976296, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
2 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 115, type = REG_NONE |
|
2 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 21976568, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 | |
| Write Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | value_name = shaofao, data = C:\Users\FD1HVy\AppData\Local\shaofao.exe, size = 82, type = REG_SZ |
|
1 |
Process (974)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\shaofao.exe | show_window = SW_SHOWNORMAL |
|
1 | |
| Enumerate Processes | - | - |
|
950 | |
| Enumerate Processes | - | - |
|
23 |
Module (37)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x774d0000 |
|
16 | |
| Get Filename | - | process_name = c:\programdata\microsoft\windows\start menu\programs\startup\shaofao.exe, file_name_orig = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\shaofao.exe, size = 260 |
|
7 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x774e4ae0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x774e4b20 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x774e4b40 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x774e4b00 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Wow64DisableWow64FsRedirection, address_out = 0x774e6b30 |
|
5 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Wow64RevertWow64FsRedirection, address_out = 0x774e6b50 |
|
5 |
System (99)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Computer Name | result_out = NQDPDE |
|
1 | |
| Sleep | duration = 5000 milliseconds (5.000 seconds) |
|
1 | |
| Sleep | duration = 1000 milliseconds (1.000 seconds) |
|
70 | |
| Sleep | duration = 500 milliseconds (0.500 seconds) |
|
23 | |
| Sleep | duration = -1 (infinite) |
|
1 | |
| Sleep | duration = 60000 milliseconds (60.000 seconds) |
|
1 | |
| Get Time | type = Ticks, time = 93781 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Mutex (109)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Create | mutex_name = Global\1016B419773000 |
|
1 | |
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Create | mutex_name = Global\1016B419773001 |
|
2 | |
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Create | mutex_name = Global\1016B419773001 |
|
3 | |
| Create | mutex_name = Global\1016B419773001 |
|
2 | |
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Create | mutex_name = Global\1016B419773001 |
|
4 | |
| Create | mutex_name = Global\1016B419773001 |
|
2 | |
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
27 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
4 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
12 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
7 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Release | mutex_name = Global\1016B419773001 |
|
1 | |
| Release | mutex_name = Global\1016B419773001 |
|
1 | |
| Release | mutex_name = Global\1016B419773001 |
|
1 | |
| Release | mutex_name = Global\1016B419773001 |
|
1 | |
| Release | mutex_name = Global\1016B419773001 |
|
1 | |
| Release | mutex_name = Global\1016B419773001 |
|
1 | |
| Release | mutex_name = Global\1016B419773001 |
|
1 | |
| Release | mutex_name = Global\1016B419773001 |
|
2 | |
| Release | mutex_name = Global\1016B419773001 |
|
1 | |
| Release | mutex_name = Global\1016B419773001 |
|
1 | |
| Release | mutex_name = Global\1016B419773001 |
|
3 | |
| Release | mutex_name = Global\1016B419773001 |
|
2 | |
| Release | mutex_name = Global\1016B419773001 |
|
1 | |
| Release | mutex_name = Global\1016B419773001 |
|
4 | |
| Release | mutex_name = Global\1016B419773001 |
|
2 | |
| Release | mutex_name = Global\1016B419773001 |
|
1 | |
| Release | mutex_name = Global\1016B419773001 |
|
1 | |
| Release | mutex_name = Global\1016B419773001 |
|
1 | |
| Release | mutex_name = Global\1016B419773001 |
|
1 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #10: shaofao.exe
20
0
| Information | Value |
|---|---|
| ID | #10 |
| File Name | c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\shaofao.exe |
| Command Line | "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\shaofao.exe" |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:03:03, Reason: Autostart |
| Unmonitor | End Time: 00:03:06, Reason: Self Terminated |
| Monitor Duration | 00:00:02 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xd08 |
| Parent PID | 0xa40 (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | Medium |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
D0C
0x
D18
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| shaofao.exe | 0x00230000 | 0x00245FFF | Relevant Image | - | 32-bit | - |
|
|
|
| shaofao.exe | 0x00230000 | 0x00245FFF | Process Termination | - | 32-bit | - |
|
|
|
Host Behavior
File (3)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open | STD_INPUT_HANDLE | - |
|
1 | |
| Open | STD_OUTPUT_HANDLE | - |
|
1 | |
| Open | STD_ERROR_HANDLE | - |
|
1 |
Module (8)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x774d0000 |
|
2 | |
| Get Handle | mscoree.dll | base_address = 0x0 |
|
1 | |
| Get Filename | - | process_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\shaofao.exe, file_name_orig = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\shaofao.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x774e4ae0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x774e4b20 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x774e4b40 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x774e4b00 |
|
1 |
System (2)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = Ticks, time = 97343 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Mutex (4)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Release | mutex_name = Global\1016B419773001 |
|
1 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #12: shaofao.exe
6884
0
| Information | Value |
|---|---|
| ID | #12 |
| File Name | c:\programdata\microsoft\windows\start menu\programs\startup\shaofao.exe |
| Command Line | "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\shaofao.exe" |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:03:27, Reason: Child Process |
| Unmonitor | End Time: 00:04:05, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:38 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xe64 |
| Parent PID | 0xce8 (c:\programdata\microsoft\windows\start menu\programs\startup\shaofao.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
E68
0x
E8C
0x
EBC
0x
EC0
0x
EC4
0x
F84
0x
F88
0x
F8C
0x
F90
0x
F94
0x
F98
0x
F9C
0x
FA0
0x
FA4
0x
4D0
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| shaofao.exe | 0x00B60000 | 0x00B75FFF | Relevant Image | - | 32-bit | - |
|
|
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 26.49 KB |
MD5:
5b5fa6722ec5bcc34a61df6ee16df9e2
SHA1: e42104fbd6ff32890f3c7eb47c924e3d0e6de453 SHA256: d0a54ad943502c481f5cd8bab350f38a987ec952b0d7dd523eb7f7a65e0828f4 SSDeep: 768:3Ggwxbias6WmjxOgV7FsJtcihkqujAIje3Mw:2ckWjtctAIC3d |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id[B4197730-1016].[randal_inman@aol.com].help | 387.92 KB |
MD5:
88f9ad080c5b65dedd24445bf234822a
SHA1: 6592e1a055265a37e0170d38c6098d30e21003b3 SHA256: fcf4b6a496fc61a6b239e866be8e2c8383daf85a7bc4396baf23536e7f5b6f43 SSDeep: 6144:acjOZihyof9HASW7hu7QHG85bOTCj/sMmu+eDgHM/N5nWtQxCHBPXSLD3nrMbXZw:a+Eof+SWNu737u+6gsfOICpXSLbrslXu |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id[B4197730-1016].[randal_inman@aol.com].help | 6.44 MB |
MD5:
5c3a465583298f5052100768c7447ef2
SHA1: c15fb59f03d932460fd110b4180b1baf773ffa24 SHA256: e44ff03342f71f513228b1bc8370d770b6012b9939447ec2be1a82a4ae23dfb8 SSDeep: 24576:zBc9b6xjOkUgs8Rvi6w3CA1h5b5iFN4atEua3:zSbDkUJCob5CEuu |
|
|
| \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id[B4197730-1016].[randal_inman@aol.com].help | 15.86 KB |
MD5:
f1d5c36332d5902050c29919239530e6
SHA1: 95123456f5adc2d57ddb8b2aad9b5af0ce4b132b SHA256: 3a1113873f22289ccd7eb99a18966774b188af196719523bfeb4eb11c3a5d039 SSDeep: 384:+x6mG8xRojwedMtYXQLjAdgUoWZtp1zHBrfpxf0r:+x7Rojl2trnAdTtvzJw |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.47 KB |
MD5:
d0d981b1e7d45714a0418e89be017142
SHA1: 0b9600fc1f836c18f3ecb6727afe85ebcd11da6c SHA256: 892b6b23531ab3048c96126634d7df1c9dbb9a3bd64a4c40c3f320fd6c9f820a SSDeep: 384:NngTbULp4XSRKTQUE99VPD5uX6od/e6msl0iOKjF2T4ERzcjbVO:qHUlTVW6og6N0iO8F2jGU |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.47 KB |
MD5:
9c010541d68aa9544cc0b64202536906
SHA1: 7f459bf0625af265621d85bbe50569a3d44c5ae7 SHA256: 67537e940348cead59b3ad8a9623daa2cddf8f1c37470f9aac9d0a368985559d SSDeep: 384:u9kzAqZcpZxl4Na6FqXUfvCmlWl/lf6mAlFEjh8Ad+2Y/mo3tw0LmgCLMlMbO:uYAJZX4N7CUPEFRRAf2A33W0LmwV |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 20.99 KB |
MD5:
6dd7268f788949fbd1bb2ca051093125
SHA1: 2d3773bcda3cd4325f0bf45f3f7bd21120eda0ff SHA256: 4c2776cf8613f5de51f10606cd6fecb27712fa57eab7cadd7ef428e4b46ffc7c SSDeep: 384:PvoWJ/FApJjyJsm9PAkf5TacKMl2R5bZNhG/FTQqLzHpXH9XM2AGVqjW+:PvHkp6sm9PA4pomKJZXGQqLzHpX982tE |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-1016].[randal_inman@aol.com].help | 19.00 KB |
MD5:
7fa15a4b9fc6b4a44c5c6344c8cec3c5
SHA1: e1877c32b97d9ae4159e82f8baaa9ce909b4b4cf SHA256: a0790e33ab2840faff560a323e73ddbb98f8e4e45aed306caf40e622a48361ae SSDeep: 384:bnWBJeea4JvX/QaMjKYHv9VjWG4OS3JkQzUhRyK/dI2uJPlN+KTSIlQdn6z9cBu:bnmee9JPnM2YP9MfPzkRy2uNB+IG96mI |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.99 KB |
MD5:
da40b8191e91d9452ebb7ee99a662d88
SHA1: f69cf497a68a98c703677c83ba6cdf831597e91c SHA256: f4518c30e79f7c089227079fef63977a744673d4a9befd626d93287d0938902a SSDeep: 384:JftB6XSYSrbE9se4XzgKUkVPRg9pCFFpD2a0XL5YALU2CVtXFJXGwbMJ+:5tri9se4jHPByp3UzX2wh |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.49 KB |
MD5:
e5c6063d610b5b22060fb2a59862e7ff
SHA1: 51257125746dbdc5b4cf8fd3d89af0fd064b56d0 SHA256: 850affba0777c8228a34f1030028833df15b26824e11d83d28434e02ca474e0b SSDeep: 384:lTvJJaA6jqDPoptHhAwiAOFj2asHLwgp6SJi+:lTDaBqDwLHhAKmlWMg0SJL |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 11.64 KB |
MD5:
53c80b69347ce88e452c6fce9a14f4e2
SHA1: 90bcfcbb58c26b6bcdb0ce94acd7819f26a01639 SHA256: c46a0bc0d71efa0e175b8081efe2eabd758b89a003b92db9eccf209c7ea38d4c SSDeep: 192:XbR13ZoK5srTtMygZRgasgD4LZl2UFMu4aLpwNPVWaA04+VRsYMi/H/nCwRCZ+:9hZoisrTuyg7bdD4NPf4opqXS+1Mi/vp |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 19.47 KB |
MD5:
7f4aeebb802aa24610fd4e26f6fa0ccc
SHA1: 1e5acefc7df98535eb3d9aed9133988be8c6054d SHA256: 93b0b1f61fb83a4331efa135ecd3153605a974e6b8fb6bc651acd82552d0c05a SSDeep: 384:6GOIWGWuHClBBEX93ozR9wij+5c0afGWFSallBjB7n5ZXMmm0M/Bifu+jRHzxJO:NpBoGY99MfBallNB7HM50M/85RTxw |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 22.49 KB |
MD5:
765f1fe712951b1e72ffbc18bbfe8719
SHA1: 6937cd4469bf18887b8d241366f0188eabfb0226 SHA256: 6302b9cd6af1e10483baefa1a4850accf4df8ac7fab9e0d8bb1207ec8aac4626 SSDeep: 384:yoUJoqDsJVzgc6gljanYF5kmwl1Kp44Tb7BP1AHnfnIOwRH/7CquhB+:n0lwJVzPDmmmbKp4s7/AHfnI8Y |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.99 KB |
MD5:
764600c5a6addbff67312d16d9eefc34
SHA1: d4284d322e8b070f95ea354cb491bf23e0da7b39 SHA256: 186907ab21b97f3e28cd9ef3465c270fa3a850c968f3534f01d76c86bac3335f SSDeep: 384:dGnWskTnz6YY0Z+3koSom4Shia5DVowQ7zPYINE/kiW1/d+:8Wskf/YY+3n85DVowsUINE8T/s |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 19.47 KB |
MD5:
4fbb04bc23a28a53c381b103aed1a59a
SHA1: 9bc569e43b4e4289c1cf4aa1d60efc5011446650 SHA256: f2e4a29501baaec271c17ddcaa2fa76d85de6da7f250fb20a1e5b7e9ab1a29ca SSDeep: 384:3WJDP2lcG/iGZm2drICTlmYCGj+w3fBXdbC0K9mqeWvO:3WJP2JiGZ7rI0lRd3ZXd+0KVs |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 20.49 KB |
MD5:
9927c0243e82c6f5630f21938a0db99e
SHA1: 858bee86bf30f60f6f6231315dac3b1ac3dafb4f SHA256: 998cf5d6884fad6e2a6ffe320ac08a65d85f8d8f85c5d942cbd9141446209320 SSDeep: 384:hfebDroA99ntU7ohGvPsKYJfsZNqcqQxSDGN6XB+1soDNp+:h2TV9y7pvCsZNyQxJYXBjoA |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 27.47 KB |
MD5:
1812cd8f9064eeda83e2e2a4959efbd8
SHA1: 0e089a7a4150a52553b33274ed2f737bafb3b9a5 SHA256: 4c428b11081d0dd3f3d04aca36d4ab01c0705ab967ccbceb4ffa51063eba9434 SSDeep: 384:lQL+OJgwwtz6GZb2xh8jralBtEfUj6luWvIJnFX8eejtxAwvQuyFy5me9TCPR+VM:mI1F6DmGLtEMj6TmEoH5Le9GJGP2D |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.99 KB |
MD5:
d10b30596f910ad65b9db5ff85db0d47
SHA1: c7d8b699f5ce096590033ceae7ac8c16e6184ea0 SHA256: 1cdb6746919bfe12d105b32755aba62418e3a4a59c4a779ecd69403c7e4571dc SSDeep: 384:D1pwLJKgQ/PWsvthzvfUgtuWUNCUmIWSOBjYrLpGh9WoMPa22Y0olQbf0+:lp/PW+nzvcIxGTWSY0oMP9BQbV |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 69.49 KB |
MD5:
8f59d458f00cdbc23542d85b700f58b4
SHA1: 90e21b509141a0a11b1ebdca1379bfd4f3e385c2 SHA256: 0410bdab70523810a7b04695725b0c2533ac55cb0b58a486b3ed9b3292af5904 SSDeep: 1536:gUzTR8zxDzrcD9IzLBigjCN3z9RlWVA5vdGOXjdAHOwWW:rQx3r/zRghHpBd/AHOwD |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 22.99 KB |
MD5:
ec9bd6619eb52e29fefc375040e0d9c3
SHA1: 421678156c492fdfe347ab7756910af60cc8bb13 SHA256: 630a3dd32d1658a87dc81633fac64a9d7a85206f7c72e8d532d23cd72c3fe2dd SSDeep: 384:380VGbeaaa9brGPRYFhk++6y0H4EPTrygZKH5xgPhbfYYJbDPui+:s0VGbeaVhYqSx0H4GTryg4H5xgFfYKXQ |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 6.77 KB |
MD5:
04f40ce2aa4dc37b16b88fc4daad4083
SHA1: 6874751b2a7c993899d26db8cc78e842c4ba5e44 SHA256: a1b7f3abff405beb2a724bf1c461312a996ae1436a1cb283ef6d0c0be1d3b007 SSDeep: 192:eoCXFvTFUY+xN3hJExQ2XT/QQTSuGB8WoPssN3L9+vDm7jTkn1D2:3CXFFL+ExvIjB8WoPd9f7jTk1D2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 3.42 KB |
MD5:
c5f36a9af120703193dcae3f03b64342
SHA1: 4a9f55e742f5c942e6a9a7f19ad41edc2452d238 SHA256: f39438ac13229583d553d0c53da75c2463a6d1974ad5e7ef92efb3b95e85fd1a SSDeep: 96:ktnuKlvS0c4ekVzIL+rPVbg3gyk3waCCz:auMS0cFI86DV030K2 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 24.47 KB |
MD5:
4669e970d360026b9c00d7edff610c10
SHA1: eae1be6189525447d88e2f59fd76ce83e48463ec SHA256: c2f353dd0fcc044d5daea81327b7dabda5249e1698af1ed3efa5509c60471580 SSDeep: 768:STrN4pJsw1tVG4sjSAWtYrCmChu609O5J:grN2siG4sHEYmhuv96 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 19.49 KB |
MD5:
ce9f21447910ca9799ec9933d44d58eb
SHA1: f1e1d579c5fdfcf62e2f527475419d52bee3a50c SHA256: ca50a410a311ad450e14457019bd8c01e1920565c28ce8c05a6cbe6ffaef323e SSDeep: 384:2HjUP8EgJVPeM4t/p6IQ1AvViOoPUE9untmovR/YSd0FP4okWXGesVnHcgParcE8:gJrLL4dMx+iO75HPFs2znHcgPaIj |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 20.97 KB |
MD5:
9a4ee7d3ff18a887cae841c2f30d3183
SHA1: 67d3dce890ee7e9d38f185022e2a65c1b2a1e593 SHA256: 56954d281b4f9a2cbd8f9e3f9ef789c36e6b15583967d810ac37c1ca2dc4cdb7 SSDeep: 384:80ryUK5e0CmTYRTJXmYiNF6dsg5tRJuCWY14m0S1/FhMOpx1rSO:byL5emkFJXFiCyqNkGNqOZ |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 24.49 KB |
MD5:
fd0e04f81e41a653a8effa0381e79a2b
SHA1: 014c387be02bb64a8d8e06cd2c210e0f344bbfce SHA256: 44b8e184e7e8289cfe22373c6fdb79e25368541f8139b15d4f369fcb09ae7e0e SSDeep: 384:kaEWLsK5mvfwIH3JZ7z86NbRxRiWsT5puINxu3+w7OV8u4e/qpewPY+:kaEWYKmvfRRz86NtxRYvuI/u3+tP/yVp |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 7.75 KB |
MD5:
0ece5b114de9fe5bae94a9f1e3241eea
SHA1: f53eaeeb009b1e9fa3adf8fc253a478f816710f8 SHA256: 9d209c5bff616c8be78d5550a51c9ba73d2ee465592d6eedb6b1fc7aae3b82a3 SSDeep: 192:+nAfg7x4McbmUvS8ceDshEDnKs8dqVa9VwxNJZiXExi2:Fg7x4vLq4DoZ0MVgN3i2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 8.16 KB |
MD5:
af935dfc1c6b484a1dfe4de0b57716ac
SHA1: 3351d18b880b852fd46c36972ace8408c495f9f9 SHA256: 534ec6e32bd3e05b71df17e81ec139e8f2ac95ffe83010479a8ed3b1bc92166c SSDeep: 192:kLu+6CEYE9NQEqWES4cF7UOFziEtBPmROm/yVa1o2:k76CEwTjS4cF75FziEzYyeo2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 770 bytes |
MD5:
b340a69e18fec0b2e6b26a2464b384a1
SHA1: 7565f03fee6cc95a5a021d9e49cab107b10a8c60 SHA256: cfffc4e408389e4d32141d96b8e73e4d271467904f19d6756a76a80459467bc0 SSDeep: 24:4gjOjUbJ808Zjtj4h1PsSacLWx7axSCJJz:7qjulIjt81PTLWbCz |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | 18.99 KB |
MD5:
4c9ee0a059de146c8055dfad09f7a45b
SHA1: 6b1b11e1bfbe85f3a0f9f713c9781e1eba1dfd20 SHA256: 090cc52f193913a72ab3636119b09586ff30459b22fcef6c4a510efd8cd68777 SSDeep: 384:LoMjW0GgBPwg11oRzxXSEaPa6ZClwX3cXjWtmctUlQsYyOEFBxD9ZgdUCYTYQXEy:HLGw4g16VXSxPa64o3cXjWdtn6FF7Dw4 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 11.86 KB |
MD5:
1b984df9ef2728771b21de774df4aed0
SHA1: f34360aa598722bb8c77dcd108ae3cb2277d2b6f SHA256: 1db0c445ddd4f0610563e7368e66ac04c4804fcb7f11ad0f60750ee55cba9d0f SSDeep: 192:tSGqZGhfQi+nLidY2k5DFc/vk/Yj1b6kBNLcBQon8K+KIjifCcXLUv2cv61DNB2:tNniLtOi+1b6kBNg6oV8jCLy961DNB2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 12.64 KB |
MD5:
c56f10af462e2f616c80ea2ab83e505d
SHA1: 657a310ea0e34930030b66d0c0243ca85ce95cab SHA256: c7ee913d9f9dfdd3bdfc9e6f4c2ac5d010aefa85e1bc33c329400e79bdd3aa2a SSDeep: 192:ZGss8fncV813YOl0FhEpLiCGdff8v3C7YXCGrGoUiEgrZlisd4+easOvdqbsq+CZ:EV81p0fEq9f8v1XEDuZkse+LsXAjD2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 754 bytes |
MD5:
457fdd294e20049ba65a2591d95146eb
SHA1: 6147ace03f4b7aefeeab9188dc0e64db21912449 SHA256: 0d57efe9e037338480364a2327c4b7dcb0eb10dae1792e332bc55df80ea875d4 SSDeep: 12:0M7/lXnWne9kzX/TS6EQHcnBqreGREj6tGveJ3txHiAqqcsVaaTUNUxSLGJJz:/t8eQ85GamD3HHifqXqaxSCJJz |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 3.64 KB |
MD5:
b36363421e107ac6ee53803933ca7409
SHA1: f17ad8985a5ec18849efa4fa8335aff6e96f310d SHA256: 8c36613af7e33d0076a9d21a995e4062a2885e3b453b096ad41f8e9be80e0e20 SSDeep: 96:F9RMJPE+EnXdCOlSjxAoEXO2a69TlhiCz:F9RcEXnHl4ioEXO9N2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 12.44 KB |
MD5:
2229853e5a66973cfe66c6f813a1bb6d
SHA1: aa4bc4b05250454eb6ae7af55bbd793121cca009 SHA256: da975eff702afdf2cd1367774838018834c0619704d8e6551a70b598c5b3b467 SSDeep: 384:3sTF648rUzKIVi9jiRf/khXdykQs2G9UN2:3sd8rUz3ViMfsbymH |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 3.31 KB |
MD5:
67b6f4233dc579ffef6bc086827dfa8e
SHA1: f762874237f14cda9f030245e369558d1a463cdb SHA256: 25909341f7f43b703f244109c1b0050ed99cb767cb972edeb4ecc434b07f93a5 SSDeep: 96:SuD2Q/w/9rXn9r3miHQO2SatoQBk9KkLBs1QCz:eJ/h3VmiHMSGGLBs1Q2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 2.78 KB |
MD5:
dd8f9b8c457fbc2da6b24835b905beb8
SHA1: 0bd8d79f455d6539a8920af304544d4f0f570077 SHA256: 9a982e0a564bfe9faf268454b2748331cd69a2b0840bb511805e5e6b006cbc56 SSDeep: 48:jJNqUoIbgQrl3EsvX0PuxijPajSnyfYau9rpvi9d2+BFLcZrX+J6xDxwcFxCz:1Nqubgyl0svk3Pa+nyl2liXtFwg2DSa2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 10.60 KB |
MD5:
8b0c2f2d6ffc4189d35a52265baaa018
SHA1: ce6c571693ffcae3b95e0f57d2e1a0ba02f83fc4 SHA256: d0cdd35eece2a312f11014f8dce776e241a3ceda27634a8ccc4ba2535591fc59 SSDeep: 192:pawoXp0wQNzeS09ZeYo66J8DFB9iNtB+kbYGKVk2lcF09j2:poXqIS+em6yfINtB+ks7V96Sj2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 15.19 KB |
MD5:
0ec468839e2862a7650488c63cc2d39a
SHA1: 8afe88b81dd99b8e3449cf48584c098a87d166fe SHA256: 6892ba197c3bc7c7b7c314fb828d92f65ee0dbef9681252bc331f18e9bb0bf02 SSDeep: 192:vmZAUHuVQ6o4DXiV7KXM3+0QsFAiiCjDaFuCz6iAyXfV4VTuPwbMe6t+U1aQ1wC5:KAUHuPjqAZxFpz6iAydoy0vX0d522 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id[B4197730-1016].[randal_inman@aol.com].help | 2.71 MB |
MD5:
73197fc3329f7e29a4f19fb8ec2fb16f
SHA1: b0b4c486eba274684639b8e066387c236ab90f8f SHA256: a3e97182cbddd901a9aa3119a15dda0475417eea371574056d194c21acbb6002 SSDeep: 49152:nOAFjtiia/fx58NoSa+IX4RFWDoRSygdY6:5i158Noh4RRRSygdY6 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id[B4197730-1016].[randal_inman@aol.com].help | 2.43 MB |
MD5:
df30583947294d3a3348a3e0c47b0d10
SHA1: 6052b7ba7e309512c85bf65fdc7d23afbd765905 SHA256: 82206e2e8f62b307e6334f6c7e2ab55ffa31a7cbee34fa57857c35d0e021b7f4 SSDeep: 24576:d+iCZUPGCkqQ9gkHzxBTEWxek5jqJS5AXoy1BOXR+OzxOyULhVbzIRMe0Qa7Lp:aU0NzxBTEWxeK+WqoyyR+OztULARY7Lp |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 5.44 KB |
MD5:
0159f1baee43916b19ddd8b4b00a5f60
SHA1: 5029f034db999b2615004acfc90312de785980a6 SHA256: 34cd6c1dfbb6830f327449d0112dcc80d20fedfff6ea5446279aa17b9ba5adb3 SSDeep: 96:MUPo/k7DCYAdHbxky+fFD7siirp+upprYGJSQbc57q29LjbZCz:PPo8DAbx+p1ep+upZYG587Z9LjbZ2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 5.08 KB |
MD5:
2a0d1297661f33c3d90a1598378c86d1
SHA1: cb3c2932108efe25a61553220e8025b1b24d8276 SHA256: 0c3928ea584b95f9bab4a4ae3a3e2dd5498ec49713ccc8f324181027512cabd6 SSDeep: 96:+kIIPDQMycWBWConbb0bi9ETQZk62mT3+jreaFvoWJLF3SUNmGCPaHipRahwCz:IOWBonbbu9E6ATuZCkStG/hw2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 5.38 KB |
MD5:
4f2cc90d728e8e14f19112ff53c86a72
SHA1: 51b5b752f464b713d295e8fd6d63da523bd43348 SHA256: a298d58f908b9f63709db5c1ce2c8b0c5d5152bb2fb5a218b2c42dbbc8484289 SSDeep: 96:IhzZqqo2xhqX2asr3YgZ0u2FV92F5JPRWOixXznFfT82hE6K7g63NZ4gSzvGbCz:I9Zqqo2SX2Xr3YKSV92nyOi7o2hHqKvt |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 5.16 KB |
MD5:
d58f0d63bc186076768a7800ad36a71f
SHA1: 7c25ed8b9b2c873d36e85a121b1a08d733f5d6bd SHA256: 01e8fc6a5a411947d80bb6b09fbc9955a1cd5f0076d72f5b5b3ab6f5bd59354a SSDeep: 96:EmFNYBDXno2N1MmIZ4Xt1urYzou7gsPpk0lig+MPEtsYbYfeCz:LoBDoC1M54Xt19zouUsxk0shNSYUW2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 1.36 KB |
MD5:
ba236a2c5e886b2038ba23dc548fa20d
SHA1: 50125f3602edf51955eaffa97bf6d8e1e9cea849 SHA256: a43ba17fb6d378dc8452dd3705f938abaa97b82132714b98027dd56763035a54 SSDeep: 24:jzn8YkIghLoS1QnkQgTRN7vvOzYUlJbSkDShq+PI00J+8gtggMcTaxSCJJz:38Yk/hLLhTD7/aSvPs1gtgr4Cz |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 7.64 KB |
MD5:
ca513e04cedee6a34ba5431dc8bab54f
SHA1: 2b41618761c16890b99ceb13a5b17700055cd291 SHA256: bd4e6f5b75c768e447a4a5af07fb6540095b646f5d94da81c080acede40da8c4 SSDeep: 192:Ya68BWFGZgn6YNEBR7KWhH9g/x9ur0+xoSybq2:YjtZnSC0H9Wx9u4hXq2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 13.19 KB |
MD5:
95709884126bd10254de6749b7d484a8
SHA1: 464fdb149b7428a605ec45f32d5e536491deac55 SHA256: 1b902581de0da98436f2dda15135c72817c64b51e6529b96cc28078d9c6ef2d2 SSDeep: 384:hPEFbSYCWkc5QU9AhasEzUzFgayd0XgK3jEWxha02:NEFRkcWgAQrAFgaydWraX |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 7.06 KB |
MD5:
61ec6d9caa874386cff95b021670043c
SHA1: 0f56eb5e78c46b4bd4c3c59d71a883923269d362 SHA256: f9ecbc65a5b0fae69cd66a776e224ac26bf30d906c85efd2be70ea6ab101bc07 SSDeep: 192:KQjyeRo+41BovchgjvEY0RXHDF2dM0PYbgWHITn2:/jyeOt1BopzRYHQd5n2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 8.63 KB |
MD5:
692963affc73280213df8015f789eee8
SHA1: a4a7edcfa08e0e791af5d4e0f3f2c909c352758b SHA256: 60ecc76604f75b2351331e43aefce13e17cbc235c18a84a27715a16446981da1 SSDeep: 192:QgL/aNwZtZ7A3l0X2WxAgeBmWVNPzvW70J6PgLYplI6UE2:QgLAwZn03sAgxkz+RPgLY/IbE2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 5.49 KB |
MD5:
b0da75561b5886651d6df4315d82a608
SHA1: 10f8403f5d00445fc1c3e5ac08954efa9b34505b SHA256: 3a14e949c7a65d1ff3e5b3285a81c19ac66135b9ff27dc3ca6d9e7420a3c25ee SSDeep: 96:ZArPZ9KP9w2b6SscF065jOg9SkHjHLfzXdIEJ1AkmOolmWxhG9qEomI0cCz:mf+9w2b6CritkHjHtpJ1v+lmWxOM2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 5.02 KB |
MD5:
028c155ebce96ba84d6676a6cf91f732
SHA1: a13e2522b32a02e2f9d12cb0aebea7856305a4ba SHA256: 5e15df7d0f06ad09831aa8237068c31cbce2a47aebf7cf70f729d36e813d2c72 SSDeep: 96:XahoYfGogT39cv4ZYQ0cBXXchy/3lztSOCv7B6Yw7UjPqB1037cMB3g0ICz:KPGxMPQFNXch8zUB5w7UjPqBhp2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 9.28 KB |
MD5:
a49f15702ed3e8ab654eb91a54a46b5d
SHA1: ae48a938288db117ecba34e342df032aca20d5b8 SHA256: 2ef993dd3fce58720aa7bcedec7c610712ad041e374a06f707daed092594903c SSDeep: 192:acf1ZCka4EH4a0YVUigiR6r9QyoCFs2N3+/a0l9YJYuaU0mtFPKqhc2:lZCkM4pYLRQ3sS+/aSmYuOm/Kqhc2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 4.53 KB |
MD5:
2e40123cf0f1af26bdabb3f058f162af
SHA1: 49535a36263cbaa1c9f68b78ee6000fd5cd26d49 SHA256: 0551c0bbb4850d9de9c7c26df693b9393b0045da92b2a2640cdf8dcfd36be971 SSDeep: 96:cZLkcTVjZJkOSgQuvS83qqPv3jLJYIBgP6tPNG5nmXoKvZCEjCz:yLkcRkOSg3vB3qqPv/ZuP6tU5woQX2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 5.14 KB |
MD5:
370c954a87306e175d30df251c5610b6
SHA1: e80df5c17e0a4016956ba57ff590e6a28ff598de SHA256: c728447428fd3b0b69193a17c894c48ba7fbb739b3b887c2bfb837feee18965f SSDeep: 96:sTrCu8QTR/NrD9wUZg8dFknHA048noMQegj38Bx5PaesLpgp/rCz:iWuPRF9wcgQF6B48n2ex5i7Oj2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 4.11 KB |
MD5:
1e2227a4af9072537a1688d9e0b7ef29
SHA1: 5892aae5b0782ae4e8180d9a34d4398d807b1dff SHA256: 2d0f2b958fae724c30f07758871d0e1f571981227edf56722dbaddcf131dd093 SSDeep: 96:UJyA0+JKM7ceU74EJSQBGV36zG5fLORI5boVCz:UJNJv7n3xQBen2IO2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 3.30 KB |
MD5:
c93514f4184aff7ac54f1066fc789eb9
SHA1: 6eae3d9fd1299e5b5c1d27e48b99cd813f4d8f60 SHA256: 7477e4215d9acaa9de5fa73688cb73b6fe4c41d307ea640399cd267336895352 SSDeep: 48:I9GZbc6toir1j15VBbnG0myYk4SV6uAXd46+vCTpml8ZrtOw0uFZSunQVdyCz:I9ctoiJ7VwDkf6uIZWetOwZLXQV0Cz |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | 3.55 KB |
MD5:
f2a7be4493f469225d11de2280be74a8
SHA1: 07a0008936161ab73bd92e3ce97bc3f0a89f0344 SHA256: 6e845d7205563fd338ea5966c800795dbe8267f81d661e4906e81cdc544ce1e9 SSDeep: 96:tqBduCowm/tnh9MqcReR1pKkfUrpXxxUfFusCz:tqbkZ/tD6ReRes8xxUss2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 4.86 KB |
MD5:
c94b12b5d7023f73c85975057847369e
SHA1: 8fa724dfe334892c1d027fd9189ac75736e23d2a SHA256: f65d83d77a136f0262b02a883104c096afca9d60e45d638ccd94f86a883e817a SSDeep: 96:KxxxWyD2beApHLa/nQuMIpJ7ZtMCIRsba2nGRkBffo5k/n3Fm6wCz:KfMyDgekaf3bLVtMCI0JGRqY+9Pw2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 3.21 KB |
MD5:
8191cb4464c3e4508916e4d0c20b30d5
SHA1: a53e0b14eb29f2e4f5a1558117a6af37ec8b6502 SHA256: 617e9ec7142cab60fb22b790229cd6fdf6981ff1a206e87c645688eb5593e767 SSDeep: 96:vFLTlMk6CQ9UNWRTylV3fyzbLmkF6H0qZCz:vFLTekFs2ZqzHtFgRZ2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 5.80 KB |
MD5:
c9be720eb19021770507d6d2675c1d56
SHA1: 924f44faab8b491287554c54fd11d17f24241ac2 SHA256: 7c31889c1fe6aee00ef8cd15c4bb2b3e32e15f237cb22bba3dcbc183ef6633b7 SSDeep: 96:TGAywB5zt46B6WkRWfWpuKDKdNU+Bpx3OCCL9GzsG+8k43agFpO811DgL/F5LeS8:TGRcae6Wk8O1DKdxHC9FG+8kmaIpOGCs |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id[B4197730-1016].[randal_inman@aol.com].help | 257.97 KB |
MD5:
b32f0ea483f83c92e3584e716e345561
SHA1: a4de271d083014e3755229af00d8b35210ae1fc2 SHA256: 7b8ae85e9414714bbfaa503a9a15333fede3c134ec645882a9cde8ef213cca56 SSDeep: 6144:JDPxbQmdxMwtMzteVW4/HD5TWBMzxylhRlBDP4cK6:5pbQsueVDdbUlfnDXK6 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 10.83 KB |
MD5:
6f4d1d818507ee0f4c390acd666a51a7
SHA1: 4030396a609706090f0306a22a3a86a768c6c1d6 SHA256: 51775b5a5d37fee94758d115a9f6aac1585ab7a76bd1cdec3e0f6bcc21c18be1 SSDeep: 192:bxVChkrqS5ShfAtCgVDw7YuVAA24Mfk495Ps8x1x7+J8hPDy8jsIn+2h+QrxGrw2:b1GcYgVs7YgNurdH6MJjfntdxB2 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id[B4197730-1016].[randal_inman@aol.com].help | 500.47 KB |
MD5:
8808d1618549591596c96d0d22f1d23b
SHA1: 2309af9b8328b0306b84bc148b8ceeb4e035ea51 SHA256: b242c2435ba4fac02421e640612c6be4d3e26f21c7ca9ad94c95f85769c1403b SSDeep: 12288:3Lvkr+jJwDhXs89otUQCTJPVy12123vP4j8F8d5T++r:7aGw5s89otUQYJY1A23vP4QFU0+r |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 14.33 KB |
MD5:
401bab5ce1eafc1756ceec84c7ebd7ff
SHA1: c5413790c3bbdf64268578f190463bf6935143f6 SHA256: 545a3391a573938c0a4aeb80819775d68bcd7616b3873c50c78a5ff63ec758ef SSDeep: 192:/pTV4359DgF14qBLLLBA3XvntOerRnllKxAfYJWOwlTf4lu6Pj7oDa2:xT+35OHBLLLr2HK0Yepf4lxYDa2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 7.16 KB |
MD5:
30b804e6e6c78df3c132c2c3fc85dd7f
SHA1: 071296b94226bcfd473c2db081a6c8ad14920072 SHA256: 377fe16b04a7318451535f81419e1e029aeb61100e4f43b64a4ed6018324778d SSDeep: 192:No41Sjmi/iNoAu4yG86EtCdLBu67OPKGg2:NoCwmi/iNe4ydUdk22 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 3.52 KB |
MD5:
adae2b72c2b03cb032ccb5915e510c87
SHA1: c403930efe9e138f1b88a6afcbae7b6eb1a56cc9 SHA256: 558a7920ec9dc738569a5497185aaed85406cf286d471f61f75e34dac7dc72fa SSDeep: 96:jLtXHSuuqVD3BgcXljikgOicdjqmNDFd1UzCz:1SXqJHFiHIjquH+z2 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id[B4197730-1016].[randal_inman@aol.com].help | 881.42 KB |
MD5:
a01b5aebba0f008456017e69b71076b4
SHA1: 8fbfae4b2e4582fd84d0a9686a030f7a5e46c3af SHA256: 68e439a8ddea235010f6295d343da88589a671e1b61ccae8ea322816d3980164 SSDeep: 24576:xwx1Zk/RT3h173uPk2uKqwEaGXGCsl5Vsn6PVzA0iHGndocE:4URTCk2pWpGCy5KOp743 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[B4197730-1016].[randal_inman@aol.com].help | 801.44 KB |
MD5:
b436d9fe331f1a84b73b7cb2cfdf33a5
SHA1: c0bed78fbe7c5a014aaa06e383634c8a40f42a88 SHA256: b01022f356689b68d80f317aec00e97a6ec7592efbeabdbf719ce5821ce5802e SSDeep: 24576:Bq+nTu15BIYtv1tS3Z/RvHXxNU0cP5ml4lYloS1h:vnT4DBC3ZtUpRml4l6h |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 20.35 KB |
MD5:
a8a28afd87891d2ff7f9c33541df39d7
SHA1: 41e0a96b438298448a431c30ddc10b4e346958df SHA256: cb6283e3f083eae175515ad99240baf1d8f3818ba950477ca3aab4b63385729f SSDeep: 384:kWu9lcehVPzdjUl41z/mjvjn0dJ2+K3tB1Kt+0wF9GCkcvdChE0+MqAtNm2:kWuQwrdjJAjnD+K9B1KgTkcvh0o6N5 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 1.80 KB |
MD5:
3b9e315d410e0210114ce95ee59cddfa
SHA1: 0ffc477397f635d410d9c350f6650f0427638c19 SHA256: 7f2c7f5f0cf3b038e5118cf76965b5cf868790855fd09dfa09d9dce6ad81bc23 SSDeep: 48:Mbdz6GZ+rdARBunnhhVcZDqdWW/M/JvE9EiD7yUCz:Ed+vdARchWcTPD77Cz |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 8.03 KB |
MD5:
2e0bfe7b456db53c576d06141a6d7673
SHA1: 0a9d7b63e7010d09830c82ca5d929fb724977c84 SHA256: 685314ae09646dc95d53eceda3e4b2d74598ac3830f0feb6183aa67988d032e9 SSDeep: 192:fXDI2bllekkyNj60pqPG8ALhEQcSUFsjOfybXSarh2:vpl0kjHpL8xSUCif4iwh2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 2.03 KB |
MD5:
dbb93022f7ad2ddfa1e7b934da383d2d
SHA1: 8bac2aaa33d1633c4dacf52a2f20272668a71d91 SHA256: 6eb8b472aba16d5ba81a5acd7eef384fb597bda6deff49ce3f2ea87cd7bc2c19 SSDeep: 48:kt+VEqN45oJcNafu7JM+0ajgqSEuZqbiniD63hOtX+2YCz:kIVENoJlGlqajgYucmYZYCz |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 25.96 KB |
MD5:
adee402a9b60e2e47002f1d834fdb9f3
SHA1: 2e3f0cd21820b4d314b17f3051b98d6529a42e43 SHA256: a8d9af32ddf9d1f21a53618f1b5c5a0d644076d032069d0a579985aa72207bb9 SSDeep: 768:h1WyffqUZM/y2aiRzz0p4L825NrYXVVSP:h1WSJM/y7iRz04L8zVoP |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 27.46 KB |
MD5:
5f48faf631793738597ea4bc62056363
SHA1: 7959b2993e716e48bf04e94fa0e02747fd571e7d SHA256: 0061a03c81f40513e12b87607f84b5bb301d9c66a7e6061d9503f43c8490e317 SSDeep: 768:lEJZWWeUu8Gvwx8hi6bzK8XUO49jBblXm0RAUU:lueUu8yy8jz0hlXrRa |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 5.94 KB |
MD5:
d98dcb3a4221b89f807121ff1c46e0c8
SHA1: b8833e2cda20c99579b54ca3924f1f49cc7b73c4 SHA256: ac669006ab14dea5e3465478d5262db99f657460cb242cf2d0af0672e7b192a5 SSDeep: 96:A9KzbtO355/0Y6gzROJPpT4HdBiArL9WceRXkWjAswY9jt5ufbNRIHK8xR4QZUFW:A9sbtE9DzRO34H/iAP9be5kWjJFtgBaJ |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id[B4197730-1016].[randal_inman@aol.com].help | 354 bytes |
MD5:
ab8e4c71150bf508422810a028cca4cb
SHA1: 2cbcbaf4c1a5627a71c81c31794065050d5634fa SHA256: cac25c4f14e6ac7cd19a4a51de09aa173fb4858184f51b0d07172d016c215f42 SSDeep: 6:jplwNZwYXzIi+aCXSPuYibkoD0w+23Np1BFPneV7reXWs0YKoHTlHMBMIyT+AsM:jrqw4zILhY8Dd371vg7reXQYJlsBMc8 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 3.19 KB |
MD5:
f5fbb5909396e2eabd38e116951f4331
SHA1: 71240bf66aadc2c2def59f2c4edb396731af73dd SHA256: 1a56a36b95881061ce844edd7a0225913c15b3a542c09d6ddfcf6bbfe243dcb9 SSDeep: 96:kr0hIJbKUIkEjXZIr3UUISOHOlidiMSBCz:NhIJ+t+r3UFSOHOlidiMSB2 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id[B4197730-1016].[randal_inman@aol.com].help | 325.41 KB |
MD5:
f85e3674cf0364dc77ad7de6c92685a2
SHA1: ecab80ba2f961cf14c288f5e44c917de06c75fec SHA256: 591dc74c3fd6df5c90fd2f97e0af2280e11318493e8dfa54b3e1c38eaa2f82b7 SSDeep: 6144:9elPotn8A1gGzCNovggP7g7zrc2RFr2KcncS47iGKIB1RTqgg:9PtJ1DCu07ETV47iHIB1RGV |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 2.94 KB |
MD5:
d5d852a1e98f5991a14ddca6a16e44b3
SHA1: 415e3047840a00d45dcb997d7697bd9a4b2500f1 SHA256: deb4b71e62c19e2a055219a0e0897f1ef3f813fa65bf0dddfcefd78c6885e062 SSDeep: 48:jVHxQDbh76ukxnRICnvjkw4uE5ATpv9q8AHWJv7OicW8MxkoeNvL/Cz:jRxg0n2CnoNLApv9nMnW+oeNvL/Cz |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 7.44 KB |
MD5:
d314b06b0b560e1d238511889b32812a
SHA1: 5147ccb81f7cb7f9d79af7e11a3106a2df4cb345 SHA256: 364bed9fb05fe215a8f89277a5bd91a7f738e7da2ecdd50c71af811078c32a9f SSDeep: 192:ndmXJKZlMafrI2Hm4G5c6335fTCzNMoIXwuthnSyLCf2:coXMT2G4icuf2zCXwuSG02 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 3.91 KB |
MD5:
2b5f259103bb7bf02479c03e39abb078
SHA1: cf450fc68ee7726f1eeae72d8b40e080fbbbfd9f SHA256: 884bce9d87f69122036ef87fbc4f6855245d0b83197f383f2fea459cc3b6da01 SSDeep: 96:R9u46verhwSuIRtMBXmbZxPF5qVa3L6I1Cz:7ieNPuIrQmrPLca3j2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 6.72 KB |
MD5:
1bbc2f76aa87bda44c85013e529ce87c
SHA1: 59fe7823dea982455aa540bb525b2031f24783ca SHA256: 927b8fc7ae0e22b4751941222113f78ccd595f40c3071f896fe790fa70fff177 SSDeep: 192:LwA1eGMtVWPwH7G1hyHHBBbbUmJL6DBVXlsFqBUMu2:LwA1eGMtOA7GPSXbX6XiqK2 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id[B4197730-1016].[randal_inman@aol.com].help | 354 bytes |
MD5:
b288df4e294e5e07c01d449242af1150
SHA1: a9a7f9da7a46173e8dd8433eba5d1a6217c7fe6e SHA256: dac40be8b280423d009433f0a849106549580387780ab899b6c05edf1e6eec93 SSDeep: 6:biN2lsnicU8sd8sMtmZWBK722+reXWs0YKoHTlHMBMIyT+AsM:buxny8sSsymkm+reXQYJlsBMc8 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 2.30 KB |
MD5:
28eb9762119acd716296c46f749d356a
SHA1: 30f9c3e62f81fe350022044897e8e87d6d71402c SHA256: ac3d5ac7c13879d1a2977eeacab66c544069050fcdc55fddab02ab503b6b7044 SSDeep: 48:sUZzxvfohnwlQJssMeDOL815odrs2f4Cz:sUbfle50C5o22f4Cz |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id[B4197730-1016].[randal_inman@aol.com].help | 350.46 KB |
MD5:
b49d30be3fd1837a3af17020c091a8d1
SHA1: aa039eaf489a8edd54957648c8a1949324eda7d1 SHA256: b02fc21774f4c7d847d53a257e597b9880b267045a925ffd5f19659ddfb7a394 SSDeep: 6144:qDEd4D5aqQpSnpFjZBTOUirb5LW8g7MwU63QRbSRHf2cU5zo/mHAuwsreJBD0N6g:qodm5bqWpFD+rb5bg7w6ARbSC4m+keBw |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id[B4197730-1016].[randal_inman@aol.com].help | 1.04 MB |
MD5:
830e527bd1c41d94604d6f2072ec14f4
SHA1: 110bb7c5007af176db6c049224bb39dea0aad955 SHA256: 72b69809e6c3682d7afbcb302b4ada9d8bfc9b93443eb5af2d27715326fe96fd SSDeep: 24576:W/GQa+pQfDaRYBDvqg4/lJxMnnnel9KnSILAvEUSoecJ:W/GQfpR6viHMnelKLAvEUSoe4 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 7.61 KB |
MD5:
6919d6995086814326874c7a31608ab4
SHA1: 9b08175ed317a7721485b8e5a5f11a49ffde4015 SHA256: fe3853dc196d37fce2aea493bcb1596dbb3f677ae6a717b55ed8a076da174baa SSDeep: 192:0CGMjqxDB45mIffiiu/PB7BO3FD40dX/93eosm2:0gUIB6WXXVuk2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 9.27 KB |
MD5:
ecf370d22fb847b2ff1aaa29661a298d
SHA1: e393a8fbbf463498cd60ae43c21b832b19ec70fc SHA256: 6b880b05e0c22c6f11dc95a9b0f45925da5b9341258ed8d65d0234c1de11f56f SSDeep: 192:l467x7qKKrDTobDuOv0DMh/xiqnm9fQkP/V5Y9pknVkIk4g2z47LG2:SsxGrfon2UpHnmOklSIDdZ2y2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 2.53 KB |
MD5:
076970e38963708cc84da43c8d13fa02
SHA1: 71fb1827f63b01e37aaff858340d62e297d54fc2 SHA256: 0f63e89994cffe8334e559ec8cbb5b449be42e99545386879652491bfff4d286 SSDeep: 48:1yNuwDM8t92DGvbBo6crSrSCQ8AdiNdpxOjedhYD6BysmwRxVDXPCz:4NhI892uBo3r0QbaMdD8mwRLCz |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 3.58 KB |
MD5:
59ccbf3734c7d3a216f916f52a7da49d
SHA1: ff1aba57a2ec1c37f8b3c48cd8b0c0212774314f SHA256: 3f928b85527603d2a7f99f886042925fe2ed569af0643465157785688e548aa5 SSDeep: 48:XlMhhYlYwARqhbMbVFReP3CwCsiBwda2bX44wRqc0HmSFEb08Ti5i7+jexrzMzCL:XWc1K3evqPBi2KHPEP7+jefD71Wj/Cz |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 6.16 KB |
MD5:
d45e716d8e62d0df1c7ce04497cf9b05
SHA1: b3a19cbc3264f7b83892a684d4ff9424a3a6463a SHA256: d20de44dfeaaaab60288c8366e3b9c3b8e1dc9863b6e68958174b3f20f2244d5 SSDeep: 192:rkdUctZjot3Hd0kSVPTPsBhXWgVp78Vz2:EUct6tXpSlTghWgnYVz2 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll.id[B4197730-1016].[randal_inman@aol.com].help | 59.86 KB |
MD5:
8ed9956a884b8bff39cc81c8e187c816
SHA1: 68fd327543e39d06452ba3d7987c6b94cf568946 SHA256: 43136bae572e34d200924ec31c4270b1dd55d16328bcc2d83504afef66f1a76e SSDeep: 1536:/m9Mz8+3Ff5UxSyJRDdVIXUC2zI2KSWbr/66Z2x:xz8+npyJR/TNIGmxwx |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 6.72 KB |
MD5:
92e718bcfa83220eb0ed3194bcb18d92
SHA1: 8e54edf6a0fde111683541ed6bfd6a2635e2e5d7 SHA256: fb4ef59f02d617ea6cf1e5c36d9b9cd235c11723c538178d3543cb1bbb2d6f8a SSDeep: 192:OXU0+I3TZ59gFbt72ajetmjFjoA6dQhOUJzAi82:OJ+I3TZ5mFb9LjeojsdQLJki82 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 2.81 KB |
MD5:
2314a88119f8ad66e44a9814ff76b68d
SHA1: bde9c3cca40c375aa7c7280cc04d252a5ce104a5 SHA256: 35d2a7f4951a4bf0d2708363d7ac5219c3e9e3c4d8af1044a12161872bc35502 SSDeep: 48:fRYR46Y0gVOEEc1GmfH6l9oaxPz5vI4IY/BUB1NMA/JwSfTcqLlYfUpXMHTjWePE:fRNPxTQVPzRPI+Bsn/JwSQqKfUpXMHTs |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 4.75 KB |
MD5:
21636aa99883d482359238ee1783c436
SHA1: d8bdeaa5e76073545d97c24f50e77c74e95e5ffa SHA256: 5024609b603eb00959d7ffb7063f2927df9f67eb479751801d73d01dc7ab9942 SSDeep: 96:AP0I+t6RxFscDGW5IKIdr5+ZcSmBxFKT41vrwvELjnC/v2aqLWyaCz:PtkRxFscDGfKIdrS3wB1vrwvELG/uFLr |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 3.31 KB |
MD5:
0aac07fa3a55b8c4f0cbd08225c8850d
SHA1: 8d2a399c3e5100f741ae5836f2673021859e0cac SHA256: 5642c6cc9e41842aeb9e135b6a7c0aa6e15f5677ce8daa5daabe6b1ff0f5e600 SSDeep: 96:ubF19fNsBGJKGT+ke87F16NbGCY6tG7wx5O+wN51QmBaQCz:qZfNs16zfHCY60O4+wamBaQ2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 7.74 KB |
MD5:
c23538c7e9958d3e77cf7a4b4e5332f6
SHA1: 7140b7817043ee157598ea414158405173064370 SHA256: 820bd5a2274964927fe9435f630e78206d9e057ecdd2e60e801cb0589eda979b SSDeep: 192:Gwt3czY7VXdgABCtqob577OfWfnATqJM2:d32Y7fgwCtqE57Cu/zJM2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 8.53 KB |
MD5:
2ae76f0cc30df8fc596013ad68be79f7
SHA1: 8c0aa5d06a646c374051b7526dd7777e14d7e939 SHA256: 14bcafa8ee183d7a7881bc0e7a3f27ed4424a227c51b46ce38842beac5f9b799 SSDeep: 192:GWsvqwRKwLYlj056xT6TNDCyfc3zqsdJAYZ5yp3H2:Gbq4KhlkTNhf2dJ9PSH2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 7.86 KB |
MD5:
479fac923c10a787e5c4dc72ae19dd92
SHA1: 689d1f8111dea687f1e3b7a8bb8d2ce8bceedad4 SHA256: f2ba33d06f4c2f50bdf826740b2f5e0598eee68e561cce186252866c156a91e4 SSDeep: 192:TAHyo2YM8v3W6Mde8z2Mcxon2ibpv2XGL5HmJa7zCN2:I5M8pMdKanJxEGLZmJaE2 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id[B4197730-1016].[randal_inman@aol.com].help | 973.47 KB |
MD5:
e21f4000645d5b9780ff24eaaaab685c
SHA1: b34b94b13db5eceea17484351d0f8d8144bc2747 SHA256: f9f410f55714129627ef108a85283493e34e44ca1fa8df5bdbba131289cc3cc4 SSDeep: 24576:A3V4AuwIoyiXRZaE8ZGbH90c+Vsae+UoWFLiXnPp:+dzyiXPH9F+6aKoWFLiXPp |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 7.86 KB |
MD5:
70c8e807b7180c3067509e7ec0f5ea8b
SHA1: db427fb0e95f9ac62a0f54b5234ff0fece503dd7 SHA256: 6fb1a83e86c4efe09b6322ba12d4a32775d090e923b1a25d6484bc93b55549cf SSDeep: 192:SFOKhNv8ML0GzR5QA10Ijm5Jf8KUtSK2c52:XoNAG951565Jf8FEKp52 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 2.22 KB |
MD5:
8c8ee085b0aa97bbf17bc62ae43428cd
SHA1: 8357e9983ee4f5ee267a58480d3f48fb0b257c75 SHA256: 48cdd1411e3f1eec29762953f91b7881e5d119f8356b4768868c2e8c4134a41f SSDeep: 48:oHuUZp0syQ9nPAkm+K+6MMZRYVefnzM5A4Nz7yCz:BUZ159PAOK+C7YVE1Cz |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.id[B4197730-1016].[randal_inman@aol.com].help | 959.94 KB |
MD5:
e1e3859f1a0331660df78c8a8234eb97
SHA1: c48dcf39f0fd743faa28638e33326e058d16b206 SHA256: 98bf4cc6ed7d9dbf5dcd86fd1ec02f31ee6adaa48f9132ab4c674a5170cbf6a8 SSDeep: 24576:kWhHNe0oKxwxgY3sAyK29aS7nyb7FIhWafS/4ER:tHNeO8cmbW8aqgER |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 2.67 KB |
MD5:
3fb8555adb9c7005b31c6332d6f6bcd0
SHA1: f1fddc3c60e9eddc312a305c189210d2e104d900 SHA256: ed52c952d3e939d7945cd6f065bc082253c4d3d829941f856f75005d319d5cfe SSDeep: 48:99CioloR13/5yqrkg5CDhChZiDOQ8dhwz2+KAe9qlYMS+sOW6x6Ho/jf9Y9WFCz:9soD3Hrkg5S9DOQkmz2+de9qlYjOVriD |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 3.52 KB |
MD5:
1fd59ff5ed90293bfb94bd24608e4db3
SHA1: 398bda311f5712e5862b24421609ee11e0774076 SHA256: 1019a671999d76743b5c109a2ccce0a6ddf642619511a7fe31c72e1a118a10ae SSDeep: 96:z5zVwqH94iYpgZjjP8HyzL6MCU/38/wTvOkadBXERcQd/pCz:jwuiiNZvwm3CvYykadBUCQd/p2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 4.44 KB |
MD5:
5a29d646316712a6c3cd7dd4368e6cf8
SHA1: 0960353dc58884c51f150bfa16a0dfae2b5aed47 SHA256: 4298e98f41b2072bc00dd7ee3fcf360edda5f6fd6664aa342864052f26205ac8 SSDeep: 96:nG4I2YVl2Ng53e6qIggXxYUjS77w9vC9Jv6iW24xF55Cz:qB2sMIgtsS77wJC9nWZH2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 4.94 KB |
MD5:
3308f1263c85ff9d402d48014a885076
SHA1: 363581895cff37d5977d18ec6457696cb5369d9f SHA256: 7e9cbe6f10a6ffcc6f74789533d8d6796519568aca7218e80ebd58f849690c49 SSDeep: 96:PND3vGW759pRHHJYibX2jgd3bJcM/OVq7dT8F+UPmOo2uAi86omSymr8qCz:PF3uW7PvDggdLDOV0hCPmOv5FTmSyc8l |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 3.39 KB |
MD5:
e8787620ef4018730af090f562ffeabd
SHA1: a9c89f3ace8ffec0cfcb10d358536c51cb65835c SHA256: 864f66f04e2457f227986271467d1182b374ae305b5de6ce2e8c17d46f1d37d2 SSDeep: 96:LWPzXgvI+Ov7fKHiejFcTpfWeFliy0HEzSx2gQr4a+Cz:L0wvIddiFleFceWxCr4F2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 5.13 KB |
MD5:
9795d968d8ee50bf2ad23216b3bb819d
SHA1: 83fc947a40da6a6d4b45d8c2a68f14352838c621 SHA256: 30464d6859d205a66dc69c3ff20294c7fc27f8b23bdbdcbd63134f20537ef75c SSDeep: 96:LKmxtjg2PXO+XzKjJ6G0H2xmHkjdLSr32IGuKzVCK8PcvrDzCCz:LKmxtjdXO+Wx0WxmEB2EFz18Y+2 |
|
|
| \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id[B4197730-1016].[randal_inman@aol.com].help | 381.42 KB |
MD5:
c3fa9b93f6f6d6ad176949b1aa3ddad7
SHA1: 0229d7794e15513b7b8a837fc7a0c8c723795bd5 SHA256: 6dc4d4b800c777c7e5b254b79e20f896236374dd7a304d566db113617cef8a33 SSDeep: 6144:WvtE8jOQMevXgVvJdWY0USDBDoxBKqVQ8C8ZRVN90ACFE8qtqT+99W2+pEp82nLw:wB69Jd4U2BDclQ8C8ZRVN9+VUqT+99WN |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 5.13 KB |
MD5:
a47757051c83bed00728a1ce39a02973
SHA1: 81439258648bee535d30a858ac674630dc96ef0e SHA256: 0684332da8cc88a3c910a72fdbb81b24825159dcc134eb41e1e6a2665f95aabb SSDeep: 96:Wp1omK6G6A65jggMVP3uyBDtWtszBsXWah5mCTLsbb0EsFd03Cz:WTW16A65jW3LBWeBTaOCc8h032 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 5.00 KB |
MD5:
c1b1bcc7398372e47a426e4fe8e6c6af
SHA1: fd43b311dc0cc880da4abc983647275fb1942cb4 SHA256: 2617e584a2b2666964e2347043ceec95df801167adbdb03ccf44650710c63506 SSDeep: 96:XyHvBys0rMZm2DwketJnr9DRU1KBBJODkvsflzCz:iPByYLFetJpDRU1K7gkvsl2 |
|
|
| \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | 28.52 KB |
MD5:
bb4ed7ce48ae8fa544586271fe154fbd
SHA1: 499aec2a86fcfa2a1fe6ed83721531c58aacff22 SHA256: 43a809e99df52323aec8d0fcfe2ce20e77c26c9dd7b5dca1da8882734b21ce9a SSDeep: 768:akfg8LGooO97gC9nh6C1/zIko3uNo5qJuVaG4pmhl:b1ye97Tnh6+zIjkpGTl |
|
|
Host Behavior
File (3360)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | \\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\$WINRE_BACKUP_PARTITION.MARKER | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG1 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\BCD.LOG2 | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bg-BG\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bg-BG\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\bootspaces.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bootspaces.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\bootvhd.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\bootvhd.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\cs-CZ\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\da-DK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\da-DK\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\da-DK\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\de-DE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\de-DE\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\de-DE\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\el-GR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\el-GR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\el-GR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-GB\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-GB\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-US\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\en-US\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-ES\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-ES\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-ES\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\es-MX\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\es-MX\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\et-EE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\et-EE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fi-FI\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\chs_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\cht_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\jpn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\kor_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgunn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgunn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgun_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\malgun_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryon_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryon_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryo_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\meiryo_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjhn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjhn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjh_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msjh_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyhn_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyhn_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyh_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\msyh_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segmono_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segmono_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoen_slboot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoen_slboot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoe_slboot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\segoe_slboot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Fonts\wgl4_boot.ttf | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-CA\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-CA\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\fr-FR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hr-HR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hr-HR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\hu-HU\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\it-IT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\it-IT\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\it-IT\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ja-JP\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\updaterevokesipolicy.p7b | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\updaterevokesipolicy.p7b | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Content.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Content.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ko-KR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\lt-LT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\lt-LT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\lv-LV\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\lv-LV\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\memtest.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\memtest.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nb-NO\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\nl-NL\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pl-PL\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-BR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\pt-PT\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\qps-ploc\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Resources\bootres.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Resources\bootres.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\Resources\en-US\bootres.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\Resources\en-US\bootres.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ro-RO\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ro-RO\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\ru-RU\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sk-SK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sk-SK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sl-SI\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sl-SI\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-RS\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-RS\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\sv-SE\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\tr-TR\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\uk-UA\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\uk-UA\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-CN\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-HK\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\bootmgr.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\memtest.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Boot\zh-TW\memtest.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\bootmgr | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\bootmgr | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\hiberfil.sys | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\pagefile.sys | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot\sr-Latn-CS\bootmgr.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\Services\verisign.bmp | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adojavas.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adojavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\ado\adovbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcjavas.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\msadc\adcvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uiwin32client.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uiwin32client.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\IpsMigrationPlugin.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\FlickLearningWizard.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\FlickLearningWizard.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IPSEventLogMsg.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IPSEventLogMsg.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\micaut.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mip.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mip.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mraut.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF | desired_access = GENERIC_WRITE, GENERIC_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF | desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_SHARE_DELETE |
|
1 | |
| Copy | c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\shaofao.exe | source_filename = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\shaofao.exe |
|
1 | |
| Copy | c:\programdata\microsoft\windows\start menu\programs\startup\shaofao.exe | source_filename = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\shaofao.exe |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id[B4197730-1016].[randal_inman@aol.com].help | size = 16000 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 18640 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 18640 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 21200 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 19152 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 306 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 19152 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 18640 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 11632 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 19664 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 22736 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 19152 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 19664 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 20688 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 786722 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 27856 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 19152 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 9840 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 384 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id[B4197730-1016].[randal_inman@aol.com].help | size = 262144 |
|
3 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 9040 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7232 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 14880 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 26832 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 70864 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 23248 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 6688 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 24784 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 19664 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 21200 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 24784 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7696 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 8112 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 528 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 19152 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 290 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 11904 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 12704 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 512 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 396976 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3488 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 12496 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3152 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2608 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 786706 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 262144 |
|
3 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 786722 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 10608 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 15312 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 262144 |
|
3 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 5328 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 4960 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 5264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 5040 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1152 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7584 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 13264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 6992 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 8592 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 5376 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 4896 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 9264 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll | size = 4400 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 5024 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3968 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3136 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3392 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 4736 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3040 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 5696 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 263904 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 10848 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 512224 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 14432 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7088 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3360 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 902336 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 20592 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 820432 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1600 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7984 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1840 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 26336 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 27872 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 5840 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id[B4197730-1016].[randal_inman@aol.com].help | size = 112 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3024 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 332976 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2768 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7376 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3760 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id[B4197730-1016].[randal_inman@aol.com].help | size = 112 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 6640 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2112 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 1093264 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 358624 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7552 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 9248 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2352 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3424 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 6064 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 61040 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 6640 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2640 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 4624 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 786706 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 262144 |
|
3 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 996576 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3152 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7680 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 8496 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7808 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7808 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2032 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 982736 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2496 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3360 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 4304 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 4816 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3232 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 5008 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 390336 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 5008 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 4880 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 28960 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 26896 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 22528 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 16192 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 11648 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 16128 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 17248 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 26752 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui | size = 16688 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 4080 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 24336 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 4928 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 48000 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 24784 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 40208 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 47792 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 14544 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 20560 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id[B4197730-1016].[randal_inman@aol.com].help | size = 363744 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7968 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 20192 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 20464 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.id[B4197730-1016].[randal_inman@aol.com].help | size = 590528 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 1114368 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 13520 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 15744 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 12992 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 9712 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 8784 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 14496 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 18320 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 11072 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 18640 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 274 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 9824 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7872 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 360800 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.id[B4197730-1016].[randal_inman@aol.com].help | size = 244304 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.id[B4197730-1016].[randal_inman@aol.com].help | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1024 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 990048 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 896 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 10160 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 855392 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 12528 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1472 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1712 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1520 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 4000 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 9312 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 4032 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 8080 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 14448 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1552 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 12464 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1744 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 100496 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 20624 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 48880 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 367232 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
2 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 4720 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 168080 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.id[B4197730-1016].[randal_inman@aol.com].help | size = 17056 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.id[B4197730-1016].[randal_inman@aol.com].help | size = 22688 |
|
1 | |
| Write | \\?\C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2560 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 12496 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 5760 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Internet Explorer\SIGNUP\install.ins.id[B4197730-1016].[randal_inman@aol.com].help | size = 464 |
|
1 | |
| Write | \\?\C:\Program Files\Internet Explorer\SIGNUP\install.ins.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 5280 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3024 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\awt.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 1114368 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\bci.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 16976 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2656 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\bci.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dcpr.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 159824 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dcpr.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 4176 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3792 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 816 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\awt.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 402256 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\awt.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\decora_sse.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 86096 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\decora_sse.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 27056 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 13104 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\deploy.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 587856 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\deploy.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 9600 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7008 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 11504 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 27568 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 4416 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 6272 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 19488 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1026128 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npdeployJava1.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 1114368 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3776 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3360 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dt_shmem.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
2 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 29008 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npdeployJava1.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 42320 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npdeployJava1.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1456 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dt_socket.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 24656 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dt_socket.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\dt_shmem.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 29776 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\fontmanager.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 274512 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\fontmanager.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7984 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1344 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\fxplugins.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 186960 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\fxplugins.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1056 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2384 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2176 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\eula.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 136272 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\eula.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1728 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\glib-lite.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 455760 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\glib-lite.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\glass.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 265808 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\glass.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 8368 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 4992 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\gstreamer-lite.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 619600 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\gstreamer-lite.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 12800 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3120 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\hprof.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 158288 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\hprof.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1600 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1216 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\j2pcsc.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 19024 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\j2pcsc.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2064 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 5584 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2496 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1680 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\instrument.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 123472 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\instrument.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jaas_nt.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 21072 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jaas_nt.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3536 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jabswitch.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 34384 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jabswitch.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\j2pkcs11.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 63568 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\j2pkcs11.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\java.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 159824 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\java.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3808 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3904 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\java.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 206928 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\java.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2448 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2736 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\java-rmi.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 15952 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\java-rmi.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7184 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javacpl.cpl.id[B4197730-1016].[randal_inman@aol.com].help | size = 187408 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javacpl.cpl.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\JavaAccessBridge-64.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 142416 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\JavaAccessBridge-64.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javacpl.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 80464 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javacpl.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javafx_font.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 69200 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javafx_font.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 15008 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1888 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3504 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javafx_iio.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 128080 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javafx_iio.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javafx_font_t2k.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 538192 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javafx_font_t2k.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3952 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 10544 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 4240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javaw.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 206928 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javaw.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javaws.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 319568 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\javaws.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2432 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3568 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\java_crw_demo.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 29776 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\java_crw_demo.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jawt.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 14416 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jawt.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2272 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2272 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\JAWTAccessBridge-64.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 15440 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\JAWTAccessBridge-64.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 258 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 5280 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jdwp.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 201808 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jdwp.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 49552 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jfxmedia.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 139856 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jfxmedia.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2976 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jfr.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 26704 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jfr.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jfxwebkit.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 786706 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 31136 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 8272 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 10336 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 29632 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jjs.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 15952 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jjs.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jli.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 174672 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jli.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 226 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2848 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 37984 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 40032 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jfxwebkit.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 262144 |
|
3 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2704 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jp2launcher.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 112208 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jp2launcher.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 800 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jp2iexp.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 296016 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jp2iexp.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 17600 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 7840 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jp2native.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 20048 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jp2native.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jp2ssv.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 235600 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jp2ssv.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jsdt.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 18512 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jsdt.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 43008 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jsound.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 35408 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jsound.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 42912 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 720 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jsoundds.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 31312 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jsoundds.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00448_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2960 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00448_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 10000 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jpeg.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 185936 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\jpeg.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 20800 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\keytool.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 16464 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\keytool.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\kinit.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 16464 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\kinit.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 1936 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2240 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\kcms.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 220752 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\kcms.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 14832 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 24592 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\ktab.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 16464 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\ktab.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\lcms.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 233552 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\lcms.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3648 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\klist.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 16464 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\klist.exe.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 3632 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2144 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2784 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2800 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2976 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 242 |
|
1 | |
| Write | \\?\C:\Program Files\Java\jre1.8.0_144\bin\mlib_image.dll.id[B4197730-1016].[randal_inman@aol.com].help | size = 653904 |
|
1 | |
| Write | \\?\C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF.id[B4197730-1016].[randal_inman@aol.com].help | size = 2976 |
|
1 | |
|
For performance reasons, the remaining 2338 entries are omitted.
The remaining entries can be found in glog.xml. |
|||||
Registry (20)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
6 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | - |
|
2 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | - |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 48763792, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = 48763856, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
2 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 0, type = REG_NONE |
|
2 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = 48780424, type = REG_EXPAND_SZ |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders | value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ |
|
1 | |
| Write Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | value_name = shaofao, data = C:\Users\FD1HVy\AppData\Local\shaofao.exe, size = 82, type = REG_SZ |
|
1 | |
| Write Value | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | value_name = shaofao, data = C:\Users\FD1HVy\AppData\Local\shaofao.exe, size = 82, type = REG_SZ |
|
1 |
Process (979)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\WINDOWS\system32\cmd.exe | os_pid = 0xec8, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE |
|
1 | |
| Create | C:\WINDOWS\system32\cmd.exe | os_pid = 0xed0, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE |
|
1 | |
| Enumerate Processes | - | - |
|
957 | |
| Enumerate Processes | - | - |
|
20 |
Module (28)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\syswow64\kernel32.dll | base_address = 0x774d0000 |
|
12 | |
| Get Filename | - | process_name = c:\programdata\microsoft\windows\start menu\programs\startup\shaofao.exe, file_name_orig = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\shaofao.exe, size = 260 |
|
6 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsAlloc, address_out = 0x774e4ae0 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsGetValue, address_out = 0x774e4b20 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsSetValue, address_out = 0x774e4b40 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = FlsFree, address_out = 0x774e4b00 |
|
1 | |
| Get Address | c:\windows\syswow64\kernel32.dll | function = Wow64DisableWow64FsRedirection, address_out = 0x774e6b30 |
|
6 |
System (67)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Sleep | duration = 1000 milliseconds (1.000 seconds) |
|
45 | |
| Sleep | duration = 500 milliseconds (0.500 seconds) |
|
20 | |
| Get Time | type = Ticks, time = 122906 |
|
1 | |
| Get Info | type = Operating System |
|
1 |
Mutex (29)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Create | mutex_name = Global\1016B419773001 |
|
1 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773001, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
4 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
4 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
4 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
2 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
1 | |
| Open | mutex_name = Global\1016B419773000, desired_access = SYNCHRONIZE |
|
1 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
1 |
Process #13: cmd.exe
254
0
| Information | Value |
|---|---|
| ID | #13 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | "C:\WINDOWS\system32\cmd.exe" |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:03:31, Reason: Child Process |
| Unmonitor | End Time: 00:04:05, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:34 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xec8 |
| Parent PID | 0xe64 (c:\programdata\microsoft\windows\start menu\programs\startup\shaofao.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
ECC
0x
F28
|
Host Behavior
File (189)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | C:\WINDOWS\system32 | type = file_attributes |
|
1 | |
| Get Info | C:\Windows\System32 | type = file_attributes |
|
1 | |
| Get Info | STD_OUTPUT_HANDLE | type = file_type |
|
11 | |
| Get Info | STD_INPUT_HANDLE | type = file_type |
|
5 | |
| Open | STD_OUTPUT_HANDLE | - |
|
30 | |
| Open | STD_INPUT_HANDLE | - |
|
72 | |
| Read | STD_INPUT_HANDLE | size = 1, size_out = 1 |
|
59 | |
| Write | STD_OUTPUT_HANDLE | size = 38 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 2 |
|
4 | |
| Write | STD_OUTPUT_HANDLE | size = 52 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 20 |
|
2 | |
| Write | STD_OUTPUT_HANDLE | size = 36 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 23 |
|
1 |
Registry (17)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 4, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data = 9, type = REG_NONE |
|
1 |
Process (4)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\WINDOWS\system32\vssadmin.exe | os_pid = 0xf38, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Create | C:\WINDOWS\System32\Wbem\WMIC.exe | os_pid = 0xfac, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Get Info | C:\WINDOWS\system32\vssadmin.exe | type = PROCESS_BASIC_INFORMATION |
|
1 | |
| Get Info | C:\WINDOWS\System32\Wbem\WMIC.exe | type = PROCESS_BASIC_INFORMATION |
|
1 |
Memory (2)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Read | C:\WINDOWS\system32\vssadmin.exe | address = 663906705408, size = 1952 |
|
1 | |
| Read | C:\WINDOWS\System32\Wbem\WMIC.exe | address = 1044401958912, size = 1952 |
|
1 |
Module (10)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | NTDLL.DLL | base_address = 0x7ff935520000 |
|
1 | |
| Get Handle | c:\windows\system32\cmd.exe | base_address = 0x7ff78f630000 |
|
1 | |
| Get Handle | c:\windows\system32\kernel32.dll | base_address = 0x7ff9349d0000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address_out = 0x7ff9349ea990 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = CopyFileExW, address_out = 0x7ff9349ee830 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address_out = 0x7ff9349ee300 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address_out = 0x7ff9321a0a40 |
|
1 | |
| Get Address | c:\windows\system32\ntdll.dll | function = NtQueryInformationProcess, address_out = 0x7ff9355c56b0 |
|
1 |
System (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Info | type = Operating System |
|
1 |
Environment (29)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
10 | |
| Get Environment String | name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps |
|
3 | |
| Get Environment String | name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC |
|
3 | |
| Get Environment String | name = PROMPT |
|
1 | |
| Get Environment String | name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe |
|
1 | |
| Get Environment String | name = KEYS |
|
1 | |
| Get Environment String | name = PROMPT, result_out = $P$G |
|
2 | |
| Set Environment String | name = PROMPT, value = $P$G |
|
1 | |
| Set Environment String | name = =C:, value = C:\Windows\System32 |
|
1 | |
| Set Environment String | name = COPYCMD |
|
2 | |
| Set Environment String | name = =ExitCode, value = 00000002 |
|
1 | |
| Set Environment String | name = =ExitCodeAscii |
|
2 | |
| Set Environment String | name = =ExitCode, value = 80041014 |
|
1 |
Process #14: cmd.exe
189
0
| Information | Value |
|---|---|
| ID | #14 |
| File Name | c:\windows\system32\cmd.exe |
| Command Line | "C:\WINDOWS\system32\cmd.exe" |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:03:31, Reason: Child Process |
| Unmonitor | End Time: 00:04:05, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:34 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xed0 |
| Parent PID | 0xe64 (c:\programdata\microsoft\windows\start menu\programs\startup\shaofao.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
ED4
0x
F24
|
Host Behavior
File (140)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | C:\WINDOWS\system32 | type = file_attributes |
|
1 | |
| Get Info | C:\Windows\System32 | type = file_attributes |
|
1 | |
| Get Info | STD_OUTPUT_HANDLE | type = file_type |
|
8 | |
| Get Info | STD_INPUT_HANDLE | type = file_type |
|
3 | |
| Open | STD_OUTPUT_HANDLE | - |
|
19 | |
| Open | STD_INPUT_HANDLE | - |
|
54 | |
| Read | STD_INPUT_HANDLE | size = 1, size_out = 1 |
|
47 | |
| Write | STD_OUTPUT_HANDLE | size = 38 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 2 |
|
3 | |
| Write | STD_OUTPUT_HANDLE | size = 52 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 20 |
|
1 | |
| Write | STD_OUTPUT_HANDLE | size = 47 |
|
1 |
Registry (17)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System | - |
|
1 | |
| Open Key | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | - |
|
1 | |
| Open Key | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 4, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor | value_name = AutoRun, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DisableUNCCheck, data = 64, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DelayedExpansion, data = 1, type = REG_NONE |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN |
|
1 | |
| Read Value | HKEY_CURRENT_USER\Software\Microsoft\Command Processor | value_name = AutoRun, data = 9, type = REG_NONE |
|
1 |
Process (2)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\WINDOWS\system32\netsh.exe | os_pid = 0xf44, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL |
|
1 | |
| Get Info | C:\WINDOWS\system32\netsh.exe | type = PROCESS_BASIC_INFORMATION |
|
1 |
Memory (1)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Read | C:\WINDOWS\system32\netsh.exe | address = 211789225984, size = 1952 |
|
1 |
Module (10)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | NTDLL.DLL | base_address = 0x7ff935520000 |
|
1 | |
| Get Handle | c:\windows\system32\cmd.exe | base_address = 0x7ff78f630000 |
|
1 | |
| Get Handle | c:\windows\system32\kernel32.dll | base_address = 0x7ff9349d0000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetThreadUILanguage, address_out = 0x7ff9349ea990 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = CopyFileExW, address_out = 0x7ff9349ee830 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = IsDebuggerPresent, address_out = 0x7ff9349ee300 |
|
1 | |
| Get Address | c:\windows\system32\kernel32.dll | function = SetConsoleInputExeNameW, address_out = 0x7ff9321a0a40 |
|
1 | |
| Get Address | c:\windows\system32\ntdll.dll | function = NtQueryInformationProcess, address_out = 0x7ff9355c56b0 |
|
1 |
System (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Info | type = Operating System |
|
1 |
Environment (16)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | - |
|
5 | |
| Get Environment String | name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps |
|
2 | |
| Get Environment String | name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC |
|
2 | |
| Get Environment String | name = PROMPT |
|
1 | |
| Get Environment String | name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe |
|
1 | |
| Get Environment String | name = KEYS |
|
1 | |
| Get Environment String | name = PROMPT, result_out = $P$G |
|
1 | |
| Set Environment String | name = PROMPT, value = $P$G |
|
1 | |
| Set Environment String | name = =C:, value = C:\Windows\System32 |
|
1 | |
| Set Environment String | name = COPYCMD |
|
1 |
Process #17: vssadmin.exe
0
0
| Information | Value |
|---|---|
| ID | #17 |
| File Name | c:\windows\system32\vssadmin.exe |
| Command Line | vssadmin delete shadows /all /quiet |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:03:33, Reason: Child Process |
| Unmonitor | End Time: 00:03:38, Reason: Self Terminated |
| Monitor Duration | 00:00:04 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xf38 |
| Parent PID | 0xec8 (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
F3C
0x
F40
0x
F74
0x
F78
0x
F7C
|
Process #18: netsh.exe
77
0
| Information | Value |
|---|---|
| ID | #18 |
| File Name | c:\windows\system32\netsh.exe |
| Command Line | netsh advfirewall set currentprofile state off |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:03:34, Reason: Child Process |
| Unmonitor | End Time: 00:04:05, Reason: Terminated by Timeout |
| Monitor Duration | 00:00:31 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xf44 |
| Parent PID | 0xed0 (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
F48
0x
F4C
0x
FA8
0x
600
|
Host Behavior
Registry (22)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Enumerate Values | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 | |
| Get Key Info | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh | - |
|
1 |
Module (46)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | api-ms-win-appmodel-runtime-l1-1-0.dll | base_address = 0x7ff9319b0000 |
|
1 | |
| Load | IFMON.DLL | base_address = 0x7ff929f30000 |
|
1 | |
| Load | RASMONTR.DLL | base_address = 0x7ff928a20000 |
|
1 | |
| Load | MSVCRT.DLL | base_address = 0x7ff932b40000 |
|
1 | |
| Load | C:\WINDOWS\system32\MFC42LOC.DLL | base_address = 0x0 |
|
1 | |
| Load | AUTHFWCFG.DLL | base_address = 0x7ff91c800000 |
|
1 | |
| Load | DHCPCMONITOR.DLL | base_address = 0x7ff929ee0000 |
|
1 | |
| Load | DOT3CFG.DLL | base_address = 0x7ff9292d0000 |
|
1 | |
| Load | FWCFG.DLL | base_address = 0x7ff9289e0000 |
|
1 | |
| Load | HNETMON.DLL | base_address = 0x7ff929ed0000 |
|
1 | |
| Load | NETIOHLP.DLL | base_address = 0x7ff928940000 |
|
1 | |
| Load | NETTRACE.DLL | base_address = 0x7ff918c00000 |
|
1 | |
| Load | NSHHTTP.DLL | base_address = 0x7ff929180000 |
|
1 | |
| Load | NSHIPSEC.DLL | base_address = 0x7ff916d30000 |
|
1 | |
| Load | NSHWFP.DLL | base_address = 0x7ff916bb0000 |
|
1 | |
| Load | P2PNETSH.DLL | base_address = 0x7ff91dee0000 |
|
1 | |
| Load | RPCNSH.DLL | base_address = 0x7ff9289c0000 |
|
1 | |
| Load | WCNNETSH.DLL | base_address = 0x7ff91de80000 |
|
1 | |
| Load | WHHELPER.DLL | base_address = 0x7ff920540000 |
|
1 | |
| Load | WLANCFG.DLL | base_address = 0x7ff91de00000 |
|
1 | |
| Load | WSHELPER.DLL | base_address = 0x7ff916440000 |
|
1 | |
| Load | WWANCFG.DLL | base_address = 0x7ff916fb0000 |
|
1 | |
| Load | PEERDISTSH.DLL | base_address = 0x7ff916f40000 |
|
1 | |
| Get Handle | c:\windows\system32\netsh.exe | base_address = 0x7ff62fb60000 |
|
2 | |
| Get Filename | - | process_name = c:\windows\system32\netsh.exe, file_name_orig = C:\WINDOWS\system32\MFC42u.dll, size = 260 |
|
1 | |
| Get Address | c:\windows\system32\ifmon.dll | function = InitHelperDll, address_out = 0x7ff929f31310 |
|
1 | |
| Get Address | c:\windows\system32\rasmontr.dll | function = InitHelperDll, address_out = 0x7ff928a35850 |
|
1 | |
| Get Address | c:\windows\system32\authfwcfg.dll | function = InitHelperDll, address_out = 0x7ff91c801430 |
|
1 | |
| Get Address | c:\windows\system32\dhcpcmonitor.dll | function = InitHelperDll, address_out = 0x7ff929ee1610 |
|
1 | |
| Get Address | c:\windows\system32\dot3cfg.dll | function = InitHelperDll, address_out = 0x7ff9292d1100 |
|
1 | |
| Get Address | c:\windows\system32\fwcfg.dll | function = InitHelperDll, address_out = 0x7ff9289e11f0 |
|
1 | |
| Get Address | c:\windows\system32\hnetmon.dll | function = InitHelperDll, address_out = 0x7ff929ed2060 |
|
1 | |
| Get Address | c:\windows\system32\netiohlp.dll | function = InitHelperDll, address_out = 0x7ff928955f80 |
|
1 | |
| Get Address | c:\windows\system32\nettrace.dll | function = InitHelperDll, address_out = 0x7ff918c015d0 |
|
1 | |
| Get Address | c:\windows\system32\nshhttp.dll | function = InitHelperDll, address_out = 0x7ff9291810e0 |
|
1 | |
| Get Address | c:\windows\system32\nshipsec.dll | function = InitHelperDll, address_out = 0x7ff916d31250 |
|
1 | |
| Get Address | c:\windows\system32\nshwfp.dll | function = InitHelperDll, address_out = 0x7ff916bb10d0 |
|
1 | |
| Get Address | c:\windows\system32\p2pnetsh.dll | function = InitHelperDll, address_out = 0x7ff91dee11e0 |
|
1 | |
| Get Address | c:\windows\system32\rpcnsh.dll | function = InitHelperDll, address_out = 0x7ff9289c1010 |
|
1 | |
| Get Address | c:\windows\system32\wcnnetsh.dll | function = InitHelperDll, address_out = 0x7ff91de81680 |
|
1 | |
| Get Address | c:\windows\system32\whhelper.dll | function = InitHelperDll, address_out = 0x7ff9205414d0 |
|
1 | |
| Get Address | c:\windows\system32\wlancfg.dll | function = InitHelperDll, address_out = 0x7ff91de01320 |
|
1 | |
| Get Address | c:\windows\system32\wshelper.dll | function = InitHelperDll, address_out = 0x7ff916441030 |
|
1 | |
| Get Address | c:\windows\system32\wwancfg.dll | function = InitHelperDll, address_out = 0x7ff916fb11d0 |
|
1 | |
| Get Address | c:\windows\system32\peerdistsh.dll | function = InitHelperDll, address_out = 0x7ff916f41220 |
|
1 |
System (8)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Cursor | x_out = 748, y_out = 800 |
|
1 | |
| Get Info | type = Operating System |
|
6 | |
| Get Info | type = System Directory, result_out = C:\WINDOWS\system32 |
|
1 |
Process #19: wmic.exe
162
0
| Information | Value |
|---|---|
| ID | #19 |
| File Name | c:\windows\system32\wbem\wmic.exe |
| Command Line | wmic shadowcopy delete |
| Initial Working Directory | C:\WINDOWS\system32\ |
| Monitor | Start Time: 00:03:42, Reason: Child Process |
| Unmonitor | End Time: 00:04:04, Reason: Self Terminated |
| Monitor Duration | 00:00:22 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0xfac |
| Parent PID | 0xec8 (c:\windows\system32\cmd.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | NQDPDE\FD1HVy |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
FB0
0x
FB4
0x
FE0
0x
FE4
0x
FE8
|
Host Behavior
COM (7)
| Operation | Class | Interface | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|---|
| Create | WBEMLocator | IWbemLocator | cls_context = CLSCTX_INPROC_SERVER |
|
1 | |
| Create | F6D90F12-9C73-11D3-B32E-00C04F990BB4 | 2933BF95-7B36-11D2-B20E-00C04F983E60 | cls_context = CLSCTX_INPROC_SERVER |
|
1 | |
| Create | EB87E1BD-3233-11D2-AEC9-00C04FB68820 | EB87E1BC-3233-11D2-AEC9-00C04FB68820 | cls_context = CLSCTX_INPROC_SERVER |
|
1 | |
| Execute | WBEMLocator | IWbemLocator | method_name = ConnectServer, network_resource = root\cli |
|
1 | |
| Execute | WBEMLocator | IWbemLocator | method_name = ConnectServer, network_resource = root\cli\ms_409 |
|
1 | |
| Execute | WBEMLocator | IWbemLocator | method_name = ConnectServer, network_resource = \\NQDPDE\ROOT\CIMV2 |
|
1 | |
| Execute | WBEMLocator | IWbemServices | method_name = ExecQuery, query_language = WQL, query = SELECT * FROM Win32_ShadowCopy |
|
1 |
Registry (5)
| Operation | Key | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Open Key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM | - |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM | value_name = Logging, data = 48 |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM | value_name = Logging Directory |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM | value_name = Logging Directory, data = 37 |
|
1 | |
| Read Value | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM | value_name = Log File Max Size, data = 54 |
|
1 |
Module (1)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Handle | c:\windows\system32\wbem\wmic.exe | base_address = 0x7ff6847f0000 |
|
1 |
System (3)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Computer Name | result_out = NQDPDE |
|
1 | |
| Get Time | type = Local Time, time = 2019-05-28 22:01:22 (Local Time) |
|
1 | |
| Get Info | type = System Directory, result_out = C:\WINDOWS\system32 |
|
1 |
