9266d4bd...8896

Monitored Processes

Process Overview

ID	PID	Monitor Reason	Integrity Level	Image Name	Command Line	Origin ID
#1	0x794	Analysis Target	High (Elevated)	load0.exe	"C:\Users\FD1HVy\Desktop\load0.exe"	-
#2	0x1be4	Child Process	High (Elevated)	cmd.exe	"C:\WINDOWS\system32\cmd.exe"	#1
#4	0x1c6c	Child Process	High (Elevated)	mode.com	mode con cp select=1251	#2
#5	0x1c94	Child Process	High (Elevated)	vssadmin.exe	vssadmin delete shadows /all /quiet	#2
#6	0xda0	Autostart	Medium	load0.exe	"C:\Windows\System32\load0.exe"	-
#7	0xdac	Autostart	Medium	load0.exe	"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe"	-
#8	0xdbc	Autostart	Medium	load0.exe	"C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe"	-
#9	0x2698	Child Process	Medium	cmd.exe	"C:\WINDOWS\system32\cmd.exe"	#7
#12	0x2718	Child Process	Medium	mode.com	mode con cp select=1251	#9
#13	0x2738	Child Process	Medium	vssadmin.exe	vssadmin delete shadows /all /quiet	#9
#14	0xc6c	Child Process	High (Elevated)	load0.exe	"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe" -a	#7
#15	0x2740	Child Process	High (Elevated)	cmd.exe	"C:\WINDOWS\system32\cmd.exe"	#14
#17	0x27b0	Child Process	Medium	cmd.exe	"C:\WINDOWS\system32\cmd.exe"	#7
#19	0x272c	Child Process	High (Elevated)	mode.com	mode con cp select=1251	#15
#20	0x9bc	Child Process	High (Elevated)	vssadmin.exe	vssadmin delete shadows /all /quiet	#15

Behavior Information - Grouped by Category

Process #1: load0.exe

34753

Information	Value
ID	#1
File Name	c:\users\fd1hvy\desktop\load0.exe
Command Line	"C:\Users\FD1HVy\Desktop\load0.exe"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:01:44, Reason: Analysis Target
Unmonitor	End Time: 00:05:03, Reason: Terminated by Timeout
Monitor Duration	00:03:19

OS Process Information

Information	Value
PID	0x794
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x D04 0x D44 0x B6C 0x EB0 0x FA4 0x A84 0x FA0 0x F9C 0x F88 0x F80 0x CC8 0x EE4 0x 390 0x F68 0x 4A8 0x 4A4 0x EAC 0x EB4 0x ED0 0x EBC 0x ED8 0x FEC 0x F0 0x D90 0x D7C 0x B64 0x 4A0 0x B08 0x DA4 0x EE8 0x A78 0x E7C 0x F58 0x D78 0x EEC 0x B98 0x CBC 0x 15C 0x E3C 0x F54 0x FB4 0x EF0 0x C70 0x A98 0x 8F0 0x F7C 0x F64 0x F08 0x AF0 0x CA0 0x 540 0x F44 0x CC4 0x E90 0x F38 0x 368 0x EA0 0x EC8 0x E60 0x E0 0x F00 0x EF8 0x DFC 0x 39C 0x E5C 0x 4D8 0x 36C 0x 4AC 0x 4BC 0x 9E4 0x 7BC 0x D00 0x CE4 0x AC8 0x CE0 0x D48 0x 90C 0x D28 0x D1C 0x 7A8 0x D6C 0x 4D0 0x 388 0x F8C 0x 4C8 0x 4F0 0x 798 0x F6C 0x 910 0x 738 0x E64 0x C38 0x DDC 0x B60 0x DF8 0x F70 0x FA8 0x 344 0x F78 0x E98 0x 1004 0x 1008 0x 1010 0x 1014 0x 1018 0x 101C 0x 1020 0x 1024 0x 1028 0x 102C 0x 1030 0x 1034 0x 1038 0x 103C 0x 1040 0x 1044 0x 1048 0x 104C 0x 1050 0x 1054 0x 1058 0x 105C 0x 1060 0x 1064 0x 1068 0x 106C 0x 1070 0x 1074 0x 1078 0x 107C 0x 1080 0x 1084 0x 1088 0x 108C 0x 1090 0x 1094 0x 1098 0x 109C 0x 10A0 0x 10A4 0x 10A8 0x 10AC 0x 10B0 0x 10B4 0x 10B8 0x 10BC 0x 10C0 0x 10C4 0x 10C8 0x 10CC 0x 10D0 0x 10D4 0x 10D8 0x 10DC 0x 10E0 0x 10E4 0x 10E8 0x 10EC 0x 10F0 0x 10F4 0x 10F8 0x 10FC 0x 1100 0x 1104 0x 1108 0x 110C 0x 1110 0x 1114 0x 1118 0x 111C 0x 1120 0x 1124 0x 1128 0x 112C 0x 1130 0x 1134 0x 1138 0x 113C 0x 1140 0x 1144 0x 1148 0x 114C 0x 1150 0x 1154 0x 1158 0x 115C 0x 1160 0x 1164 0x 1168 0x 116C 0x 1170 0x 1174 0x 1178 0x 117C 0x 1180 0x 1184 0x 1188 0x 118C 0x 1190 0x 1194 0x 1198 0x 119C 0x 11A0 0x 11A4 0x 11A8 0x 11AC 0x 11B0 0x 11B4 0x 11B8 0x 11BC 0x 11C0 0x 11C4 0x 11C8 0x 11CC 0x 11D0 0x 11D4 0x 11D8 0x 11DC 0x 11E0 0x 11E4 0x 11E8 0x 11EC 0x 11F0 0x 11F4 0x 11F8 0x 11FC 0x 1200 0x 1204 0x 1208 0x 120C 0x 1210 0x 1214 0x 1218 0x 121C 0x 1220 0x 1224 0x 1228 0x 122C 0x 1230 0x 1234 0x 1238 0x 123C 0x 1248 0x 124C 0x 1250 0x 1254 0x 1258 0x 125C 0x 1260 0x 1264 0x 1268 0x 126C 0x 1270 0x 1274 0x 1278 0x 127C 0x 1280 0x 1284 0x 1288 0x 128C 0x 1290 0x 1294 0x 129C 0x 12A0 0x 12A4 0x 12A8 0x 12AC 0x 12B0 0x 12B4 0x 12B8 0x 12BC 0x 12C0 0x 12C4 0x 12C8 0x 12CC 0x 12D0 0x 12D4 0x 12D8 0x 12DC 0x 12E0 0x 12E4 0x 12E8 0x 12EC 0x 12F0 0x 12F4 0x 12F8 0x 12FC 0x 1300 0x 1304 0x 1308 0x 130C 0x 1310 0x 1314 0x 1318 0x 131C 0x 1320 0x 1324 0x 1328 0x 132C 0x 1330 0x 1334 0x 1338 0x 133C 0x 1340 0x 1344 0x 1348 0x 134C 0x 1350 0x 1354 0x 1358 0x 135C 0x 1360 0x 1364 0x 1368 0x 136C 0x 1370 0x 1374 0x 1378 0x 137C 0x 1380 0x 1384 0x 1388 0x 138C 0x 1390 0x 1394 0x 1398 0x 139C 0x 13A0 0x 13A4 0x 13A8 0x 13AC 0x 13B0 0x 13B4 0x 13B8 0x 13BC 0x 13C0 0x 13C4 0x 13C8 0x 13CC 0x 13D0 0x 13D4 0x 13D8 0x 13E4 0x 13E8 0x 13EC 0x 13F0 0x 13F4 0x 13F8 0x 13FC 0x 9D8 0x 770 0x 3A8 0x 498 0x 42C 0x 868 0x 1404 0x 1408 0x 140C 0x 1410 0x 1414 0x 1418 0x 141C 0x 1428 0x 142C 0x 1430 0x 1434 0x 1438 0x 143C 0x 1440 0x 1444 0x 1448 0x 144C 0x 1450 0x 1454 0x 1458 0x 145C 0x 1460 0x 1464 0x 1468 0x 146C 0x 1470 0x 1474 0x 1490 0x 1494 0x 1498 0x 149C 0x 14A0 0x 14A4 0x 14A8 0x 14AC 0x 14B0 0x 14B4 0x 14B8 0x 14BC 0x 14C0 0x 14C4 0x 14C8 0x 14CC 0x 14D0 0x 14D4 0x 14D8 0x 14DC 0x 14E0 0x 14E4 0x 14E8 0x 14EC 0x 14F0 0x 14F4 0x 14F8 0x 14FC 0x 1500 0x 1504 0x 1508 0x 150C 0x 1510 0x 1514 0x 1518 0x 151C 0x 1520 0x 1524 0x 1528 0x 152C 0x 1554 0x 1558 0x 155C 0x 1560 0x 1564 0x 1568 0x 156C 0x 1570 0x 1574 0x 1578 0x 157C 0x 1580 0x 1584 0x 1588 0x 158C 0x 1590 0x 1594 0x 1598 0x 159C 0x 15A0 0x 15A4 0x 15A8 0x 15AC 0x 15B0 0x 15B4 0x 15B8 0x 15BC 0x 15C0 0x 15C4 0x 15C8 0x 15CC 0x 15D0 0x 15D4 0x 15D8 0x 15DC 0x 15E0 0x 15E4 0x 15E8 0x 15EC 0x 15F0 0x 15F4 0x 15F8 0x 15FC 0x 1600 0x 1604 0x 1608 0x 160C 0x 1610 0x 1614 0x 1618 0x 161C 0x 1620 0x 1624 0x 1628 0x 162C 0x 1630 0x 1634 0x 1638 0x 163C 0x 1640 0x 1644 0x 1648 0x 164C 0x 1650 0x 1654 0x 1658 0x 165C 0x 1660 0x 1664 0x 1668 0x 166C 0x 1670 0x 1674 0x 1678 0x 167C 0x 1680 0x 1684 0x 1688 0x 168C 0x 1690 0x 1694 0x 1698 0x 169C 0x 16A0 0x 16A4 0x 16A8 0x 16AC 0x 16B0 0x 16B4 0x 16B8 0x 16BC 0x 16C0 0x 16C4 0x 16C8 0x 16CC 0x 16D0 0x 16D4 0x 16D8 0x 16DC 0x 16E0 0x 16E4 0x 16E8 0x 16EC 0x 16F0 0x 16F4 0x 16F8 0x 16FC 0x 1700 0x 1704 0x 1708 0x 170C 0x 1710 0x 1714 0x 1718 0x 171C 0x 1720 0x 1724 0x 1728 0x 172C 0x 1730 0x 1738 0x 173C 0x 1740 0x 1744 0x 1748 0x 174C 0x 1750 0x 1754 0x 1758 0x 175C 0x 1760 0x 1764 0x 1768 0x 176C 0x 1770 0x 1774 0x 1778 0x 177C 0x 1780 0x 1784 0x 1788 0x 178C 0x 1790 0x 1794 0x 1798 0x 179C 0x 17A0 0x 17A4 0x 17A8 0x 17AC 0x 17B0 0x 17B4 0x 17B8 0x 17BC 0x 17C0 0x 17C4 0x 17C8 0x 17CC 0x 17D0 0x 17D4 0x 17D8 0x 17DC 0x 17E0 0x 17E4 0x 17E8 0x 17EC 0x 17F0 0x 17F4 0x 17F8 0x 17FC 0x 714 0x 1420 0x 1488 0x 48C 0x E88 0x 6DC 0x 1480 0x 148C 0x 1538 0x 1540 0x 1544 0x 154C 0x 1550 0x 754 0x 1804 0x 1808 0x 180C 0x 1810 0x 1814 0x 1818 0x 181C 0x 1820 0x 1824 0x 1828 0x 182C 0x 1830 0x 1834 0x 1838 0x 183C 0x 1840 0x 184C 0x 1850 0x 1854 0x 1858 0x 185C 0x 1860 0x 1864 0x 1868 0x 186C 0x 1870 0x 1874 0x 1878 0x 187C 0x 1880 0x 1884 0x 1888 0x 188C 0x 1890 0x 1894 0x 1898 0x 189C 0x 18A0 0x 18A4 0x 18A8 0x 18AC 0x 18B0 0x 18B4 0x 18B8 0x 18BC 0x 18C0 0x 18C4 0x 18C8 0x 18CC 0x 18D0 0x 18D4 0x 18D8 0x 18DC 0x 18E0 0x 18E4 0x 18E8 0x 18EC 0x 18F0 0x 18F4 0x 18F8 0x 18FC 0x 1900 0x 1904 0x 1908 0x 190C 0x 1910 0x 1914 0x 1918 0x 191C 0x 1920 0x 1924 0x 1928 0x 192C 0x 1930 0x 1934 0x 1938 0x 193C 0x 1940 0x 1944 0x 1948 0x 194C 0x 1950 0x 1954 0x 1958 0x 195C 0x 1960 0x 1964 0x 1968 0x 196C 0x 1970 0x 1974 0x 1978 0x 197C 0x 1980 0x 1984 0x 1988 0x 198C 0x 1990 0x 1994 0x 1998 0x 199C 0x 19A0 0x 19A4 0x 19A8 0x 19AC 0x 19B0 0x 19B4 0x 19B8 0x 19BC 0x 19C0 0x 19C4 0x 19C8 0x 19CC 0x 19D0 0x 19D4 0x 19D8 0x 19DC 0x 19E0 0x 19E4 0x 19E8 0x 19EC 0x 19F0 0x 19F4 0x 19F8 0x 19FC 0x 1A00 0x 1A04 0x 1A08 0x 1A0C 0x 1A10 0x 1A14 0x 1A18 0x 1A1C 0x 1A20 0x 1A24 0x 1A28 0x 1A2C 0x 1A30 0x 1A34 0x 1A38 0x 1A3C 0x 1A40 0x 1A44 0x 1A48 0x 1A4C 0x 1A50 0x 1A54 0x 1A58 0x 1A5C 0x 1A60 0x 1A64 0x 1A68 0x 1A6C 0x 1A70 0x 1A74 0x 1A78 0x 1A7C 0x 1A80 0x 1A84 0x 1A88 0x 1A8C 0x 1A90 0x 1A94 0x 1A98 0x 1A9C 0x 1AA0 0x 1AA4 0x 1AA8 0x 1AAC 0x 1AB0 0x 1AB4 0x 1AB8 0x 1ABC 0x 1AC0 0x 1AC4 0x 1AC8 0x 1ACC 0x 1AD0 0x 1AD4 0x 1AD8 0x 1ADC 0x 1AE0 0x 1AE4 0x 1AE8 0x 1AEC 0x 1AF0 0x 1AF4 0x 1AF8 0x 1AFC 0x 1B00 0x 1B04 0x 1B08 0x 1B0C 0x 1B10 0x 1B14 0x 1B18 0x 1B1C 0x 1B20 0x 1B24 0x 1B28 0x 1B2C 0x 1B30 0x 1B34 0x 1B38 0x 1B3C 0x 1B40 0x 1B44 0x 1B48 0x 1B4C 0x 1B50 0x 1B54 0x 1B58 0x 1B5C 0x 1B60 0x 1B64 0x 1B68 0x 1B74 0x 1B78 0x 1B7C 0x 1B80 0x 1B84 0x 1B88 0x 1B8C 0x 1B90 0x 1B94 0x 1B98 0x 1B9C 0x 1BA0 0x 1BA4 0x 1BA8 0x 1BAC 0x 1BB0 0x 1BB4 0x 1BB8 0x 1BBC 0x 1BC0 0x 1BF0 0x 1BF8 0x 1BFC 0x 9E8 0x 1B70 0x 474 0x 1BC4 0x 1C04 0x 1C08 0x 1C0C 0x 1C10 0x 1C14 0x 1C18 0x 1C1C 0x 1C20 0x 1CF4 0x 1CFC

Memory Dumps

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
load0.exe	0x00400000	0x00441FFF	Relevant Image	-	32-bit	-			... Region Actions Download Dump
buffer	0x05110000	0x05139FFF	First Execution	-	32-bit	0x0511622F, 0x0511542C			... Region Actions Download Dump

Dropped Files

Filename	File Size	Hash Values	Actions
C:\Users\FD1HVy\Desktop\load0.exe	249.50 KB	MD5: a722665c4fc7298f00a31ac652dc02d2 SHA1: 4aec87eb4d697b398b0d602194cdd45cd595e502 SHA256: 9266d4bdcb7351e4c4025371b968e96197628b342e37c3c428787d47217a8896 SSDeep: 3072:Jm7kVpR2W/G4nqjrpThO0L+3vuZGe0Mp6U924SFcszDnVZlIKG0:8AVpznqj9hO0LAdOt/YHz7TG	... File Actions Show Properties Download
C:\588bce7c90097ed212\1035\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	3.85 KB	MD5: b1a446455b2de81bbac6a2e2fe75e140 SHA1: 1c208e6efce53744892adb574e051680dc0d1088 SHA256: 8a107403f4022232dcce7cc6ec548da1db27ad2b4fade4a58c10ac93fd951ee9 SSDeep: 96:ur032sGxcqwWMwT1syb6t6P5eZjI/gh+Z07cYcFRcig1R:q03fGxcqwqB/+tGAKoh+McYczcZR	... File Actions Show Properties Download
C:\588bce7c90097ed212\1046\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	3.83 KB	MD5: 99a242f4fb289d6d65328156d220fcaf SHA1: a629ce83ee9315b70b8f3de15e6dfbfdc222fab5 SHA256: 11af07e482f996c553df81edbd0895e92473cc23f71b814286d9b722cdbe9650 SSDeep: 48:HA11WRUJ26Qvu7jXjlmx8+TFPh741ejO0Mg49n4J7CLUXZW7R+QGxN/ipZ5YkA1R:01W2qCzl+Phc2O05CLUXZW7sPqHuh1R	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-B4197730.[bitcharity@protonmail.com].com	4.62 KB	MD5: 53d75f311267bc0fe7e7543882e37074 SHA1: 39c3e3a338a31345f978e95a7a30079f04475202 SHA256: b090b7070f5a2d15c6e191da509389f7459adcaa0dfccaec0b730809b190f7ff SSDeep: 96:qUKohdZZnHD3ZXH+RmUrT9eLMUjfFTu7Za5u3ILs2klHwjw1d:qV0VjpXHUrT9eLM8Zew84g+jwd	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupEngine.dll.id-B4197730.[bitcharity@protonmail.com].com	788.58 KB	MD5: cd11d1c62ae99fffd6c7a5f728214aa2 SHA1: 9525c8847d05b0bc1a996ce0b7a26204e3ad44d0 SHA256: a7c13d27db68d87dd2d63aa09b4c0aa680116414daabd95437396ba6f0e4afcf SSDeep: 24576:rlAiw5WhnFJPGS3l0yTgzlK1K2scm9orRsLw4KDgyV+/:r7x70Cg5/wm9orRQKDk	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com	2.84 MB	MD5: 32046394ad7fd7696f7b80d3c7280b1e SHA1: d2d7a1f6c61f6a560a24ddd69fc2ac421cc07bc7 SHA256: 32250eb523753c056fe495f5eb530f1d4e43e5b9cc40763d023d81fedb3ff4f8 SSDeep: 49152:WV4YaGoDumT1r7AdXZy9KU2KUYxs35DKZ3OIK5OY7ynvt9qx76zOB:WV4Yab1PAdXZzKUYxs3pKZnKKu766B	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id-B4197730.[bitcharity@protonmail.com].com	14.06 KB	MD5: c7aeae81ccc23cc2853703b7055c403a SHA1: aa216295d79cc526cf3a1d6f8f44f283e0889da4 SHA256: b04633e7bb28012e61c0c0838381026585f84bf33a9da7dd2c4169e82b8afb99 SSDeep: 384:lH4j9Lx+beEZtAtcqlfKyh/5EwSM7fb0wz:lYxzEZtAtsE/KwSMTJz	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: 016e0a9bd7578234ba30378749b7ec86 SHA1: ae9908a88d313fd2b19a8381eb5f614230283eca SHA256: 21c1d53c2cd99fccbc1feaf7a087aaf77eeeb4889aa07a23d720d47e01971571 SSDeep: 1536:jnWdl/nt16RrFAfx3HM0x42j1gEBBvDgCyjiblvHQA:ip16Ru3HM24U1lsCyjSj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id-B4197730.[bitcharity@protonmail.com].com	13.18 KB	MD5: 0937942beffa71b9a18004a1c1835d00 SHA1: 47f15cf4c0e2fa0015c9c7fba721c4426f75f23e SHA256: a4b43f49c4caaa2e7689c323a451f03125ef2825576ea97d810007b17a793285 SSDeep: 192:/Q0t6ZI75hAhGDV6u8a54rjDMhQ/yzDfkTCzNaKtC666TMq6UTva8p:/JghGDn8ayrjAhQ/kLkTChaKhAqZCm	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[bitcharity@protonmail.com].com	5.01 KB	MD5: c88498da631ca0c91d68d83baca175f8 SHA1: 10b5350766920174d2b664f75ceffe729863208a SHA256: cf5ea731960860e5541f69d78f0717de8e359df10b7ea2032e9266c676d725c1 SSDeep: 96:7JG630z39K98JxuPC72tYLr3rgDBrRg9NmCaTlulj889i39WYd2K61p:FG6Ezg94f72tYLDr8Rg9ACaTkj8rNVCp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[bitcharity@protonmail.com].com	4.53 KB	MD5: 7e679eab75a1189a328068cd6fd21784 SHA1: 431dab3ed125ed8f63580f646d3dc12cf0518f4e SHA256: e14dda1183c0f169b824d4057978c464954b539d16147a6f7ee8da6e3e8706ba SSDeep: 96:9nfdhXAVSXNdzIQZpRlyIqzTWm8RRWKifQCB3vCuCOumyD+Kmam1p:5VhQkdd0QBlyI6TqRW13dbuSrp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.53 KB	MD5: 27e374ac984e048afb314cdf0d9d584f SHA1: 6957e1f7b5053c7a79ce6adb6ad47d97e6e786f2 SHA256: 3b17d79c2ae7d5b2ec7361be2c478f16319b010c02cd3d0e687b5d919af6b764 SSDeep: 48:A7zkLTtsnN7Ft8/EUfxpMfApBgnv4yjZOdofjYfUWVqtnqUYxcA1m6:2+ONMsUEALU4HufjYZQqUq1p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.21 KB	MD5: c9ecd4cc210c8803da4013006b0cd650 SHA1: 72082455c23d12af23fb9c7bdc56d6c7694499df SHA256: 742986888867cc72b52a54a107cc0f70c590df7d5dc51f2b4a7dbd6952e43c88 SSDeep: 48:QB7KvNurdJb5sBqXoqGEf4RFEJFBYSjI4utl141+A1m6:m7K0rFNkFEJFBYdtn41L1p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id-B4197730.[bitcharity@protonmail.com].com	5.12 KB	MD5: fd415ef16e2fbf7c90960c5d713b5856 SHA1: f7c1b4f66fcc9fddf70bb575557be7264b673944 SHA256: 881083e71f12912ed163f6617dc41a1153f88cfa1daa4763fe781dd16c5139a5 SSDeep: 96:3oX2wEDjABCUSaL+GY/2/L8mTXC/ooZ+ouB0dlhCtrBV4ygm0Xadf0Ks5l8CxDIL:G2wEDckAJk2/L8mu/ooZ9o0EdV4ygm0I	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id-B4197730.[bitcharity@protonmail.com].com	22.23 KB	MD5: dec0a1f11f2dfbe255280453b85b0438 SHA1: 6752db9dfc1d2b812b26928839954088494c1156 SHA256: fa04864819bfd738ab459dd5fac90f8ed50cb339a4469f9c70e6b524700f1457 SSDeep: 384:ixFusFGdeBfsePl2KtiRUUBRPFNU6yrFEJiIMsioiWdtETLJgA53dlK5zVSfDU6R:iqwtLPY2izR46yhEJ/MxontETjtGVyDD	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id-B4197730.[bitcharity@protonmail.com].com	24.43 KB	MD5: 845ebd2885b46952afa7286e0337f390 SHA1: 0b5b9436a3120a412b14a33c4c73534a65d714f1 SHA256: 1c22365b711c8648fb18e72c28d4f6fd9ae1fe46da2a65038f1a216f8a8efb38 SSDeep: 384:Dk3UbE29hrAlfNBNtGDwz5L6K+ObjPNERZtN19KXYZJ3INZ//TBB3Rz/ebVmN:AEbrABf5L65ObjFAZtWYX3crT5CVmN	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF.id-B4197730.[bitcharity@protonmail.com].com	12.46 KB	MD5: 7818b62f9c99351775017e12bc4684b4 SHA1: 1828b32dc9d210c507e38afa82d2e72c8bd86594 SHA256: 0d018cea811dd55fb6e84904058a8d1eacd787a4701bf1280b7c7d70980464b6 SSDeep: 384:os/Ktm4Ylh+ZAI6UPVdXmM+jAjQybFSP+ak7/aD8V:z/KU4YlEZ36k7+jKpSPe7Ci	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	18.47 KB	MD5: 699a51bb4f0385265a33cc97b02d8eb0 SHA1: d9a66b3e73352a28d771fb19c2574f8fb49d83e8 SHA256: 533d742524a30946261ae49885133e5bdf11037168f960f550be7113c7d4a185 SSDeep: 384:y/BNM+FxTV6NphZtXu81TCmmGvR1CrTKPCvPNTQsELE/2JHC:y5txTV8pX5u8FvmGvR1oTjusELE/2JHC	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.92 KB	MD5: f2c55119e671c0ff61ba03c78c9bd329 SHA1: 333a6fdb80ee55d0cfe422120dff4b959f803411 SHA256: 6d4014645e1d833bc58656e514262e1bf9be75dc590d22a55b52c82211136db0 SSDeep: 96:4OQQZhwlg87CLxdS5yZkL/DAcSgiDCRB35thW1p:4OQZJ7ACyeLrxiShzAp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com	27.15 KB	MD5: 8a014463664ed8a12135e12879caa5ee SHA1: 6742ef199474f0fda68a75395910964ae149dccc SHA256: 260d2924251445d9cf4ea0aac81f3b15d42df1f076ad3a9e27dcb1cf970145f2 SSDeep: 768:8j1z0tSHJtRNCMgd3A+0/D13CuC6ybtM/Qo9ErF7WNcq:85bPRMY+0By96r/ErF7W7	... File Actions Show Properties Download
C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id-B4197730.[bitcharity@protonmail.com].com	0.31 KB	MD5: 48d5a0699cc1d06a23de1d0b36312b49 SHA1: 3e1820c50e5d1af5649081194480a26cdb2ac3ca SHA256: 72e210cf48d62e472d9acb6c1939abda2262089d76a93f58b43a6e458535ee4b SSDeep: 6:SiGVt6d49tcel1DmRH8lD7gzNAG17rbK+cNuGzR/u1mEYTQ:SbN1UH8lIzn17rbK+cPY1mEYU	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\preoobe.cmd.id-B4197730.[bitcharity@protonmail.com].com	0.31 KB	MD5: 657da3e947e831e6835fb42c11ea2755 SHA1: 1ffc688a21987dae1cf6139e6c1cfeae47fe66ce SHA256: 760c0892ee79e69e38c20d9ed26e08ead3c0ba6276b126bd87200dcff10b2f7a SSDeep: 6:UJJTOFfhV5NAokCHQlSa3Vyu4F3kqDy7TpqLhAmnBy54:UzWP5SbQa3gua0zM1TByG	... File Actions Show Properties Download
C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[bitcharity@protonmail.com].com	6.14 KB	MD5: 311a7e6f6ffcc84afbd4fb8c15694457 SHA1: ab5d96dddbc60bac128491c5559081190d55b40f SHA256: 1172b3578accffc723b3854f7fb7d96625505b7f7b4da206519a01e31b1ff6d5 SSDeep: 192:c9VD/lhU3o26DlqxSkssk3TrA4PcefRlj0Zd7VRh:c9VDTUY26DFkUTrA4Pce0NVX	... File Actions Show Properties Download
C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[bitcharity@protonmail.com].com	41.97 KB	MD5: a5bebda2505754f2a50f641397903b8d SHA1: 716ffab5d343dc125265aafd9a9f219d9c5cab9c SHA256: 7864e35150d2cbd2646d9fbf678d909ee7bb242b310d2d0cf5b769d90353cb16 SSDeep: 768:VQVJOCTFE5hI62jeYKMQZyu/6Z+3xPewmJMRHqlkfIXBJOVON9Y:VEJOCTFE/IiYhkCZ+3xSMRHqafICo3Y	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id-B4197730.[bitcharity@protonmail.com].com	0.41 KB	MD5: 20bdd180e9a8e9f427135e9c936e8a48 SHA1: 856f4e6bc77773d6b2dc76510d8bb2b8c1b7095d SHA256: 6b76d62b9adb8c1ffcb8fb40d6b833058914e6954f1ce93e32755b0235f9f850 SSDeep: 12:fN61LcvQFHX5SQ7o4/laqG1bK+cPY1mEYk:f0wqHX5SQk4/laqmbWPY1me	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\SetupComplete.cmd.id-B4197730.[bitcharity@protonmail.com].com	0.55 KB	MD5: d01302a0341cf95296d979a331dc99ac SHA1: 8992a3b10fa3d26fda30cf9ef7bc2ef837ca646a SHA256: a36e1c1a90186872f50b737d7cc473732f63b61b8445a72cd673b34f786a700f SSDeep: 12:mOnOMrSQJ+j4Tj37wkNYxyoNVlfurWiFH8lRjUv4ja0zM1TByu/l:mOnnrSQ78kNYTN7uSiFH8lXHsTB3t	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id-B4197730.[bitcharity@protonmail.com].com	140.95 KB	MD5: d4a900022589cf2a0e5c4938b1747f0b SHA1: 21f6f091c321649505dbb335f88ea3f911f635cc SHA256: 925cc00373a44a93e5bee605023beface80235a15e88c5c03d49f2a07c859e15 SSDeep: 3072:B61SiJzXyu6LeLuc5zsxA/yTlUckGPilBbwChk0WRtiYK:Et7zsayTWc1ilJwOuwYK	... File Actions Show Properties Download
C:\$Recycle.Bin\S-1-5-18\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com	0.37 KB	MD5: da4324163b980803d29df46df2202fc9 SHA1: 27694e8730756f53acf7b6e7ea86c7db8593b53d SHA256: f64443ac704511805ec1daf4d9a1a681f1120cee5270c7bedecb2b7ad03bc66d SSDeep: 6:pb1XXB7tzu0ZkToU6WC60O46w3bK+cNuGzR/u1mEYTWt:pb1nB7xOoPA0Oe3bK+cPY1mEYe	... File Actions Show Properties Download
C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com	0.37 KB	MD5: 0784f81ad92450cf08c6a8d91c588cf4 SHA1: 869bbd02670a2bb87e5b73811778105c6ea138c2 SHA256: 7b2654ae57c9f78e9b98b43067f32bd521b8761132e0c978afe603688c16c5c5 SSDeep: 6:oLhngjtkz57aKzIxL6SpifFsJy6WC6WxVYkJNbK+cNuGzR/u1mEYTWt:olgxk7aKzIxmaWe5AcvjbK+cPY1mEYe	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.id-B4197730.[bitcharity@protonmail.com].com	0.83 KB	MD5: f5457bb10abdca217c6bad9b2c28f516 SHA1: 4070c6fca92fe02b1ad87341635a8761caef5d4f SHA256: c2490660e2897b0fca2d163065b7bd188c5e6bf0ca01e7bb5f23119550774705 SSDeep: 24:IZaKdOGvFSvcgg5hI4ibNKcsJm5cfKeH8lcqHsTBr:gOGvEcj5+TnsBl8lcqHs9	... File Actions Show Properties Download
C:\588bce7c90097ed212\1030\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	18.09 KB	MD5: 1910ac0e04796b25b6095395bd94a017 SHA1: afa2144f2b38013299ca00eb81db8b3c6b7538a9 SHA256: 768c3a059acaef6488f16f5becf436392d2ca26b0cb00bb799233d74a607bc12 SSDeep: 384:kS0coh6BqITUVXSGJy4BxboaQlR2GWlvSOh1QEox3PIs8oad+u27O:d9TUZae9Q2G8jhv0Is83+u9	... File Actions Show Properties Download
C:\588bce7c90097ed212\1025\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	7.61 KB	MD5: c4a78bb4579900de238cb383e2822191 SHA1: 34da5144390e6aa791f52328f2d5f990906f28bb SHA256: 0ea34b694c7540ff1db358acbcc4a1cc25438acd2bb07f23070f002f2e813983 SSDeep: 192:K9Rfh4Gi52Iyx74h48Ujb9UPt3F8RucOrXwU0+nR:yhiUDRq+pUPt+mTwU0+R	... File Actions Show Properties Download
C:\588bce7c90097ed212\1028\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	14.09 KB	MD5: e7e6256e3046f6ed82c8da74d27a8ce4 SHA1: f2377d49bc267d34ecefcd1e29f10dd1abe88f1c SHA256: 77ebdec2810d63c7c2fac91fd5e0106a05304b02fdf12a7e400871c8439d2cc2 SSDeep: 192:sTvqr5ctk3P9v4TbcrCHdMcbOWF5D2rC3A6yrrc1g5jihOjHFscBfFzDojR2beSS:sTyCtk3msrydMiOaD/A/8grjlssf18B	... File Actions Show Properties Download
C:\588bce7c90097ed212\1029\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	18.09 KB	MD5: f3ea89d356e4dab7c0c43e9169a846d6 SHA1: 3cd9edd156ac5dacdf3adf36e0014a5e3b173d0b SHA256: 4dc11850046e1941c206ea21ed319dd0995fe0e55b68bb4dae5fb1c3231631e8 SSDeep: 384:l3/Q8nrCbXHfLZLBBFFQ8gXrS1OmG1c8IGEx/AkoOOxBG4nS46RS:lY8rOX/ZBvFg7SOmkc8L1koXnS46g	... File Actions Show Properties Download
C:\588bce7c90097ed212\1025\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	72.72 KB	MD5: 6a8d34528c4f16c6577e96237674e6ce SHA1: 163053a244a243521a0757b5511840aec2d900bc SHA256: 7c26c8c8c6625a00f312ae323043c3292c30006d6b7bd408bf789d8937a22049 SSDeep: 1536:g4my9FR3RcqRjiUdSnVW4dxZAsTeQhdcIgba1a1x9zyQVheE4gmgnJ5l:nf/cKjihntfysSQH/Jo1nzyQVxmm5l	... File Actions Show Properties Download
C:\588bce7c90097ed212\1031\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	18.59 KB	MD5: 04029a61de27c3feda4d0be814e097fe SHA1: df57ca69a5dab9f3fd036ef452e40b7538e51ff8 SHA256: 86bcd5673fecb47c4d76237d015c37f18f76da78d908eff1cd5f637ee13e153e SSDeep: 384:46fUais/lLAAkENtHKzyAfnae1az0PE4KQUH8GMzz1cziYwwLAJ9XY3Pu0plFHZl:lfUaF/lLAAkEn031az0PE4KPazyuYFLH	... File Actions Show Properties Download
C:\588bce7c90097ed212\1032\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	19.09 KB	MD5: 9e7b78c63920b1a41ff01d36a057828a SHA1: 1f4821ae02de0c76b84bc6318f2b4941b986d555 SHA256: 6cadc7322c4554fb638d7597eb33009d897ba24f1d19e92ea780c0e121729029 SSDeep: 384:YO3tRklrKB28fbt/PTmGfzTyXHIxVOSqA8UNZgVl5yAQX0c2DKTjI:/kADfbViQiNA8UNZ45y9k+s	... File Actions Show Properties Download
C:\588bce7c90097ed212\1035\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	18.09 KB	MD5: 2d3f1dece27cd42531142ede6758e3c0 SHA1: 46fbea0d81435d3b806919d13b5b2aae70ecf2df SHA256: b9e244573ef607cf886b3c892ad6f6e88cd468380bed2e59b3728278162e3dcd SSDeep: 384:ryRV6v/wVFhHV3fAnIracIPAyOSC9LHE4FkPRPCN5iB:ryH6voV/VvAIrsP1OSCajRPWw	... File Actions Show Properties Download
C:\588bce7c90097ed212\1036\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	18.59 KB	MD5: aed9ae23e497030024a35aaca36fa617 SHA1: 2af943718eef2076090e8dbb43db9245437847b8 SHA256: b05465374ae44e847005b84c1ef418371d9cce755fd1a0957e97b46510a2147f SSDeep: 384:e79dcRDuL16hKvko90xvU4PEIP6wnRiVKHvGUnmDfG7gdB:vDuAhEko9Kvz8wn0Vm3/w	... File Actions Show Properties Download
C:\588bce7c90097ed212\1038\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	18.59 KB	MD5: d78237a666d94dce8a417a06a745d2ab SHA1: 7c66bf7c6c36d8bf8439b703297418dd494128fe SHA256: 8a9850128b34353347cff8311d34de19cd4283597a6d5672cee9d7f3c2daba08 SSDeep: 384:OYZ5hPkF1xIJGQ/yqLXdB/yXXTEPoqRSWrHLMZ29THVz3lCoZVFJIf:thS1xIJV/yqLXdB/cjH2HMZMTlxvzW	... File Actions Show Properties Download
C:\588bce7c90097ed212\1037\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	16.59 KB	MD5: 1f97169d3f9ab34bbebc014f317ba465 SHA1: 0bdfc4144eafe15a1768a0fe679441396f90bd73 SHA256: 5ee04b75c626e3285331530c6e4ea398b233fb1dbea0f94b4e53b63569c79299 SSDeep: 384:euPch1HGwUxttBJKFzxJb526Qx1LBh0eS1pM3RRb1ruveUSOk:evhMw4XBctJb46IZB6/vM37b9uvTk	... File Actions Show Properties Download
C:\588bce7c90097ed212\1028\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	6.39 KB	MD5: 3b219730c99778991cbc63edc93707d1 SHA1: b89ffd2dce7f3e84f51c77fcdc34ca9c310a18cb SHA256: 782e353c5cd61c88af4512188f0ca4201b1a4e89786d00ed7dc1fd3cff18ffc2 SSDeep: 192:EnHK6QhLUouGz2rjqVJ3CCxSJm7HwkStEEuR:EHLILUoNz2rjqz3dxIiQk5b	... File Actions Show Properties Download
C:\588bce7c90097ed212\1033\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	17.09 KB	MD5: b2e509bc22d020cdc5e6f9ac657fa1b7 SHA1: 9863140d5e68f0a308234e0f54acd6b894c2a2f8 SHA256: 144d99a7ea8f0724684e8f7224218b19e134e9e29c272d800a2b758a25cd02f6 SSDeep: 384:gY0qxs6wePNbWdK2HNlbCPYEorNjyS4agclGcNV3W8ZuR9RjhvM:gfqxs6FSPNMc9glclDVBujRlM	... File Actions Show Properties Download
C:\588bce7c90097ed212\1029\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	3.86 KB	MD5: a229465c2e90f1a96cad3cb5e1f4950a SHA1: 1b8fb5c40f66e08723b1dcb6b9901acc45fbc444 SHA256: 29e24f707f8b2f074a7825941f1aade3e1a1f5f4ed2df65661eaae73f2150eaf SSDeep: 48:hNbyRjtdxbb577+WGsXzoxmKx18tyhu0HnXes00qjdFfvPTbV3EaHsiOxy71xtMv:hc/vus0B8YFXeuq3fvej5y5xQXwyae1R	... File Actions Show Properties Download
C:\588bce7c90097ed212\1029\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	79.32 KB	MD5: f89b799aa49c38d30381e5bb697f7f49 SHA1: 0198976a361e7e64a0fc180be87d77239f54cb68 SHA256: 1c27a19be7bf6d4574a4a115ef8bb263b2090677f42d4158dd0b1b000fc45be2 SSDeep: 1536:9pYpYobF6+2oxth3S75lG9YiLguC9I4m5RwvCZ8x9A3hs24x:d+4oxvS9cYDlCwm8xSs24x	... File Actions Show Properties Download
C:\588bce7c90097ed212\1028\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	59.65 KB	MD5: 482f41b4e530ddec44946c7b7c139ee9 SHA1: 2054fb4432d3d6a5e53805bf06bcf04ed4e34def SHA256: f1ab61f4cb21d5794d8d57e46062696c7f54f3f91edad0e646a5c02295787523 SSDeep: 1536:0iQX1OOtv3/bMS/mHcNhrFP01XbA7o5Nioj7l20VEWm/QkXtd:0iRs3VTHZO5rhfiWiQk9d	... File Actions Show Properties Download
C:\588bce7c90097ed212\1025\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	17.09 KB	MD5: 9f1897a91d89025b7d1e6f9a755d9a32 SHA1: 7c38b42afed1b5d09cab467abb558875681ac29c SHA256: 02602d943b6c8298e576adc88558fc34b3fe524440cc4cfb9ce8ae086457295a SSDeep: 384:xtr0P3JLXrIB0edqPFhQAxxmEXeFkk8PSKRAVFKHXuece/tIs:rrI1hQyf+kkaooXuep/tZ	... File Actions Show Properties Download
C:\588bce7c90097ed212\1030\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	76.18 KB	MD5: de32b424affab1ac604d217d5cd2d19b SHA1: 8f6b9277d57ee2dc52600855104ae74f07bd3b61 SHA256: a630e1f5b17a3b2d4c33e4b4d2822893886064b115aa7569eae2b2c98574ab02 SSDeep: 1536:kqD+EJK0dNDrRQ5Cfotg4x5DtJ3HVEUdjIMNq3mtPwHWETEgjdjt5cEgBTr:v5JK6Drc7tR5H34UPeSgJZgF	... File Actions Show Properties Download
C:\588bce7c90097ed212\1030\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	3.47 KB	MD5: b2208799f8ccd6a33f9821c47c5e0f45 SHA1: c4d0fdc69c830d30eca23e7f922eb8bceffc4cb3 SHA256: 19fc6a7216216b13f9db383620503ee8246c9158eea60ee743aa33eb503be268 SSDeep: 96:VCRIIiscibYUT3ckS9S40i4Byf9GHAaH1R:cPz/7S9S4X4Af9GgaVR	... File Actions Show Properties Download
C:\588bce7c90097ed212\1031\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	80.66 KB	MD5: 8118b9204b751243054b5622f20cef5d SHA1: 95186c9fe9ae82f8243dbfd4c2cc1ae6e83e5583 SHA256: bbbc13ce911807c688a245ab12715eaf6d68addd6093a42194826b15a5ec9c58 SSDeep: 1536:zBBMzL+wy4REE2T/0cVG7oAHk8P4xzjHPHpsODFv5C9pNhV6jQDdCLpOTrT:rMnpLEXT/0R7PAzjHBXFv508OTrT	... File Actions Show Properties Download
C:\588bce7c90097ed212\1031\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	3.57 KB	MD5: e0fc85c4f35ed290dbdbe83705a96765 SHA1: a7e0796063cb2e76036ec3c4afa4635a3723e58e SHA256: eb2644ddf50b8220f2171dc0008b931af8b3aa8df4ade5a56b89da43a5e48ab2 SSDeep: 96:7yMdNey4Va4wFI+SGbbYxw0+3/lU38E4yiRrOYkWezb1R:71ey4Vo++Sobcw0Y/U94y0xaR	... File Actions Show Properties Download
C:\588bce7c90097ed212\1040\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	18.09 KB	MD5: 853b517c6e4f89d3aeb270c9bc57b83b SHA1: 3af473235689d4260b3fb117eebb442fbd983abe SHA256: 0f551a15a7e7f4b88a75fcf58136f5d4fad620e5e360008d08c5253a60a01018 SSDeep: 384:qD3QBqzcs2t7AtzBC0adMpl5wCO4mVLbfh/Ul/ulf0Dqq4/9H:I3Q8zq7gz0rCIpJ/Ula0eqkF	... File Actions Show Properties Download
C:\588bce7c90097ed212\1041\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	15.59 KB	MD5: 091fc101bf3838893d1557bbba4cabfb SHA1: 47e55c8e320b9023b2c16b2e7c89de0943f03205 SHA256: 1e71b6192742f844770cc6218ae48c5f9f98dea36bf424f8cf79e5f8a2ece876 SSDeep: 384:4idmT3PnoCMdwY/7zwYZnI5qNwyHCBCPxJPaf:XmLkdjzlNI5NyiBEJU	... File Actions Show Properties Download
C:\588bce7c90097ed212\1033\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	75.68 KB	MD5: e03f31d4be938897b430d887a93d49b2 SHA1: 5a7d44995fcededea07c95a785e0241ab56fc05f SHA256: d6fcfcbf48990aa427510daa6c5e1b52ced3ac3a31bfb0d932c904b59bec16dd SSDeep: 1536:XfPkGs3dOeyqCYRzXCaZ/3muetAVpInjA+MiWW:Xf63dHyqCWl/wupInkxiX	... File Actions Show Properties Download
C:\588bce7c90097ed212\1032\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	84.51 KB	MD5: 9ef7043ea2dcc8c72d2b4692eea48693 SHA1: 7b04d3aedec5b4367bd1498da96ddc7d7a1f6475 SHA256: 91c36204da1386d2ee56de1bf04e81d1482c36449ac65050aef0f748c2f82234 SSDeep: 1536:v+7ir4SrxwBkkQ2WvAtaM1kkCEVuntme387H6uBswZ0xBQ8jjK3cDKxSR9b:vucwBkkQ2AAtajXjntmI8r6uBswZ0bjV	... File Actions Show Properties Download
C:\588bce7c90097ed212\1043\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	19.09 KB	MD5: fd1ff2e40dd1d2301391de22d22737b1 SHA1: 339c1e973f5b94304ff48ba256c23ea9e8b09202 SHA256: e475de672ff45f49e9f4fe2ee2b62d1a8b4c3ab86317f113180bbdc6bfd295ee SSDeep: 384:oBbkVr8/+ZjC4t2aPnNGMHcPXjJc2GGIVad/LVQ91toUaemnd/aa0hTyoUpFSY0v:mcQ/+k41vMMHcPXux7aZL6iUlmd/b0hH	... File Actions Show Properties Download
C:\588bce7c90097ed212\1032\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	8.89 KB	MD5: aa3c161692c98164c5c613fd797df43b SHA1: b45e4431d42646ab9188836530db1f790af7c9aa SHA256: de550777f04e23579a320c11969d855635248670b0bfb0d0ce602c5b7d73f861 SSDeep: 192:0D5dLYoTZV8cOlPwioNw2TyyurSkq1nOjF0q/jZoLvEmM2v/eLy00AJR:U5PT74I5w2Krf2nOjFB/+LvEmM2v/c3R	... File Actions Show Properties Download
C:\588bce7c90097ed212\1042\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	15.09 KB	MD5: e461a8fabe4229e5d7d59f53e16faa2a SHA1: 259c91f3eccd0ea61d05638715ea460e5f8f97a0 SHA256: 52637391106e53825231f60a6780ace7df8ca0be02156ba93bcff72d842fb9a1 SSDeep: 384:f17qAiPLUNfLGBMVtzgyAb4s8wILxA8vJPiG3tI8Eciu7:VqAiPLOLG2VC6wILxAkJv2ciE	... File Actions Show Properties Download
C:\588bce7c90097ed212\1033\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	3.35 KB	MD5: 308f265bc7ac1da309eba3a068e88845 SHA1: 59a2421f8631ba623d656e15257900fba4102554 SHA256: fb70954e4372f8827d5b1580a5705fd658daca2ab0483f938fbdb0b87c6773a6 SSDeep: 96:jhVQNWDtuNtjK8VsO9FrSs3TAsOgAjqp+4v81R:jh3DtQe8VsMFrSs7Pt+4vkR	... File Actions Show Properties Download
C:\588bce7c90097ed212\1036\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	81.27 KB	MD5: 4ce5bfe6aefa4be8497ade72822a9a88 SHA1: 01eaa6b7be50c708e70057c762b0e23f833bb3be SHA256: 3bd333449b629b3674332cdb6b150ee3fa52bde58c72889c127c76512c630224 SSDeep: 1536:mUDTCVEPYT4AscCozucXNeiviMrM+n5ord6n8X4o6y9ZfEtoa74Gq3TmdZN:mTVLxDdeiXrM3ao6y91EB7NcmdT	... File Actions Show Properties Download
C:\588bce7c90097ed212\1037\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	6.93 KB	MD5: ef3a8c3ccea6f5e6bb3db72622c5d1f7 SHA1: eb753adf6821683255feeb2cadeb8a27e5a3068e SHA256: f5d2b052162e645f756cf727afc876f1e00f74d2003c7c0c510cd3fe93a4d405 SSDeep: 192:sgfjEiPRKu1ZjNph9JzBzrzkMABjHO7jIR:nfYi5KaZ39tBXzkMABLuS	... File Actions Show Properties Download
C:\588bce7c90097ed212\1044\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	17.59 KB	MD5: 1cd32003fa50cea41a258b619fcfa95f SHA1: 406352c5d8090817a0d6b36db42d9dc6d808d555 SHA256: ac4a097781ecdc27a75bb8da91b42247fd20a2a959085e9e095b8438a5048e9e SSDeep: 384:ZWxkS/RyWOCSoMnLLC4Yheod5DW3qD0zkfwMhr2agPoJxYahdDGiOE:ZWEWOnL1obpD0zIwexgPoJxvDF	... File Actions Show Properties Download
C:\588bce7c90097ed212\1049\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	18.09 KB	MD5: 4369a58b94898d2467a237d6a986b042 SHA1: ed2c210e76dab0df93f78251bac4ffd49d1e1ecb SHA256: e112dd6977dda343b64425c9207b2ab509822a9da8e62c39729f16eac102b973 SSDeep: 384:KMy3ZJoQcoA7hMpizJyDQEEsfENXAJ8sPv0ojgkiVXcK62r:KMMcoUKcyXEzXAWGJgjcKF	... File Actions Show Properties Download
C:\588bce7c90097ed212\1035\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	75.46 KB	MD5: 303553811f28e555ca8ebf82a9b37287 SHA1: ce93a0af298341e3f4ce441d29ab8a5bba4981f0 SHA256: 07c315f20c6ed6093a23aa795480ab951d6c943c89ca3c127f3baa3a1afa4b83 SSDeep: 1536:lmqxfZPiPymloRelhW36ZIDUs4++w+UTmgthuT6obF5GZX9K:nBP+liOgqZ2Us4lOmgjuTbcNK	... File Actions Show Properties Download
C:\588bce7c90097ed212\1037\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	70.63 KB	MD5: 6c3671fe2bf7149b79688a8fb8e98dea SHA1: a9bd7895f7aa539aa3c6c8eadb7eb8842441be7a SHA256: 93eb66fa446e452093f5b9c0ce166e580685a03a06d9e4fa506a9c6cae382d33 SSDeep: 1536:PThQc+igTfMKoW1KaZxZ/oB5JR/I398+09k33P1AVqLUNVnxYjvhEaP:b6LVfMy5/Z/oBzZIekP1AVqoNVnxYrhX	... File Actions Show Properties Download
C:\588bce7c90097ed212\1045\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	18.09 KB	MD5: 127e2fa3d1cb817d26697d2ff7f40f6d SHA1: 6f1d62d3e5eb4face2427fc23ba134e7c9c21a74 SHA256: aecb9f527eb5a81c9660d97ebd971bc68be383bb0ba270ca2c435a38030a3071 SSDeep: 384:NabXP4pWP8BGf4DQBeyBshLK1yfQrXO11WMLEKJRLQB0KL2GcDXD6po2:Nabf4k+TmB912ztgERLzCn6D61	... File Actions Show Properties Download
C:\588bce7c90097ed212\1038\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	4.38 KB	MD5: d40c9d0a6b72987de21780a16de72ae6 SHA1: 6a3d376a3a92d8936709623bb44e586b95dbe922 SHA256: 8f6b0218de00c574747b8fcc9903b7a58ae33811dcc5630a2dcb5a233f7028ed SSDeep: 96:8UZBnITvGp8cCEr1/lgzlriBo8jpoRYmpkaJLjVLJzDHyEXQXaqyDnieIDWdMIGj:rvnIy+Mfsr34poR/XVL9rymRvelDWRiR	... File Actions Show Properties Download
C:\588bce7c90097ed212\1038\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	84.66 KB	MD5: cade0a9ab6bff8105232d45aa614910a SHA1: 9c0b96446f8db1dcee18fa5e394a33fc02d6428b SHA256: ecb8e82775e0b07587d3c4d3e94deb7ad9b8e2e7c3abed298201ceb0cfcd9bf6 SSDeep: 1536:78R6/87Z0+8dXhjOByaF/nQZBZOwgpn/OFGHiO4VaZkvVwmmQTUS1ig:w2+WhO8aOYWc/4VqtQd7	... File Actions Show Properties Download
C:\588bce7c90097ed212\1046\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	18.09 KB	MD5: 6f2f1e399026dedaa83d6e9d41798002 SHA1: fa0c534ee46ed825e5a4874c16ce7fa7266059a3 SHA256: 30c7781258fbbab6132edb46cc8297e0c41d664651d66f4f073fda4ee2953026 SSDeep: 384:TryJyrTP0cX70yoGC+x3LH38yTwUMDshm13BK3hT:TTP0cLkxiXK3ohEg	... File Actions Show Properties Download
C:\588bce7c90097ed212\1036\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	3.68 KB	MD5: 7d150afcf17935caf2bd788a0d053b6a SHA1: 91fea93395f2a540f33dfadbf6f021f27c856cda SHA256: ec097a6a62f24d885f04ff74cf660e1aeff585842ef21a438b2305de2ef9e74c SSDeep: 96:AT4Za9Gw8ihGaFnzz9LiAtJKY+RZHUNQeutO1R:uJ9Gw8itp9Li2MY+RZHveMaR	... File Actions Show Properties Download
C:\588bce7c90097ed212\1055\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	17.59 KB	MD5: d5d79b3f6566cb590c429203c05d3f72 SHA1: 514a57c3ade14ead9d9341005559e7da800b5e8b SHA256: cf102a9f3c739a23556b5d6727ca2458ee8a28550927ebe35f3ebe6407b52e8d SSDeep: 384:lBqkZDxSsQ8YoN02GmY5ZpGOciwUI+hAo/2h16P3PqpeouiEun4k8klekF:lBqIDxHYo67pGOciz3V/TP3yEpk8kD	... File Actions Show Properties Download
C:\588bce7c90097ed212\2052\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	14.09 KB	MD5: 6f4b365307e2e611deef74f963b3c1c6 SHA1: 0335762fb483391a7ca5210036040887cb1f51e3 SHA256: b35c0f52d6f11571ec88a429071444193f4f55bf679910491668ac18235f947c SSDeep: 384:wbBgx5m44Z7O1rluQrrDQZC6/sU/UAGxp+2IbQGkT8GjL1t:lxEdor0d7UHp8KT82/	... File Actions Show Properties Download
C:\588bce7c90097ed212\1053\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	17.59 KB	MD5: 8eb2eb9f56d3750a4997e827a5ffe6c6 SHA1: ec635a4b006b62fe07d4dd7b12f77ca8cfe219fe SHA256: 53736b0fc889b96c8b86c1853cbcdbb762046631ae5472e119cb3950c554fcc6 SSDeep: 384:8rBDyDfLRsFxpLcVSe+ilFy720Tttm8B6myjtfGh+WJSDIN6psV+A:8sjRsFxJc+i/49Tttm8BcjtfY+sS8EpC	... File Actions Show Properties Download
C:\588bce7c90097ed212\2070\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	18.59 KB	MD5: 346293f2999aac87f03bb3299b8415fa SHA1: 71e2df196c33ac7c30e5859671a98617baf6a2e3 SHA256: feeb68ef4c9d0457489de7965a212031d4128e618c63debb89b7b9668a684d11 SSDeep: 384:otFd6bx9jA4/6dCgOWabihqCcuky7aXuUaZMfiC:otFd6T2CgOW1cuaXust	... File Actions Show Properties Download
C:\588bce7c90097ed212\1041\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	66.88 KB	MD5: 71a2eea5cb8bbb662a7fd5e38cf3d36d SHA1: bfe5b905f90cbe2b22e46516097ec06867475f3e SHA256: 9599b3213417fd0b20e3363d93953b3b98355d6b3bbaad9e59704c34f0808d6e SSDeep: 1536:U3M6pNSqHznmXtaopKSCyue1WrrtHg/M38sM0NnOCF:cBA0S150tHZ8CNnF	... File Actions Show Properties Download
C:\588bce7c90097ed212\1041\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	10.11 KB	MD5: 95aa581436d84943684c1e28b44c7c8c SHA1: 122ca7e50b5ce4b63b25ba63e26ade70114a6663 SHA256: 1e3b62070788e5bf15298c7cc6c9869c964f93e8c150a9451c6e094e2246c78a SSDeep: 192:D7MXNm27YGwjUvckRVYNmxFOhYq90zvYkxTbRTjw3oNJS+OIcEc5ojR:X4UGUADYOF8Uv9hrNqII0	... File Actions Show Properties Download
C:\588bce7c90097ed212\1040\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	3.79 KB	MD5: bd5aa6baf3b5ef094912b510d44e17a6 SHA1: f5451d13c73ecd01160dc02a7c60adb1cd483405 SHA256: f6db31d2acb90041a9267a55fe166c119c1839e7ab727118296e5be5b0df1b23 SSDeep: 48:7mECDQXbJNzg1zDC93JWuONLhzKrb68Kr71N0XcWT2tzUbCf7YQASfLGDHKkB9+9:7CDQrJNMfU309LMrq7IReUb8Aetkmh1R	... File Actions Show Properties Download
C:\588bce7c90097ed212\1040\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	78.43 KB	MD5: c28df06fd14c72257f560f3f2fa02a93 SHA1: 01b8c60f7d4139f9dab458f59f727e29ebcadd1a SHA256: 742fbe1d0b7f32c7ab7ba597e3f0719f46ff551d99e2e70c56134610e97f4bb3 SSDeep: 1536:W4XwG5ZHgXl9aLmu6MI0CzsYN6MdfBudkah7T1L4PBHt8qi0Sc:LX1AIP1fYNNXuFTp4PpCQf	... File Actions Show Properties Download
C:\588bce7c90097ed212\DisplayIcon.ico.id-B4197730.[bitcharity@protonmail.com].com	86.71 KB	MD5: 56e6775a585750a258d249cfdf64d65c SHA1: 379b2eb0683626cfbf979c31b05d85222d1ecdc5 SHA256: 8256deeff77ff70162f5359fcd8350559b4684c747294c05854235ff463d4835 SSDeep: 1536:aGsxhsz2y/mrOP+7o8HMK8AtRnyM3K+lajTVx04VdpzzJRQo0JKqxFinVysUjk5s:a5rXCm8FK8qny1Jpx04Vlijics27	... File Actions Show Properties Download
C:\588bce7c90097ed212\3076\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	14.09 KB	MD5: dd3e340c3bd689e09ca20a34497d481d SHA1: 2d4dce69d55aeda33196d8d2f3982b16a2a79215 SHA256: 21d334f25123edc3dba706f889b4a89c9985c17a810375fe2e95a8310cac6c03 SSDeep: 384:ZTuQf8kFhOPKOSorsqpqLsoBSlwQcjQbvbZwTq5JQmXG:JzkkLOiowxsoRQvbvbOI/W	... File Actions Show Properties Download
C:\588bce7c90097ed212\3082\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	18.59 KB	MD5: 2c640d05e21a1b1fb0a4aaed3755338a SHA1: 2d48639f65290b5c550178ea975279ba4bf656ad SHA256: 0466fc67cbece133584d77f34741670ad10112e387319c876bed59840433cc48 SSDeep: 384:bR+ZLPxAvt80/rY3qgjECHpznxAfF5CMT4201xPSTZ/BdxV3H+zWCs:FGPxASar/gj3XEEMM2K2ZdqzG	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Print.ico.id-B4197730.[bitcharity@protonmail.com].com	1.35 KB	MD5: b967a4e89c7bc2c25ce4227a9c8df3da SHA1: de5fe71788c1db936d473aa7b906cadc6474f8b3 SHA256: 9d248af3d07f0cc5cc1d0d4653dab9fd8bf3b597b19aec4c716ac195dd141788 SSDeep: 24:+MotePO7KuqGgy6ydnb3TFI2oLjgfxYapeFOBtMGcA49pq0jZe3ftHsTBN:+heAglIn7TxoL0f9QVGcAAp7gVHsb	... File Actions Show Properties Download
C:\588bce7c90097ed212\1043\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	78.02 KB	MD5: 24eec1a9051202c66e12f3f0ec2e58f2 SHA1: 6fcb5ac18a631caea106dd28dca937ffe04d0f20 SHA256: 3c1092f5a747057283e30afce283c25b8f484298cfba079ec2885803a9a1ffef SSDeep: 1536:56YgpOdk6xtl+Y8vSAD8Q4iigEdo25bcCqblSgLee8BPDas6CDqayhpy:cYmd6xg58piYdo2IbogWgs6CuayC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1043\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	3.69 KB	MD5: 740147580e21ac3ca67d60127d78295a SHA1: 4c24100a7a69519587741ab5871c6a29ad6b1472 SHA256: 6f29df792595793a4b534af6a5a817038d5f0587c2fc771bc377bfc2accf2704 SSDeep: 96:B9LASlhQaSNVIAtZiqcoXSI7VzilzFig1R:HniVIAtZystK4gR	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate2.ico.id-B4197730.[bitcharity@protonmail.com].com	1.10 KB	MD5: feae0492f6aaddc2dd742880584e4636 SHA1: 2ce988cf017df640a621e02fa22e56b60984f8bc SHA256: ce915abd73518c4e546782e43404411378f29aa958de814f80b3adeae9420927 SSDeep: 24:d0kFR1g/LkptYcYtAnLjx0fxo0ZuWyF1M3yE7HLgHsTB5:bz0AtYbc041M3TLgHsf	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate3.ico.id-B4197730.[bitcharity@protonmail.com].com	1.10 KB	MD5: f2ddfbcd58e1242cf47187d9153fb65d SHA1: bec6e3399a37fa3f34846c1a1b6de0af43187c7b SHA256: b7dba6c4e366fe20eb5a5f53d463ae6e992d477f689cd0935409ec660ef4e254 SSDeep: 24:JYs5TO9KBZ/j2YLP2WN/kP6EoofiZ2RplKPY0uMGPGjE0myic/HsTB5:JYsn7/DLPoPfoofiZeplKPY0uyjgc/H0	... File Actions Show Properties Download
C:\588bce7c90097ed212\1044\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	3.21 KB	MD5: c9d351467c77ced471ee8758331dcebe SHA1: 3c3ecd7a9bc75e811a9e95041b082a8363e4339b SHA256: 23605fec1db54eaecf438b049e607b7d63077cfebf9bcf1d6ec8de8b642b68b1 SSDeep: 48:F/Yget77vKqF78asae/s/jDkoorwROlss6SFO0Ipce4Tk4/qUstr3mHX8g/XdYUa:6ZVbiIe/Il9UlsHnFtTm3vFjG5wh+1R	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate4.ico.id-B4197730.[bitcharity@protonmail.com].com	1.10 KB	MD5: 652a1989ca12ec199c51f394922bece8 SHA1: 9b4f9d7f766beef1c9556fa3085455fd8a5ac2ec SHA256: 832bd436a016514544f7ca2d8d7b13fdd86720a58685ff83c6aecf8862174e28 SSDeep: 24:C1NDtWP6Uyj6DOzGhBpD1MkGhLMhKQMRoXP6GjCB0iVZj4HsTB5:gDoRwGXpBMkGhLiM86uUFV94Hsf	... File Actions Show Properties Download
C:\588bce7c90097ed212\1044\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	77.69 KB	MD5: f3e1758112e90adc86d6f3c5f1a9d198 SHA1: 78c9008ae505c74f7f9d121ebba0e82e455d3295 SHA256: 2cba40547d82552c0d0dfbfcff9c29e892c9168e0d14d59691515b097d27a985 SSDeep: 1536:jbDBCXlILhwXHBEPLjY+gDnwJ6s3liQCcqGViDRM4CRb99xyRD2YaobVCdWBsuOh:XQVILhwXyLcDn8RCiADW42JryRJtbod7	... File Actions Show Properties Download
C:\588bce7c90097ed212\1042\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	63.96 KB	MD5: 8d96130070ceaab1514bca409ece7d2b SHA1: b39038fa56fdd8c2de7293774c7066fa91647321 SHA256: c8879a7ea43c8de6e0a8c753ef752f19d4938a1accdf276fdf568eca7c282e9a SSDeep: 1536:fpGA+LhV54f/licr/hfxMPpkw8IcbEGpjN1w2G67Ng:fqL14f8cVJKV8dbEYN1w2G67Ng	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate1.ico.id-B4197730.[bitcharity@protonmail.com].com	1.10 KB	MD5: f12c614cdece39ca548f69a74c74280a SHA1: dfb9eb1fab055e1b2913af9462a400b66fd0e127 SHA256: ec99bbe1670db5490b0c7d044eb4b2a509688d04a2aa804f4bd446f11fcc6707 SSDeep: 24:vUSvdmA3aoyMx3rVu5X5Q4Y1mysXnvJ0cEIZuHsTB5:rFmuJu5OU9X2Hsf	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate5.ico.id-B4197730.[bitcharity@protonmail.com].com	1.10 KB	MD5: e58866309671b253681f5bdf6801f0c6 SHA1: 7e740e4b7746dbb3a9aa55ba93cdd7ce16847bfb SHA256: e56200db2bf844c4d4af31c2fd8d4500b917b6b69ae35433a46ca48640221c58 SSDeep: 24:iQ7vFeMCldEfuRyH7Uuogzyz91Wwb4rWwAWEz/HsTB5:iQzIMCLRsxGh1bYdUHsf	... File Actions Show Properties Download
C:\588bce7c90097ed212\1045\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	4.18 KB	MD5: a460fa90e3a939fa59c0761c5fbc9a17 SHA1: 8dbe9d2f123e77677a5e850b75c1116b39f17f14 SHA256: 339f647cd517757c767f434a3e3c0c26cfcdf7f954f959df0851e700c9d4a78b SSDeep: 96:SI2I9Gf+Y2Gxd3FZicN3h/KTTIbJzqgfgZjY009ZMuB1k1R:X2IYf3d1ZicN3hYk4K4jY00WR	... File Actions Show Properties Download
C:\588bce7c90097ed212\1045\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	80.69 KB	MD5: d31ee833a3dc3f0df5b7d0ddb3b5b1bb SHA1: 3401d8ce5d521808857c375f7af767704a2aa265 SHA256: 188754174cfa1fb36500fba7d1f1ab3e1df3f79151bf4feca0a4ee605337298e SSDeep: 1536:uIIFZPMD1UffI+TH2OQIHKj8mzcrPy7gzarY+5QmZsi9zhR9pM2pWgJL1vcX0o43:uhFQwIpeBrPy7gzarsSzY2ogJZvcX0o0	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate6.ico.id-B4197730.[bitcharity@protonmail.com].com	1.10 KB	MD5: ad99691fae228e1618d9627c12e437f1 SHA1: 7ca5b5d4bc37334fa238413a856ef4cab97a5e7c SHA256: 1d18004f912effae66babb7dbf220fd922ff198cc67c5b2754df23facc507d36 SSDeep: 24:XSauKZG3xvBVfReH1+yTPeGcX0MPEJW2YXHsTB5:dZGpBaHsee3N2YXHsf	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Save.ico.id-B4197730.[bitcharity@protonmail.com].com	1.35 KB	MD5: 2164bebf9e4f08023c6fc9156d62be9d SHA1: 73d4bd94ee59a5ceb5f296747ada598cf05c9f4b SHA256: 41766fefa0d56969f47af9889f28e96c12ce8b2f681547c9e446c5881580b5f4 SSDeep: 24:cQxbzEEUWlifdm7ElAishFnZV3Q3lAuQ28lRrHsTBL:c6zEhaWdwEshBZxQpIrHsd	... File Actions Show Properties Download
C:\588bce7c90097ed212\1046\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	79.10 KB	MD5: ba48eca8d12032bbf4f063a8e8bed26f SHA1: b30518df01bee42404f936e4a4040a4cba828221 SHA256: 8ead5f10d8141c60f64572eac5f19374a39aaf01d696cb0b3daed97521f81244 SSDeep: 768:5nbZ2YvO3vEBfPpketk0j6+c6MN/TbXvkNB7OnvA8sla8ARurDST8xVZo1SoMTvi:xjvOaPdw6y7Gqb0aCukZo1SDv5RSn3p	... File Actions Show Properties Download
C:\588bce7c90097ed212\1049\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	53.41 KB	MD5: 11a88eaa9225991466b1f68783804974 SHA1: d1f428a7ca3b40ed8bfd9cfcecd3322d453bc6b9 SHA256: b5730843ed933d0062b2a8b8aac5387ed7c485f8a760fb716ccc3c236ac82dbb SSDeep: 1536:LkwGaGG2PCE7cytZwatdRdEXK+RbsAj/g:hBKCe3tZDyaYy	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate7.ico.id-B4197730.[bitcharity@protonmail.com].com	1.10 KB	MD5: e324a1db84950d185adb6122fef047d2 SHA1: d080dd79acc281a9d09a79becc1da347dbd98123 SHA256: aea70e3405224beef69694bf0dfad1dcb10a26af2f056044e6aabe838cd28bcf SSDeep: 24:AWi/eR0BbbNNR8QaVUnQiylhFNKLSlIMb8cxtOTKYHsTB5:AneRIbbN38enQicFNKLfMbtOWYHsf	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Setup.ico.id-B4197730.[bitcharity@protonmail.com].com	36.08 KB	MD5: deb6b92b746d2e3e4c322c7c231755c7 SHA1: f5b702fa45982e4a0d8f19b9e009378db146afaf SHA256: ef1a039598716cf1fbc720636c6fb0dbf415692a56373d9bc001b4f484c21579 SSDeep: 768:6/o+UyUmdLTXzlHg/y6vG0bYmYQeNANFwaRyTyBHtrm9kVynHZ5ww7ktdwZm:6/3NUiT2/y6ukTeGFwaQ4H+kmTwAkLws	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate8.ico.id-B4197730.[bitcharity@protonmail.com].com	1.10 KB	MD5: 5829388f6419bd65e94274341a9da321 SHA1: 780cc5dcddc0665c216ae7128d4caa77008e9703 SHA256: 91b8b40320ba6a4956c8abe8918d3f184a664fa0bf4cce253db20a69b1a95107 SSDeep: 24:9W6Y42QaDK/NJzi/dNwl6CqEf8IBD1MozH84HsTB5:b2KVNi/ds99fN5Q4Hsf	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\stop.ico.id-B4197730.[bitcharity@protonmail.com].com	10.13 KB	MD5: 2907462444e86ce7a11e9da954f253b5 SHA1: 50422e5e5f59ba7bb8eea458e483f068542172aa SHA256: 2fa823ae75879d9a9c528c497f249d6a0897d92716ec4bd179de05e21f41eb6f SSDeep: 192:msCH0uGEEiCrTf1v12/e1djAL/d4g+mTL7Zm1lR5sflet2aS:msADMTffr1d0L/8MRm1VqAW	... File Actions Show Properties Download
C:\588bce7c90097ed212\1049\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	79.82 KB	MD5: dc272922dd74e0da71ffc1872272e1ad SHA1: 2b2c03c0909d289fd9edac40acaeb00f991d654b SHA256: 5272a318b00b07e72b7d975c670641225a82de3e58d098cb81b5fe875f97d1a7 SSDeep: 1536:CSicl3tRWYeKntBoDfpMaDtP8QalVptoFTvcKXajimSN4BXq8mI+6KV:CQ9RdtUf6aF8LlVpswjSq485+h	... File Actions Show Properties Download
C:\588bce7c90097ed212\1053\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	4.00 KB	MD5: 1e46dc5a26f4122c792c6241c8e58973 SHA1: 63984c569f023f503be10bac3b470a1227d565a4 SHA256: 5ab216d4ed9f751b3e9a446f4af395d6ab8e48d6c678737ec09ff51f5871b203 SSDeep: 96:FnP4WS1mbFLNAJVxArlrxmWj3gAJXnvw+LMFf1R:FP4WS1mbNNA7xG98G3gIgFdR	... File Actions Show Properties Download
C:\588bce7c90097ed212\1055\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	75.27 KB	MD5: 4af4bb57483131bb85632acca8310623 SHA1: 3d2f5c566e065dcb49a6f217ddbe07b9956b1114 SHA256: cf2b5add0df3f4baf39c205642e927d374a8137469479179f10061fbf17f7576 SSDeep: 1536:xX+SLxUbcyQtTX72DBksev359MB9ZRqrlZIKSt/8dZBf2GF0FPTr046:R+SLCbGT78ksev33nXTSt+ZBf2GF0dG	... File Actions Show Properties Download
C:\588bce7c90097ed212\1055\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	4.00 KB	MD5: fbdd8606a7d7c961e1de69d3b20df00b SHA1: 81e1179adc63319353b589ecf58d4461a1f62ccf SHA256: ece43dad7c2a03dcda0cb8db206cfb139491e740fd5d29c0f2dfbdc14f6093cd SSDeep: 96:HgmppTfTGQsRrwMTA/qrJrsEwkzDtVBXRLbGoJl+MBZ1R:xNfTHGs/qXwkzDhhb9JwMFR	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id-B4197730.[bitcharity@protonmail.com].com	1.36 KB	MD5: 6796e0b212d2f65698f843bc261cb851 SHA1: 829b454d5b8bfd307e8592d5d22c272394b35701 SHA256: cbd5d3b99522f0743322cbb4c9ff18871177ae190cbf954e99150938bc9b2087 SSDeep: 24:UdU8lcPGXIs/qCvbZ24LoSp2n5bgIQJ7poJB/nXBReqHsTBb:/8+PGXIUqCzFL5yq7+/mqHsN	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\warn.ico.id-B4197730.[bitcharity@protonmail.com].com	10.13 KB	MD5: d48c759da46f7b1b0664438d55046666 SHA1: 28b844c2edd550190d57d4fb79b128ada75a739e SHA256: 1909901204c995ae17f3ee2862c57d7b398bb886cdc2ca558edbb4c01397b9fa SSDeep: 192:0wq27ibQFTMoA9pIaJIc7kJWD7ZaflK1bCyFWCM8DIkfxhyvRaJTkokOezS:0j27ibQJMoA9pIaJIc0W3ZafkFCycCM6	... File Actions Show Properties Download
C:\588bce7c90097ed212\1042\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	12.61 KB	MD5: de46c8149294f408d46688c1963b1533 SHA1: 13253d245690037c15950ef94dde9f772b626fc5 SHA256: 4e1a3ee3c067e11afa6410e81ab0fc50f9f043261912d551e17bab2ea1859d98 SSDeep: 384:T8D5CHfLfWCuvjHfgGZxYo+G1fbmzkgmST8M:4DudyjHf7Zj+GtigmTX	... File Actions Show Properties Download
C:\588bce7c90097ed212\1053\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	76.12 KB	MD5: 76971f34a2db15a95aa37090425bd0a0 SHA1: 8f9e1790ed3bf47bc6ac55bb464d958d09f89d55 SHA256: f86144c9c8a3d57b3d9f0ec05939b262df4a7644e2ea8e6219336dffbe113078 SSDeep: 1536:+P5Q7TITgahoXsuMaetcfZ+TSADXtOJSd90NQk/T/emYVZR/hbC5zHzJ:05Q+gJXGtWZ+TStSd9N2TVYVZR/NC5L1	... File Actions Show Properties Download
C:\588bce7c90097ed212\2052\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	5.93 KB	MD5: 1820ea4cb31d877c48b8f6f84cbdbddd SHA1: ea08ee686674e1f88fce2f5b64ca1384b7277ed2 SHA256: bbf85333bd83d2d9f42964357e1acd6106bef5ae1264f3c92828809636e67578 SSDeep: 96:8kxo5sRACRowD4FPt8tHhT4Y45SIsELoJfhHZLdd3BXrvzTeoeL1R:bxgsSCRlD45t8V54Y4S3E8JJJjdJmR	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id-B4197730.[bitcharity@protonmail.com].com	1.36 KB	MD5: 7c42f5e6055597addf2ba630a841bff5 SHA1: a24f2be05ec4e59c90a5c59d6a908e602db09165 SHA256: 80153df412273915b3b528e410c5986accabcfc2ffcb31e027e1b3cc60c3244b SSDeep: 24:YeQyVk0M2gsc6G5/jTxNQv5IhjRoW46nlHTBrCje0bcHsTBl:YeHip2gjP9Aihw6lzBmdcHsz	... File Actions Show Properties Download
C:\588bce7c90097ed212\2052\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	59.51 KB	MD5: 79d460b9830c9a752209838e6def3b3c SHA1: afd70909701abaf5082d037e6b8fcf5f0f063617 SHA256: f858a506ec8734ed97b1b6a412a326c8a7a95b1776b75d1ac7732c55102c6040 SSDeep: 1536:y2097WwLmFXo6A9dFuRMIGwr2N/n5TzuzYsYdj:y2SawLmF46A9eRfKTzZsY9	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core.mzz.id-B4197730.[bitcharity@protonmail.com].com	173.83 MB	MD5: cc75e7bda8993fedfe1a6badcf08dce7 SHA1: 9f7920f930c3874402c2d3c14535e2bdd1fe4eed SHA256: e104262286e666244be9b1244b073d074f316420ff783d93d664a93ea8c7c99c SSDeep: 196608:GV04YyKSBXZ35w+KBK2KJKDcloT46ooP8ZNoz+hK12RP1O7lT:z4Y7qZ3CwFISoT46ooP8Zyz+hm6Mp	... File Actions Show Properties Download
C:\588bce7c90097ed212\2070\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	4.14 KB	MD5: 72b3ce8ad6812a845948d80584a147c3 SHA1: 774d202795cf422fd1adb719e5fcf4d62acf431c SHA256: 85d0ac701bde6904766b768bb950754f9d48012bde9d3d13c1f47d46439d17c5 SSDeep: 96:5IYYgek/nlDLAfaVXtlPs4hvHuDWIXsPOKgjUt3BJKb7DdplOhjNy1R:qYYlgMSVX7P9hvHuiIXtKDJ6dplOhh2R	... File Actions Show Properties Download
C:\588bce7c90097ed212\3082\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	3.22 KB	MD5: 60bb0ff96f232f700bd4b7db15c19ac7 SHA1: 6469e62dbcbca116b7cb64c208b53431c800475f SHA256: a1fda2be88a003b0e7b2a792596915d39b112e626ceb6208fb5370166c9d7656 SSDeep: 96:M0i1Ky42VG66usKKk6D1PincWiZw3DKCh0w1R:MFgy44YvPicCTZ0wR	... File Actions Show Properties Download
C:\588bce7c90097ed212\2070\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	78.62 KB	MD5: 7d1c44f3660f8d1bfb29ee3676e4171e SHA1: dbd0d2b8c243aad9881fd2a16855fff41611a4b4 SHA256: c7b32b13c62730bae183b279b4d9d57ca8b2068cd538a59f86694925883b579d SSDeep: 1536:E2UwZUmHH2tiC0C01V4yuYH9dlvK+BV9qWlmR7QviS1ylDKLiPrXoyRl1CdNI0NS:EWZUmbx4kdlvPqWlcknQjoyZCZ0	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core_x86.msi.id-B4197730.[bitcharity@protonmail.com].com	1.11 MB	MD5: 10fe90651f14c71fa78c0bc85bfb33d3 SHA1: 3f087a0e7d5ef8c1cd9614971c8e667f13d1a46f SHA256: 8a2212bceadceae114b2b077f9716f26c2480c2e1284836cef699b031d2a642d SSDeep: 24576:CzQ3JtsvCJ8NoFgKyVJVebrbny3Nydplxj67q+Ta9OQl/Xj21OXgs:C8tnqKyJKrG34dplZ+Ta9OWXj2ps	... File Actions Show Properties Download
C:\588bce7c90097ed212\3076\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	59.65 KB	MD5: c8f4b14121a58f9be6c99aa674e15407 SHA1: 7349c88e071f72aa64e3808558d6e073663f02d7 SHA256: 9f2707fafc3d9929ff8a7e64d58425dc72af906453dbd579b0191ae6128e5316 SSDeep: 1536:1d1lf0ITyd/WUL2m0KekKc+O+iAojJME5Zu+YbjX5Z2:71lfdgZd0KvKwlbFLcBpZ2	... File Actions Show Properties Download
C:\588bce7c90097ed212\3082\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	78.37 KB	MD5: 91f73dbe2d7e2480a1ad30dd680772f4 SHA1: f5c1ba0c67e135b69b158f3906d61aea789c0e61 SHA256: c10b6b8db3301abeda744a73fc0a053e86c2ec727c01ad341f7c21fe3d4e9158 SSDeep: 1536:Qt3vRqCGhNGd1eVle03PDmF5aOZS7cONJbEUUSGIbCPe:g31GhNJVllbmwbXRUcCPe	... File Actions Show Properties Download
C:\588bce7c90097ed212\Client\Parameterinfo.xml.id-B4197730.[bitcharity@protonmail.com].com	197.32 KB	MD5: 4e58dd751b8280970dfef6a9df185ec4 SHA1: 80fa61cb7de65509bdb53a207b5a3ad4cdffe832 SHA256: e300f5c229e72bde446c26269b8cb407c07ab3d704b9f3ed9b31b5146e523bbd SSDeep: 6144:9To2iNyn0cs0tE2NSRlbiOnHwFmLre90nZR:9ToZI0csWSrnHBXk0ZR	... File Actions Show Properties Download
C:\588bce7c90097ed212\3076\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	6.39 KB	MD5: 91a7419aff4af0627637e6100a13941b SHA1: 3d80c2da24f263360ce84350aa2159aa86f9de3e SHA256: 7694bf341b99095ebeea72ec3ba7cf9ef1da80729e74c6e680f72b5c8c8d747d SSDeep: 192://MKEmZDj81bXdF2xD9/pOm0wZuM8T0SQrk5R:/Uej81bNF2x9XtZuPpQG	... File Actions Show Properties Download
C:\588bce7c90097ed212\Extended\UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com	38.37 KB	MD5: f02ba4bda474d5abfd248d32ae9208ed SHA1: b16a1facda1c8af55971c103bb63d0ad45620702 SHA256: 90949da8de4664234790e831e5ffc33654634a0360f7bcfb4340c05ee03a8434 SSDeep: 768:ZWRFl0hJVCsRqGwowgHeWYrn+VVQGYxEyb0IX6Q4o/kwYWwnHf4:Zu+JVCswpgHeWY6VVPiEyblX6Q4wwnHA	... File Actions Show Properties Download
C:\588bce7c90097ed212\Extended\Parameterinfo.xml.id-B4197730.[bitcharity@protonmail.com].com	91.38 KB	MD5: 08bd2e96f1242f73e5be849193a2e2bd SHA1: b8e8f4b25f2f51f16fa71c5cf2485cc2150a6b68 SHA256: 6ef14068db5ce67b1ceb091509a6ddf24883f57719b95f490ee759998801623f SSDeep: 1536:jy8dPSYstX67qSvQFlVihCtQ2+94TYI1TxOnyTExEhHeZugJ:jy6SnEqbq52+94TYI1TEnch+ZuE	... File Actions Show Properties Download
C:\588bce7c90097ed212\Client\UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com	38.37 KB	MD5: faae2f869a83a2bfdf47e07e73a28323 SHA1: fafe399bfa8718796863423171990dc627a7b02e SHA256: 411f59d771a88448979c420b9e48f89535720dc23cf2d2a715a44d4917cdcd0e SSDeep: 768:tYUiUqpn9DBowVasOpkKzh39VL4R6E4nzwYRt60X/NauLw:qvaJ1zhNpkY1/8uLw	... File Actions Show Properties Download
C:\588bce7c90097ed212\DHtmlHeader.html.id-B4197730.[bitcharity@protonmail.com].com	15.99 KB	MD5: 8c0babc78747c9e07fe8d5afd5cdaaf1 SHA1: 43aff8b136c3e3565be129fd802fb8fb2542325a SHA256: 822dc10532b3eb623ee7d0cdea0af6895fad8993fd167ee1bb12d38d012c4bc0 SSDeep: 384:8FFbyTgZyWgToTYG3khrffbxS0i//AOKAXAUYC:+wAyWgToTYG0hrlS01O5AUYC	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended_x64.msi.id-B4197730.[bitcharity@protonmail.com].com	852.27 KB	MD5: a8d54a8c1f063c76c9a2b8d6cb04ecd9 SHA1: 0aaf03b0923cda281769ca5675902a08cbe8b876 SHA256: ff2326c0f122e6c822a034b19aebbb1466e4e394d172d3ccf109a085dbeaa68e SSDeep: 12288:OmEJcrMHPCKTFyvF8kHAFgVA1B+5LI/IjXWLij8HT+JbjAX56Hfa1Quhh6nsJWvC:OvcrAPpZyhQgVA7+FI/INj4MkrLJeA6G	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupUi.xsd.id-B4197730.[bitcharity@protonmail.com].com	29.65 KB	MD5: c12a8ea2b2e259a853fc1453646ae8f2 SHA1: 98e886102d47e24ebc199bf26bed6101bd474819 SHA256: cd01de0f42ef4b95d4eb711506f5eead4868b10c227c7283fe8d8f16427b43ff SSDeep: 768:aFdKzxRyxHeZIc4dXEc7n0Vi1QBQ+auUnvmUxBcvw:aFdKmeaVXECn0Vi1QBQ+MBr	... File Actions Show Properties Download
C:\588bce7c90097ed212\header.bmp.id-B4197730.[bitcharity@protonmail.com].com	3.77 KB	MD5: 6692dcb7ecbbe6feb4fe928fda18de06 SHA1: a8f774fff40637b20a695d42a793712bfe435b57 SHA256: fbf3f95738dcde9e5b9a8bbdcfb765e2c479ecfd043bff2ba9a0be533d0f39d0 SSDeep: 48:IB7hN+5bm4SY3EyHt1f2rCOTdsHvnE4g9XAD279z0vkXoZDfJjccRoaA1m2:+hELUyTf2zdovnu98+9z02I5RC19	... File Actions Show Properties Download
C:\588bce7c90097ed212\ParameterInfo.xml.id-B4197730.[bitcharity@protonmail.com].com	265.91 KB	MD5: 7ee78641a0935b8473d67e0684da8915 SHA1: da785ac47ee4719ec989e580e64540aab6a95770 SHA256: fc68008a5ff7c2bb4a0aa8c27952f505ae2a3e5eb346c208920014716f591e0c SSDeep: 6144:66Uomp4uyMLQSh4e64FeAO0vQNokXLTYbGoWBcj544mJ6:63oUfHjSe64IAOZoiLoVJmJ6	... File Actions Show Properties Download
C:\588bce7c90097ed212\Strings.xml.id-B4197730.[bitcharity@protonmail.com].com	13.99 KB	MD5: d0a45f6ba3906ab151279b92f2af3753 SHA1: dac3666adec897241548c4e72969d0d999ea8c56 SHA256: 9daf917e4fa768418ddac98dfce1cf2839ce2f9093cf9375951cca98f1b92cbd SSDeep: 384:uIzazdFp5UChHxFXHw8GIlc/jmiVxYaETsI23LW2q:uIzaJ/ZxdQ8Ll0mqEzcfq	... File Actions Show Properties Download
C:\588bce7c90097ed212\SplashScreen.bmp.id-B4197730.[bitcharity@protonmail.com].com	40.36 KB	MD5: 1e416cee7cf584347c57fa99a012b6c9 SHA1: 6c893d90e2edffe9a2e9c856ae99bb0eb7d0da4f SHA256: 674ebdc5dbb2f92a12c464cef5e4286e6199d902a25c6d5a4f3347732db42bc2 SSDeep: 768:EBtI5PUsoeJomrhZM2XvTrUmrctBR60EWSRtpHYdmHOi7IaLE0Y2ElM:EBtpsoeznVHUk8BfTSHpHYdAOejoVq	... File Actions Show Properties Download
C:\588bce7c90097ed212\UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com	38.23 KB	MD5: 30cb76867c1598f0f1e876ec84175573 SHA1: fbbb49a44099c8802888bdec28dda1bc0cdc60fc SHA256: 2070585338b728be8d29dee73529a1dc0b8c0ab168a02f3a80a0526ffa9b0cc3 SSDeep: 768:fO5jLbUqrMQQVQs+zYDx2ege1KXzUtdTjQoKdqheGP4f8+rz2bwaUaAm7cRPVYNZ:jqrMQQVQsNgVeVDTHmqoc4f2bBUaF7/b	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core_x64.msi.id-B4197730.[bitcharity@protonmail.com].com	2.56 MB	MD5: b2dc06e82a35f2f65031c1679f088224 SHA1: e31b1668d5c516ca79255e069d89ec97809125be SHA256: 3ec4d3e8c73e52976d99c5963c76e9b0b6286ed9779de63f5f08670e24ed6336 SSDeep: 24576:nc+BQbPyxbs4rONS5voMfjhOGxxV43AfiLfjeDfD0zhwXL1Tp:ncxisfQxoML1+3UiLLev0zmXL1t	... File Actions Show Properties Download
C:\Boot\BOOTSTAT.DAT.id-B4197730.[bitcharity@protonmail.com].com	64.25 KB	MD5: b5580b9200daf3b12c321ae88e3696d4 SHA1: b5157235be3e4ebe52a60e6a651de4edae7b0b72 SHA256: 67e3d041b2d0c277de807ef198a0951a1a2c9b54a8dab46ad7e6194d26d81181 SSDeep: 1536:OJ68PgZW1gY6PrXr74LkJcu1o5h+1w2xpdbwQWbdZF:+4Z4dsrXvXSuK5hC17u	... File Actions Show Properties Download
C:\588bce7c90097ed212\watermark.bmp.id-B4197730.[bitcharity@protonmail.com].com	101.87 KB	MD5: 0f0006b6d21b6016ea49c4da4fbc75b7 SHA1: 22fb1bb379251e9905a88dabd1e69c50a1f3cdfb SHA256: e55b05564cb6dfa5dddf1d11e3ab876f2befda702b7dbbb1b494b79585b4f1de SSDeep: 3072:uNdU4f/ki58aHzJjzlmMbYiFWyiw/vy/TWx4aNn:uX/kifNIiFWyisycN	... File Actions Show Properties Download
C:\BOOTSECT.BAK.id-B4197730.[bitcharity@protonmail.com].com	8.25 KB	MD5: a3656490556423ed33baff9e3a34ac32 SHA1: 9f54ece8c0c5e2cb632c59e2d8f4181d44e6e6e2 SHA256: 6907e9146055e980a431edf5153399babc065dbbb5bec9cb7cfe6ea2a018df89 SSDeep: 192:MVFjc6tUql4nQ/R/eJjhs/fD1wsiS+118w5TdHk4vpD3A0hp:85rb4nSEjhsr19iS+t5BHta0v	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[bitcharity@protonmail.com].com	4.30 KB	MD5: 32a58e1b63e89eec1d4b79840bf5550a SHA1: 15b9ba9e20d4a61aa57c7959e00f6381260d73ad SHA256: a2fea9383208c3fab626422ab81375ffbd757f4a2e1a7dda1ec64eb7f8077149 SSDeep: 96:UeOryf5R2mZdgT9vBNTKQ2m/hkvHUCEcrWgbyheIvV0ArVzWyO1F:UOf5R2mynTl/u5bkvVJzgF	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id-B4197730.[bitcharity@protonmail.com].com	4.93 KB	MD5: 583226e4963025411535f5467f50decd SHA1: 755f038c139717e5b149746461cecef849056f54 SHA256: c9cbec6f1474e8fd893fc99bff98e9c7d492190724cee9b8e5d1927c59e1e60a SSDeep: 96:+ohFjl58iLTKOk0ZIcS9M9vKJ0+TFjMjyaByaPiyVgAqGZEe3cOA666qA4d1x:+oR/GzWFh9vKmelMjyAYy9qGZsOANbvx	... File Actions Show Properties Download
C:\588bce7c90097ed212\RGB9RAST_x64.msi.id-B4197730.[bitcharity@protonmail.com].com	180.75 KB	MD5: fca2c53addd808d28ce7e28ba6435d0e SHA1: f400cadb77591452d6c54af1444987fd06a34cf1 SHA256: e01e766b88be975825fb431b6d14c7a1f8a03a1d3b84bd921479cd3ae66ba4d7 SSDeep: 3072:sN2GUjmFueXS7L9leEjPbcocgGP6HvuqzAyvQnoZGCeXisZYtyCT9VkqLEUWQTII:sYXjmFCle4Pbxcgq62CAyvQoZGssGyGl	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended_x86.msi.id-B4197730.[bitcharity@protonmail.com].com	484.27 KB	MD5: 47133fad374440b4b558e680ebda7f0a SHA1: e124de693c34bf781d0aa69763d444c788c4eb73 SHA256: 8042ce11557916f15155ce6b33cbe22bf6a4150b5cef850cb2685f168204e100 SSDeep: 12288:QmSglDjhoTh8/MEyPhjGDNs9GnHTN/NfTohROlEsU8axA5X/8LRw:QmSgJjqThQM/Mfnh/JaseEaxA9/aw	... File Actions Show Properties Download
C:\588bce7c90097ed212\RGB9Rast_x86.msi.id-B4197730.[bitcharity@protonmail.com].com	92.75 KB	MD5: 28248f144a26b185f27727fbcbe02598 SHA1: ff86d3882309fb450981c77b14e57a48a6566c53 SHA256: 082cd39d23e3019ebcc4b357b492d8720db1d920183a81824d34426a4e1a4b5c SSDeep: 1536:xa80BNcE003X1si99PgYMlYoczuK/lml1g2KZ4zlh/9zbFk3hZ63u/HECH7RMBsy:I8gyExXiCPSlncL/sl1hdzb9XFUZ63+m	... File Actions Show Properties Download
C:\588bce7c90097ed212\Setup.exe.id-B4197730.[bitcharity@protonmail.com].com	76.55 KB	MD5: b08304ba7a6a384a042e670729131254 SHA1: 9411da9153c45ee3ca2f92c198b6591043f2a4f3 SHA256: f19d2c2d1f9031442e2d650b4c88510e4870be3d74201843532f2820a9aa67a7 SSDeep: 1536:ufO01+JDCrdrkQT4AhsJ/RQOtmEol37qA/vgBlDZAWaZ0/Cx9in2:uWSWIhT7s4+mEup/4dlCx4n2	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupUi.dll.id-B4197730.[bitcharity@protonmail.com].com	288.57 KB	MD5: 9c4feed20b6ca29a881b326660f10918 SHA1: 6b5bf654ec95a27d515fe57610fc0da15be2d327 SHA256: 8a2c0f1775830051fcc9e7973d48d53fa1f7f7dc3124c90df1e5611b116eeb3a SSDeep: 6144:X93A5vGGJf3wVA9k3noB4QVvPvvBcn2p914Qs3FPH8pInwXAVn:X938vhf3h63noiQNvKn2a7wg	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupUtility.exe.id-B4197730.[bitcharity@protonmail.com].com	94.08 KB	MD5: 8bd0079c99f74e9562a790bc14282306 SHA1: 08d47a1ee8c7070b2e4bb9317094da3f1cdb2d80 SHA256: 5071e3ce6bbe57b0787ad2b4e5983c8bef977093f3f362b66841a48a3a704f43 SSDeep: 1536:nr1EPzLT8nPFlXhn69TgAKyD8er2gbgxcRsvltgzRELLE8zD4OYtR8SrmjmNUP/M:rYHT8nTX8pgAKyD8er2gbSOsvltWSZzi	... File Actions Show Properties Download
C:\588bce7c90097ed212\sqmapi.dll.id-B4197730.[bitcharity@protonmail.com].com	141.27 KB	MD5: 2f914b625ee88057502a83bd662c9227 SHA1: 85f294c76a800764bf84d568fc08123f45281350 SHA256: f0e280ad912aceb9bd3c8e0012dd084df8f0545b1760e5c010c9ba975c5007bd SSDeep: 3072:Z7i2BDmNuMnEzbgt0xtGzEibYsXDy5dmhKxBAG1LnQGZ:ZGkSkHgt0KA/5dfAG1fZ	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[bitcharity@protonmail.com].com	5.71 MB	MD5: c3238d00c3da2a7e0030e6b599971322 SHA1: a082b81d10a34ea837ede43ed0b7823d495ea581 SHA256: 3c4be39b031dfb05e47306347f697bd0c3812298b1ed9e1fd12f90c81cfc0d0b SSDeep: 98304:uuEAUjb7BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKWk8uGP0pz:e3PBkOK2Knq45mY4H5OMKkKWkt5	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[bitcharity@protonmail.com].com	5.61 MB	MD5: 63860c22283c34490ca2cc1404d11aa7 SHA1: aec903ec75b42134bdcb47a4a79e36f473e5c1ec SHA256: 003838e567f015f55a4901a202a20652dda10a4a750b684d9ac1d83a2c6189ef SSDeep: 98304:Ef0pKGBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDKFCknxeMslPJ2:27GBHTK8KXZ4UuY1kB1iKFKYkklPJ2	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-B4197730.[bitcharity@protonmail.com].com	0.87 KB	MD5: 2314d8e061ce6a66b3d3d41e94776a15 SHA1: 03d8e7764c7ecab38401c6a072e54c19f0dd0f57 SHA256: 9064b72438d538847e6d94283f4ea3438d8d711539de780a0c6cb942b3e73447 SSDeep: 12:IRALS7wOqMQc6OkTSigIaDI3q2wJtOh3TNWonl6A1tJXASrbK+cPY1mEYe:c2MH6OkTSU4I3q2wLORNDnBX1bWPY1mk	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com	2.79 MB	MD5: f042e9f9bae668c74577e114cb777147 SHA1: fcb3a9255fd62719f2b60844d81a52e57f603e34 SHA256: 53e0878604b676a4710daa6ee8eba3a07642dbce452dab0f9c65c1dbd88a2878 SSDeep: 49152:oJ6tDuv7GuMRau8yuXQFKUYcs3HVKf3rhKFvz3UWEOXQVxb1Lsdt:oJbGnRau84KUYcs31KfFKFvgXOQFQdt	... File Actions Show Properties Download
C:\BOOTNXT.id-B4197730.[bitcharity@protonmail.com].com	0.24 KB	MD5: 0c67c446d60f0ccc64a6b5f8152df852 SHA1: c0e6bb0e997ce1905f85389a1d2662e823a3996a SHA256: 943ff332343b96ddeccf9db9340cb9d7f05d0e5c86dab90d3d5cd0ef887a0568 SSDeep: 6:md4inclwXdZDo4/4F3kqDy7TpqLhAmnBy5gl:os80Ea0zM1TByql	... File Actions Show Properties Download
C:\Logs\Application.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.25 KB	MD5: 8192883fcd4818b07d399fda9dbf8f0d SHA1: 090f17592e58784990de042b281653543f10ddfb SHA256: fd731140d3c54814702d31f65802bbbe3604c10ff1d838ff83de353cf168fed7 SSDeep: 1536:ZGXklfTJNISQHErVTV3YmajW+uk2892eLG91vyRXhowQZifiCfuLYH:ZGgfTnCHcVTV3Ym2vTEeLarZ+Hfsa	... File Actions Show Properties Download
C:\Logs\HardwareEvents.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.26 KB	MD5: 9ff743a6df8f95050cb87d52636dc601 SHA1: e07836cabed58e40ca559b95a90cc12d2b4bce23 SHA256: 4a8a48ccb9b7d67684d6bedca973369737c9ac4f4893182a4916d0a23ef46e52 SSDeep: 1536:bHT8LeF2BfZFbCyWDvE7nNy04jKhTXAmX/4L1lr:bHP2tnbHWKnwzjlmP4f	... File Actions Show Properties Download
C:\Logs\Key Management Service.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.28 KB	MD5: ae4598432f9954e17ed8b01ed3bda81c SHA1: 1764d6d0e67e224ab9e5fd18daefc84072a90015 SHA256: f797678f0552e9d188ffe4f5bb0a79ea2d8bb6c6163bb3ce91ab8f47e6778d28 SSDeep: 1536:ExXXjDwh0Z6qPaOnIXk2kDtrOiT5Qt7W88lB/RUA+HfCwAJzDSB:ExXTvZ7SfX1Q9OikS8Uj+69JDSB	... File Actions Show Properties Download
C:\Logs\Internet Explorer.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.27 KB	MD5: 7838442d002049f060a8910e84aacfd1 SHA1: b99e2863e0e0367d1504757e8715d58f817990a6 SHA256: cafae2b648327d90e541b09b863a66558aac119350cf89c3a408cd63f4f04e38 SSDeep: 1536:wVtnLHC8MUxJcuMBkH98Hbb7Jna04x8XvFfHw2QkCg6YI/:mnLHDdxWXkH98f9D4q9fH1CrYI/	... File Actions Show Properties Download
C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: f392e1fe8459504c7521d0f255d9665c SHA1: f4ac3c38daa20eddbb0a72fb825c4a5573e761d0 SHA256: 48fa5cce7e3800ef2e77727b2f5b4e3e3a15b7fdad3836b8840218e2c160cd83 SSDeep: 1536:yBNcSmRAlPJogRZaS5fjeV1Po2zWBu39R537EYTISmT1q/m:yBNMSN2gRg+rK5WBu39f37fTmBq/m	... File Actions Show Properties Download
C:\Program Files\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com	0.40 KB	MD5: ba0a9b11c8df189e0a9ae8303c87dbc3 SHA1: 341d5865bfeeae803c3b22c4bf8a7dd36d7bdccc SHA256: b6647fb531f5709fcb0af04623e22ea1e4e0db40670390d9756a558284efb3e8 SSDeep: 6:KqBL7hzLijvKnZILmTSaiDK6WC6ADrq2ZhrbK+cNuGzR/u1mEYTWt:KQ7hzKvSOmGacAADlbK+cPY1mEYe	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.38 KB	MD5: 2e944c30860658b646ddabe634b0dc46 SHA1: 635351a23539964519cf5b021d53c51bb595a368 SHA256: b7c1f15b1dad584002381d809f9f1c7dd9e93b09d85b3fc8a0e5ac81ceccbdd8 SSDeep: 1536:KpPqPeVQ6DzAWh/DkZ0dl7PMC3gMe2epur3+52/T6u35ShLkrZsH+U1N:TezF/QZ0dxPMCweepe/keyeMN	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: a1c6adf2dacb2a3a8ad1539182230750 SHA1: 70bba68ad3f363cff4708dd448314e29d2d3b289 SHA256: 5b3fcfe7569864e7ce5c8111142fb045aa9daf09b7e222b3945ac2852e8de1d7 SSDeep: 1536:Nu8AVkazHJ7oyRjgnjYo4/l1lTnP3qBXTYo64H/YE4uS2ye2nYc8LFuFBTj+oi:Do7hX0nkoofVnPaOoDfYpuSX3Yc8LUjg	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.32 KB	MD5: e9637829322153f8f4ecf230a28dcc47 SHA1: 17a749964bc172cc64768f104a6b20fbccd348d9 SHA256: cb3e270f1029f2fcc0d7747a6a385d34e481bb0ab601b7bbc6086c4c80e97569 SSDeep: 1536:2ryNg/8RIqhfm3FzFxY0OXeIQ4vENQvAF9GsmgqcBhaY5CqBPQ55J+eEz:2ryNPRhpUL6oqENQdsnHLb53i7e	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[bitcharity@protonmail.com].com	1.62 KB	MD5: 3f82cff17e0ba7cfa4b7bc16345bc0a4 SHA1: 8f039cb470fa36af09e1a9b4bd207d7423bd5f37 SHA256: 0aa6d4d425bb37f1023fb514508918afdde36cc4d9ffba2048e78a10d522ad54 SSDeep: 48:B4ABAY7pwSkB6dtLfSKJWGUbD/4mAavHA1m2:B4ABh7WsrLNJWDUaY19	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[bitcharity@protonmail.com].com	8.62 KB	MD5: ccaeff019de61b265c3b87bc2f099d55 SHA1: 79cd167d15b41bc49e0003a743506bbad2266074 SHA256: 64c354c136215cdf7c473596e3f23536df0f772a2081126191ee4ebf094089db SSDeep: 192:QdrzpUMrGISh36GG+Om+vcZwT0eTb9CngsUQ14/C6K6ntpbTCxlJWq9:QxzpUMrGIShqGHONkZWTApUQ0C6Rfbmf	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	0.39 KB	MD5: 9d88cac66b30adac9badc0d35b9a4cda SHA1: 1d191b9d8a0ca1b85d0e11de82bd7c2aa662a1f8 SHA256: 070d130e7de34f25cbd5e22d186dbd67c4e3a055ddee084f40ead1fc8301cbeb SSDeep: 6:b/6fSBl+x/39iSRPv0itHV2GzFN3AJnciMvnOClTvPEbK+cNuGzR/u1mEYTkn:7/+30SRPMiFNOMfDvPEbK+cPY1mEYg	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[bitcharity@protonmail.com].com	7.87 KB	MD5: 47a739089f3a7ba1bf8688676533a66a SHA1: e51de009ad1fa2dc2af8315f6781923368e6e279 SHA256: ee82b94b48eca3d4cddbbc97f3ac117e3288250e1d3e34ae652ac7998ee79894 SSDeep: 192:ZoR0vEgSHIMTZGDGJTZ54XNYhzaqbkm6nD5eSXNX:ZoeRqIyQYlAezaqkmeB	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[bitcharity@protonmail.com].com	12.21 KB	MD5: ce64c3edf1016c9ba121dd5c5e89f27f SHA1: f0f0a6de22c349fff77fd811d013bfe5222daf4c SHA256: f45eec5d45157da304630b1eae020901cb683cbf9e808fb89fc537fd6254ba90 SSDeep: 384:f1ACG1v2UXbzrzUNFTCYMwuuba+/Zuu36Awwob1o:d5guUrPgFTC7+asjqAwTbC	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.33 KB	MD5: 6bbff1f8d39854261534752747e6cb06 SHA1: db14e1f0bf7b8d86c656fb78e0f9efa7cb41fc55 SHA256: be5e5d827c739147380982f5b530a426ed9d25aced48314ee6e14833ec6b9b7b SSDeep: 1536:3BK+sGcBjqQvRFzdO1GezpqJHk9blsdFHEHezcwWXvIZ5f:AGGjqKPjImk9blMFkrwwIr	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[bitcharity@protonmail.com].com	15.15 KB	MD5: b3d081a763788def377e42700c6f19b7 SHA1: a18b56f5e9519845a2c3338201d1596c3de72055 SHA256: 69753d6962bbd49c980542d583844ba7e20619f0d8f7e139dbc1726be1cbeef5 SSDeep: 384:WWg7bpE5mCWcWzG893+hG/n/SbQ7KGrlLi1uqkdAG:3RBES8J+QvSGrlLMDG	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.33 KB	MD5: a426dea6af3013c11ccfd5adf47a9909 SHA1: cd5f1c7e0dc306fa5a4ce3624ed071563195ce5c SHA256: 3843373507b8f99572aaed8d3dde9fee93050d81c7e45f63b2a0cccd71c4aa91 SSDeep: 1536:oy+UqYKVCwTmRplrQChrOzt4ON3LqSa1QAfqzN4F:oyx7bl0ChrOz4zQrzNe	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	0.42 KB	MD5: dcaab99f9aa80928464b698adeecdb71 SHA1: c2b0e9a4b822625883138001d089bc26ee97cc3b SHA256: f540f6ece543d2a9caf8fe1ce0f79e95bb3454a86d62888d070b0fd9603e5d7f SSDeep: 6:cI/PiLggDB1TV7cRycMgJ8FI5tcp3zlUnOClTPJOVLobK+cNuGzR/u1mEYTq:cXLgIBLgRycNLs3ODPJUobK+cPY1mEYm	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	0.41 KB	MD5: 6e124cb716b798289d52edf5eceac698 SHA1: 9cc51ad0839d4412a9df98c742a84063baffabf2 SHA256: f6700ab300eb6d3c39a68c903442cee24de6be53019d99b291920dca03b4c43c SSDeep: 6:70YgCmO6NuwOB1tQLsVQDvZhUp3SnOClTBycrbK+cNuGzR/u1mEYTq:9mEwa1AbS3qDByybK+cPY1mEYm	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	0.41 KB	MD5: 20ecd3ca3ca3978dd8ac4b1a67dd5f87 SHA1: d1a83a8d15be89158a79de4bf7e3ab30e60f89dd SHA256: 94aa158941182ad8f8b5ae40e9156cb9dd4aa005f5a14fd169c5a0394ccff3bc SSDeep: 12:VLpe5iNr/KZX/aw630b5DjfrbK+cPY1mEYSn:VLsZp/aEtjbWPY1mAn	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	0.42 KB	MD5: e8a4b111f4442587f56aead0cbed24de SHA1: 0e05b789211f40561772abca41f4c23d52eb88e5 SHA256: 21d26fbf3021e7d371b841d6e2cfd44f132f1991e5853bd917f9f32be95c3a5d SSDeep: 6:VaP1NIyd4BmGresEuLg4aUp3CDXynOClTkeNPbK+cNuGzR/u1mEYTq:mNir9JM4aS30aDxbK+cPY1mEYm	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: 142d0a572a9a93461ace48ad13c1223a SHA1: 3564beae62101438d8f1d382124dab6f6dfa8feb SHA256: 466cba1485f434a4d940d62df72a1c13f5d7eff08a2e0ca0253f9ae3ed1b8d53 SSDeep: 1536:v8Mex037EP6aRWvys9TiVfCVP/Ry71hAJ7ovYkGAaL2mLM:vh7q6aU6s9+hIHRy7cGlaqQM	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.30 KB	MD5: 312a01600ea83088bdea62681476424b SHA1: 740d48930b2e9f88312324b3795d7e1423de616c SHA256: 1f47ed3b0bb80e3379c68a08f3a8ea1b5fca5748d1913becb3c3e5f305750212 SSDeep: 1536:8URupxzij8t/VuZEZuuId8iLKA2o4lb2yXN8EQeLvov7:vGtijS/vZuuTiLKAYb2yXN8rekj	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	0.41 KB	MD5: 03d1a640e06340c59a3e0d3a21fc45c5 SHA1: cf2a55f0fcb0dd551077cf4e151eb53b73f3877b SHA256: 5bdfb9eb8ded3a0e730df8d0b04372c7aaf47aacd54255d7527d944dee245993 SSDeep: 12:sKoe3DWt28GsOrZc3H5DXubK+cPY1mEYSn:sPezeacgbWPY1mAn	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	1.00 MB	MD5: 3e6c1c4bdd25af2c38f433bdb6eac042 SHA1: 2169ae5f527cd37b900e90fbb626adfbf8a6ed64 SHA256: 23418faf2b79c3a5ea7a3fb8230a84f398545f586167e962767f60fa55b3df01 SSDeep: 24576:FBLNufEVRkuDeJmxB3c3oY3dh9IzOMl7tUH/bhVk48v:FBpzYAdc393eBttY3k4q	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[bitcharity@protonmail.com].com	4.37 KB	MD5: d3d7e56af6a6e227f37f4e1bedd3f688 SHA1: 41db15d71f0721c9cad6a0a072ed74b11b1339b6 SHA256: ec065dc1a45a30b43d916ff1603edabb33085eda99a122017e64d34828e80696 SSDeep: 96:4T6FIk3+33pJEW3D+dOwwiDLD0EBHkMnIkYDZfCeklOTl1/:4pk3+3AybDiDLDLB9m1Xa8n/	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[bitcharity@protonmail.com].com	103.25 KB	MD5: 47828ce647e7f2bf495e43a8cd9adfcf SHA1: 30de06e508bc93ce5fcbf4dff74a04b1ffc6d689 SHA256: 1f235d5913b35be4129f1c05c0bb6bc185b257cbce677f2c8311a5c2d70f4dea SSDeep: 1536:13LbKft88e9IFRMQ0OrtLeUZhvobjQ4a3nN4+YQ33X7HvJx7zOX3ZjepA:QftEK6dOrtLDvwxGn2+tHBx7C0G	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[bitcharity@protonmail.com].com	0.27 KB	MD5: 6686a92ef55263f64daec5b7fd9cbb07 SHA1: db5b72afc2a4df1050f13b5a79259e8e20a9369b SHA256: bbf2273b806fcae51f286b10806ee5fe5a7ae453f602a87400c9091ecf1db0ed SSDeep: 6:jSs4jS1prDi3s/lbK+cNuGzR/u1mEYTYt:jSs/y4lbK+cPY1mEYUt	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	1.07 MB	MD5: 3b4fdcd8a1f7be421951701d1b7f87e2 SHA1: 3d0b01248b32a7a8adec61c584405929ca75d82a SHA256: 21286afb9f2b0a3a99b76cffae7b0c49a683781c3c7021bb798026e463f3c022 SSDeep: 24576:dIJ4hHFvk8QiN9v1dXKHb9Kb89YDFrXSak3ZjRwK:CJ4h1kCWp1Y1STd	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id-B4197730.[bitcharity@protonmail.com].com	142.04 KB	MD5: 6e8c97a37046b3a6a658a6e8d5891c53 SHA1: 8ace9839335d201f1daa38cf78b62cd1ab8c10f0 SHA256: a27b49ac8ed93423a135b0371f1822585a609dfd7d4e8c34ccd20dec92fd17d2 SSDeep: 3072:KiBIJ27PblBggytKVw0DtMUVedEb824kLgrWkdwJtapjyg+yluj3Me8bc:KiBA27BBgNKVwGmUV6lJDwHaByfKscR4	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[bitcharity@protonmail.com].com	62.71 KB	MD5: 278f37bdd4871d6dc39b6f980d75e033 SHA1: 6a5c8b1e678a3e5ea5e0835825272bfc8004b856 SHA256: ee95c1ef9bbab0fc211bf3cbcb7770e4d4cdb71d6573cebd360f0abd918264f3 SSDeep: 768:SLtUde7hc/e3HD76qcmk6bhwc+qhXjhzF1eYpq6A6+r87k93S7mYUSBbjUL1Ix/G:SRUUcsD760k6mQhf5pw87KTajLxwCd3K	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\Welcome.html.id-B4197730.[bitcharity@protonmail.com].com	1.17 KB	MD5: 9f4e69fbe8511bd9165cf61613a04dbe SHA1: f93f5a57b2a1e249a83d34866ca4b2f7189fd659 SHA256: df2418cd95ee179aec349328c325729513b12d68fb11a27c9d481cc8020ffec7 SSDeep: 24:0F3yPU/yH04X6RLTzN2+Qcab4iXBvUH97cy6Vpsppj/47bWPY1m6:0Fi8/yL6RfzN2DcavBMdIy6rsj/1A1m6	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[bitcharity@protonmail.com].com	0.53 KB	MD5: 9a1c3c8f2712978c65220fde9a7b9743 SHA1: e9be9b76f79c98d4a2bc73aedd8dd787cc44873a SHA256: 8b6753ac776b539f2466477699990b877835f023090b9dfdd784a221a2fbc483 SSDeep: 12:Vn9uX/5ct7cIusTDH90Mz0bcUwjc1jIRJWn/7rbK+cPY1mEYk:Vw/5c7crsTDObZ9kOHbWPY1me	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.32 KB	MD5: 41514f6ddbcaa9e740443b1f46cb10cd SHA1: 85fef0b0e077e1e48659cfdf76bbc1be3af1f440 SHA256: ba08e6a92ed8e04858399d65c16d713028d860bdef059924b37c9951f514adb5 SSDeep: 1536:1403gRFBCbu2+KYJXzux3fIyvcbA2L/bl:142M4bbUzuRIE4h/h	... File Actions Show Properties Download
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	0.41 KB	MD5: a5b61880c445104926e46cc8f4d468c5 SHA1: 757538324ea8b67799dc00c5d8fabf36cedcbdc6 SHA256: c9f14bea60a0a0c0003a596210520b34f099efd701db69e3aa93dfdf98428e27 SSDeep: 12:vGQhAL5Um4teq3vT5DSwrbK+cPY1mEYSn:7AL51MAwrbWPY1mAn	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[bitcharity@protonmail.com].com	170.68 KB	MD5: b07d46bc87e6a4c62882613949dfb823 SHA1: 906ba147b529375a8f361dab83cffce7bb569d1b SHA256: 4e3dc49027acdf73542bdb274a569c83b99575248c8fd6b0ed6c767fea3a15f7 SSDeep: 3072:T2UYLD/lFRxaXWO26VPfVbVdr9rXpjd4nFaaApXpoh/E25MyOxAezvSvEv:T2/lvxTO26VPjBZpjdOA6N5MMezvFv	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[bitcharity@protonmail.com].com	35.73 KB	MD5: fa56b0c4c69921063d556c9ba438e59e SHA1: 1731c85a252332da84a7e31720b346bbdd6479ad SHA256: ab24869be01fcdb04799afee7970423772d0a69dce729a1a0ff50273dea1ea21 SSDeep: 768:+odskGTsZwN46LCSwJ8kyiSpOTBvWM1HqEZX6YQ6QctldsM41/rM8wpdQgJjwRFG:ckmsZx6L7wLyjQBvvKEZXcXujsM41/ry	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[bitcharity@protonmail.com].com	92.49 KB	MD5: 59c8449dba317fff924ee8661ef0d18a SHA1: 2a2520db1072f69cddd7914ff759222445d7fb48 SHA256: b012b7f75782818c37d56a689aa8d4cdeab06c4b8f38a9c0c8e1da8481e9f791 SSDeep: 1536:IC36ZGP7SHrRjFSMLJnDgv/uh9vZsjKXcjoy3KmK9BFxRVAfY0SZEKj0w:ILZLd5jJnsvmDE+9XxRt5BL	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.81 KB	MD5: 4c53a53d0b44cbb3a8419d675fafdf05 SHA1: 414e00fd69fb8856c71d0c04f9fe465fc69281f4 SHA256: 9a95129a93923f1054104ff3cdd99ea16e06d64c2cc1c8752d38c9d4d4f6847e SSDeep: 48:txk2MugeBYGXgVBVvpa8u3FPe+WMaCYfyAzRA1mI:tdgQXS31w8+WMaXXe1v	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.33 KB	MD5: 90a52ad291b523d770389c3352ec75f2 SHA1: e7e9cb1acf9f770763cb875d6b25e28cf64f99b9 SHA256: 4d69db8060898f6a8b0629ebaea3223f32f4a66775157b885dc81464bb7e09c3 SSDeep: 1536:d530in3T9pnn72d2MNHOW3lZGMrbwyOHPkoLIB1MQHmLYE3uyj+cWblznQq:d530I3T9B72d2MoQlZGmkyOHPkPMQUuJ	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	378.59 KB	MD5: 5c26b84c4f1d2d48c1257266599fa4c5 SHA1: f4b08991ece4acbd86f553d99f9e4c7a1d84e478 SHA256: 4be8d7320e3285307bd3e5e4323b946bb578609e90c4e745d8b70fb58963083b SSDeep: 6144:alcER+pb9Hn5FcC9/muzO6kJrhmimjlFTIB4TPryK6FsX4/D0W38PFxFDyIJUbc:ald+tFcW/mSMJroPF8FK6FsX8D0W8PtB	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[bitcharity@protonmail.com].com	6.42 MB	MD5: 991d0aba585ad2d88a8aeffc7a388966 SHA1: 9be5938d362b33d3676e24f37f24b6b17cdc1209 SHA256: 8600173e91993de0ed71c8a94d0492a1bde2c6c6c9096e1b8bee76198bcfade1 SSDeep: 24576:54vzz1Y5Zj9Y6AOwaWVNWWHHzRu1k/L9chbUF/Tx7mWqn3gVtiBwGFwRusBwlNSf:5qk3NIX3NIIaRiggyrkdbVVytTTvxiH/	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.32 KB	MD5: 58233e7c02d941f6d197f3c82dd50fe6 SHA1: 3a00fbd2f7367952ddf41157114c7fddcc7376e4 SHA256: 5b1edfc63ae1da8bd55aa923610706632d27743b2b493f5954d3cef96b76ed04 SSDeep: 1536:StDdyHXRf4M/nDSzV58KxtirvtsQ79Mg6Gp737a39D2wgQHT47:ydyJ/s57HijtsOCUW3d2Yz47	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.35 KB	MD5: ec0275d6b7e8cf8e26c8ce589ddf45bd SHA1: 234c8ee4a72e92c264d422c367539f1cd6e52094 SHA256: 99f45fb74fecb318d2bf91a9220dd054bd72c9531982321e3cdddeda5dc945c0 SSDeep: 1536:16VlYdHj2F/VtZXZJCT1NjqCI8W8wCFIqu0/01wQ1LyVUL0YYlre+2:klYdDuVtZJwTvj6HJEkJLyx8+2	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: 0deaa1e3bfe94643ee5d37251ddb7344 SHA1: 7153567346a339c2d0531289b4d638a9e167c992 SHA256: c4a375f87e5e74c8f5e3b3633732f27e95987f24158c0b469b8967781c40b265 SSDeep: 48:XUA/x6BaSPUAENb5R0qL/NkcWrb+BwXA1mI:XUAmPq04lkcWri11v	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: 8480886050b79812438f65dfffcf6f7c SHA1: a45984b18e7a30d2e76cd09ba31b227e43a51d59 SHA256: 4ac456636c583fb4ce8dbbd500b59d433a755b2e5152fb8e9be21e573acb7ef2 SSDeep: 24:YFHz/DTKCC+vfIMwOcbH+D+m2wiiRG3qS+Sb9LAlPM9aXxJTbWPY1mI:YFT/DnvfIGcm+ZZVDxAPM9TA1mI	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	485.20 KB	MD5: 491ac4c8dc19821d13788ab4908b3fe6 SHA1: 8716adf4fe527a52108c1719f57f223ff7e2a534 SHA256: c037b736be11779d6971ef1e66e2ed20b936e6528789e8748245236928f30d23 SSDeep: 12288:WklHGmB6lVk67TLMTMGE/fAscNJL7H/jmwTCK5+HmSW0ND:WklHAB3LMTMGoc/H/jnn5+GH09	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	2.82 MB	MD5: 93197ca2f023e636f18cd99342ac627a SHA1: dbd44afa757237d2ad674b743e758b0687e4a78c SHA256: a6ad940fcb498cd213dd922caf4a00e21276bb53b0842ec2752a9b113d932f18 SSDeep: 12288:YL0oi42rUMzq8n+1FUVlWUSnYpVhTvRgIwatZVPcMTU/45vLsmtNLo:YQoi/rUQC1uSng3ikVPc12dpo	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.32 KB	MD5: 69345fd54a7d2b8b829627af09d4dc6f SHA1: c377abdbe232e908d69bf071da3880b45a32a773 SHA256: c5693da176af9431d5ab3163dccb2ee85bdcfdf1789899932cb23a6a17e93f43 SSDeep: 1536:w6VvoGLKl6srC7zsKeNIc9WqMddL6F/NNGGdCMcZjcQC3FbykmSmIX:RKl65kSdL6VNxClphC3UnSmW	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	248.09 KB	MD5: 2896d7f22c32b01dcd350f5a01d754a3 SHA1: e6821f66647562fa9ef795ff2df716f13b78a238 SHA256: 910fc7490595dd491b9cab4a38cae3adbdb352a63b92f75fd837f3e1267709a7 SSDeep: 6144:c7Bz69NzSQk+5TKS395WrcfOB8UJpPXvs1J/LidTsOEG6ZpKBKs6ht:cIRSnqTl9NfS3pXs1hLOx6xht	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: a7b1fe3bf3c5c20e00566990890cc4f5 SHA1: 41785ccd4c72ffd574b02a245ae447ad81864c52 SHA256: c5d6b3ab0e064f9136e54dc2efe0ef84ae29fda4e12f567646e56e5ae758b661 SSDeep: 1536:IApC+kFTrNRxn4brDyTVE5B5QAFtFSrlgDvrWCi8zRVyxGJgisL:IfNBNH+vyW5BmAnFSrlgDzWCbzRo/N	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.35 KB	MD5: d462541479dac4cfb04a84eba0a89eeb SHA1: 549f9ae4392fe3d5f3dd8d3150e908e5bfd66988 SHA256: e90dc55808b6155dff1d17e20897785b8d1fa6fb386758b4cd87ef0996ce6b51 SSDeep: 1536:rbWNUmlGJWsabp9Iw/h4VXFBeS9x3A7dv8kW+:rbscfw5SN9x3AL	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.32 KB	MD5: 8e77a9f75e721c4e5b88ae6bbf191db5 SHA1: 80bf49268e2afcb7c311972958cb2a583a85b281 SHA256: 9be0a18de780992f2dc2efcd910d0e7a2666fa4036101fa8716de2c8f58046e8 SSDeep: 1536:rCpT5KMMcrhybme78yTBZZdUOspeS+RqlkoY2xCKkxihzjrH9yKcG+QWGdi335d1:2x5pMcrhuv78ytZZdUOpqlHYaCmtH961	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.32 KB	MD5: 51307479427046008f4b9971683335f5 SHA1: 4e4d76a550061a6cc0a39f0d9434252cd0f4edbb SHA256: 163d65ba411b4be6c0fccd61994a849ec6fa09765359674c114951c3a3a80dd8 SSDeep: 1536:OFqzhYqc3wUiHLjopbd5fVIxhM5WCBzL/58ZAg/efx/U/8a2UMcFZ3vAH:OFeDclircpDy05Wyvh85/efxk8vUBFy	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	782.42 KB	MD5: 8529340a3aca6d8fabb59acc90cfa8fa SHA1: 4443af1c9b4e2975001b1d913a61dafd3ec4addb SHA256: d7ae0455e34583c7d336a55e7be4ef2fd14fab5866071717e60cc5c4523185d2 SSDeep: 24576:8NnrqdSHpw7kR2cMToiZIksf0mEdi04gsd1i8Md2:Kr0SHpwwQciZ6UiRdwM	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.32 KB	MD5: 584b0f339978541404813b5ba52e662d SHA1: b2ef749dd21e1cb8e191a02b5687ce01db7ab085 SHA256: 07e7dcf816ae50befa8fc63f0a562ae226e8a6e465ce84423acecc9395218cdd SSDeep: 1536:RTNHJ+eRELtzZEqQ4FMiRqIgTrDmEeLgHy85b5/CeAP4/Fm3V:7HNElZEqQIMLIgT2EeLgHy8p5cw/F0V	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: 2e56895458374b50d620347245ba4bce SHA1: 64fd30b208b878d800725f151b40783dcb8ce7b6 SHA256: 6b2efe599614005cad83abb7a559e51eceda350752280881ca09c864b699b3d3 SSDeep: 24:n8z5HuxyYjOe+Ia/R+/BIexEDXT7ILE5z6TUSjBv4In64ObWPY1mI:cOxkJI5/iA67ILE5z6PBg34XA1mI	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	19.31 KB	MD5: 835be78b510845c06a898d9a616372cb SHA1: 89fcd245246805cf059be210d6fb264cd250eaf3 SHA256: 1f7f0257ab85a55346cd415acc7524469bcca6e6a279390ef6c23836bc269ba5 SSDeep: 384:tUTugHHbpqON4Tp0xQM/UpC6l5KyyxQOmI3rs04wOZlg:CTuI2TqYC6lCxQOl404xZG	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.33 KB	MD5: 2ea752baaa03d9ddb200ce23df93b05e SHA1: 24bc81a72551efd823dd965ffa66d80f080051c3 SHA256: bcab34cfa4b695666203c4035f42e4dc0eb3152ed0ca139fb1eb7f5d16626aba SSDeep: 1536:xp/Px6OSHlmGjFDYuvgmhsIQZbAXQWVm1W27+QO6aW+u7:xo/VV/hsITXBVc+QO6Su7	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: f6bafceb1899d2cca38c295d33dd2d89 SHA1: b977029f540cf13bcc4a89246313a52cd6f711f8 SHA256: 8c46908224e64376ece68a461a49fac94ad62f6a7b598dd6bc484b12935d4904 SSDeep: 48:OXCIUPD/nENSOKyj+3sRy73SY1smwmcA1mI:OyfPrOMy63YE1v	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	745.79 KB	MD5: 3e74e19a955264461895b67432270755 SHA1: 5dfc7fa199e049bb0bbd0eabd1c45e55a3bea4bb SHA256: 9c242e04298b32fd45ef81f444caecbefdb7f8068a5dc07cda01bf4ceca7c15d SSDeep: 12288:x3ClHm18iNfJQcCO6VJ0oH+9XHqs3BVZcjQoQFOczvphczZQzt7siM:9Clm1jscCOIkJqs3BVZcLQTtezZeA9	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.30 KB	MD5: 598ffa45bce97a76155ae5e1c08e7dcd SHA1: bebefecf58528f030ff0f44519a495b62ff47faf SHA256: 78e1547c5aa5ec0fcca8ca44481448b9886b13000c3fd1e70b64eacb19b3c12f SSDeep: 1536:FU5Nm1wy7gZj+VWh6OGgLafyaSxw1SPY+eOrGgMaAkP:2W3MZjgWUgLaaaSxjPYuCgckP	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: 8e1cdedd5f2009a61af8ceb4616f0cae SHA1: 11e9f48e7aaec73c004506b0cb93fc71db998051 SHA256: 81103a867d12b0b151698b30d2842b20c5a93f0f6b891b76370792808fbaeba7 SSDeep: 1536:ngEnVEMqyujc+zjiYtDWNDgk5HFZsaIDvRFfnetH2WKUKMV:gOEQujcStDWR9nsaIDJFW1wUx	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: d18c56142c051d1a6f4431e98fc605fa SHA1: 48b2ddbe32421ac2a27bdc8ea96c7e1299356b41 SHA256: f79ad32ad619d9d421c57f45f0c990654eb6feaf799d9d89c63c7558a0ac6062 SSDeep: 48:uuLVozFY5wyq8AL7Dui2+Zg/F/B3aA1mI:iRyePT+//3/1v	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	1.00 MB	MD5: 655508c2dae4ecf883be2ad30a4efe56 SHA1: f1ce1597ae1faa60ce91555935cfa95b3a6881d1 SHA256: 56160deb78a3f5f0b09c8a924f2fed1c825d5b9b3ac09b293a42f91a17eddf0a SSDeep: 24576:UoiynpHMKP3dkwHHK69vhO/F7v3k8xEkIgBCJm0sjykA2:BpHFP3dkwHHXvhENIHnsZ9	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.32 KB	MD5: 9f78fcdba7991f83e8715907a3ae16d6 SHA1: 6ce938e1c8a35f90fc9f9f9f03b99c411fcb09c6 SHA256: d0364f02daec5659afa458aca4785210fb8af11ad8caa15cf9c58412b8ee4db7 SSDeep: 1536:SbNSOXC6Y6vrrESYPNwu7qjgyYXMB0CxC6CwiO/7/vRNCpEMDY5HVKA:SJtC6YWrYPNwu70PhB0CLCghNCSREA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	2.42 KB	MD5: 463487368fd9f84ac6f3a547a6f6608a SHA1: 8f621fdb6a70f69f564d355f8c9750f0e7939729 SHA256: c2d5fcb7b6e55019108bbdc1dd782375ffc01acd183555b932a8c95ba8192eae SSDeep: 48:eN3urIrNpkFcmAbepXAWtEDOZG6o/nXR7Qn6OiFVdZYFmfvwBdSA1mI:eNmApkFfAbep7ayG6o/n1VOiZKFmfvwZ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: db863e57c59d90c1bdb12398ec12a5b0 SHA1: def735f75de62bc66de455a18b3b5ce85a20bf8a SHA256: 6fd860eb705fbe477559ee47c0ff183d15a02f33916df97bbfae6b35b117b234 SSDeep: 1536:HUQxtXXvOD5ApZ9NA3GX3v7eRa/ljc4bDujCUxlHG0yIIxHV:YDc7SRadBDGCuHG0LYV	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	2.42 KB	MD5: 6c5a88b8c0ba736b005030ab72bc70f6 SHA1: f868ee6c042dfbd4f5447e5d78393813139f590b SHA256: 2ea51cbda9d652d65ae6ff1eb1ef5dfe3b2184514091d5bebbb70febf5759e65 SSDeep: 48:A2SLGkqDTG19PTj+3/cEXlZXHZJ/LwBN3vlOCS7Hpb4mPQOPV70ySGrbtJgbyA1v:A2SahDTGHPTSP3jH3/LwBNflRCLVPSG6	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.32 KB	MD5: a926c269c703f143e2b0d5feecf978a1 SHA1: fe06c5b63f4be0805abeb3d78bbe39c49d8246bf SHA256: 12811e1a9df79a253326e852fe908f787abba188bfb46228c0e6962f0a62ce01 SSDeep: 1536:4aws7+Yx4pebjo+wZsNh6BwVHQoWsqKyHNlHkauHHKuLs5xCc5:DyVpe3zswVHOsqltlEauHHXLs5sk	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.34 KB	MD5: 0e911dd2e6bac00e1bb446f087115c9d SHA1: 95ac31608f389db0980a268988578a39f692a4f4 SHA256: 28bf447a694e68865d115bba0db0b90f3f579eccc7e4ec59c397bb9e31eb074d SSDeep: 1536:alP+uv/ar6D2hh1Vcqqej8UWkwVP2Uefl48EgM5:cjy6Deh1EeAUoV+Ue8F5	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.32 KB	MD5: fd2d913a426134a301f24d1afe919d4d SHA1: 651cc930056b1479e076b1616b838ff207110a61 SHA256: 5af52e8933c1bfc12962f19030bd49e58dd0e6e494dcbe2dc0803a1dc8705785 SSDeep: 1536:q+H0Tun5DIMh2hHwwleHUPKn6Zsdg+0XZszgtq/pQIw9CzOKu8WVuk8xSO:b7DIMhULineIOXZEgchQIwsbWI5	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: 495e882527408d42110441d64d557f81 SHA1: dfb69bc14bb73ad63176689b384781ae7795cd33 SHA256: 957b9522c13f50e6dd6f40312f3f9141f5b1c41af698b951af2e3c2029b08e77 SSDeep: 1536:kjX2uRwHv4Dl6L+0RkDR89jAwMjxybLReapCV5z26OvaR35TG:oht3eEOBApjxUeapCV5jOCrS	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.33 KB	MD5: 4a8c7786b4f756159c1c898951ccfea1 SHA1: 6b97af8801cc3d4dbeb90429eed61fe036b85029 SHA256: d1bc69fed8230761c2a812b48888b2f3ae0b65ddaf60453837d588e8939a4f25 SSDeep: 1536:SAe3MgMARxbej7D0t80JM9YeN/3UnIFDnXp90fzAxJDhVwcH9qB:SjcZARZ69+2Y2/UIFDnXp9zxJRG	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.32 KB	MD5: 70d6722057b9fb3ffad799d8b4b45d19 SHA1: 4c03247d3918e6e1abdd65b78e5094698eb48fd5 SHA256: e0101bb53621dd64dd76259d003d32a768061d4889e4afea3c465aa85eb0a30a SSDeep: 1536:Mhc6Hd6YqVZP1Dwd4T6dLQfVARG0obC6WOmWyjOCTUaoIM5ROlTycrJ:ghd6LVv68WRl1BWyjjsbOlTycrJ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.33 KB	MD5: 56573bb74c2cfb0cc3d8ff1c3d46929b SHA1: 5a9dc032024845a7a20973fdcd8ed38cd26ecc18 SHA256: b320d6832e4170a6c32ad12e74387cdfbca008da80bd6bf97a88f93ba11fa4dd SSDeep: 1536:5f7Nu+7klEK1w/B42ATFAXSGybtM5ryeK5yF2yq:5f7CRm42QFAiG6tyryXByq	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.32 KB	MD5: 1f6110e6bcc7f2ab61aa921f0e665473 SHA1: 93d34b6a660d9c2b84149e57ed4e09baea266fbd SHA256: 379237fad759187a97074a71af5e91df0b48daa6ff1eefb0e921dccfb515639e SSDeep: 1536:djslw8vnklpDddaCESDD2j9eCQT1d/WovxpLlngBrtpGlN5yP:ulw8vn+3BPC4FxphgBrXGlN5yP	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.07 MB	MD5: b6cc2bd9f2fbbaa328a5cc04231ea710 SHA1: 6ea579abafd490b07eaf0f60f68b28c88fc714b3 SHA256: 2fad767c1ceff6b2933eb3bebb8077f8228a062ef67c45dc6afd8c3a7d138898 SSDeep: 24576:VNha7+bZcWo17VSPoDlEgf3SPlkZbBk1AZYjDlgL0tDi:c79t7QPVa3AO9B3+jDlgLf	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	211.14 KB	MD5: a4f3a286c722b044ba4d5b8c9cf097e5 SHA1: 6fac82a9c9c208be04c34722d31c6b140f54e6a0 SHA256: 99346f2aec646e16ae72f6db2b74b8328d18ac87186ffe2dbc557c917208eb84 SSDeep: 6144:iQyzMza4O0qIovHkgXvQqJbu/aGhh/SPQY5z+ryK:igzaRptvHkg/QqJbuH3UQB	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: 78149a6a9b65cefde5da85bd5955b624 SHA1: db8f724c6ac6bcab2ce3d0cc869759a10833fac0 SHA256: f818422fd0ea6e0d2aff2eade016f0d4d6471b03d0753284cd99f8a6fe32be43 SSDeep: 24:C9EaLd+eWd6+YipmF45x5jxiQKPy48Xq4HTNiiPeeepT0GVhDt2elICbWPY1mI:8LVh+Lm+Kqx3HBOFpNh1IbA1mI	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[bitcharity@protonmail.com].com	1.00 MB	MD5: 1823015d2bdb6c8bd1c5917ec411a991 SHA1: 509a2037a9569f48badbe0f03a0f6609f21d4eef SHA256: 95bb8b0a8f53212ca428aefa4b0eb661c511c6a2e258ef4693bde4c19600bd15 SSDeep: 12288:v3ujxtcpUwJ/nkQpEvbC8yW6+iAmhNY42xE6WytCR8tmW2HceoRYhNhZL2KfgnXp:v34tBw5kQqC+9m84Vv1LhV2KfSHrCVPi	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: 083539df97f1fe8c2727b724794df7a1 SHA1: cf87ea786779663fa8a485b10634a5a0be468dbc SHA256: 5ca94a321cc4c93d4c8aa294bfe4b1ea1dc31a6a9e4eceb00a45db8c240c992e SSDeep: 24:q7ldiK9r4OekZI7g+vSGqd9H9hFRxUI7xpSDQMXy7h0i+n2ZQbWPY1mI:qfmtkZInvUf7xpiXy90qZ9A1mI	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.30 KB	MD5: 66a709fff2ac30fad1038cc2d54606d5 SHA1: 38757f64610e1ccf3b7cb62f55ce4106800449c3 SHA256: 82abfbc82d67022855d25fa9376d0b4764d323e03c577179d859fcde017a56a0 SSDeep: 1536:bDhrLr4w2KXdwjwhk3Rmn08fTlQvu0ywD+b2PHFF36RgiN:Xl7V2bg08rlQG0yO+b4lcKiN	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	335.61 KB	MD5: 75be05265a4e4659958e9153f5c7fe10 SHA1: c3a0535cdcb2f08d3bb085d8a70f43a55f38c2ff SHA256: de7b78ac8b981ba7da54ce9e4a78d2bab76dfffefe2e2fce1954524004523381 SSDeep: 6144:1Ikba2HbZvb3C/TFYkA1qWkOlVSfQnGA95MXi3orKgEL66pCh5o:1he2HBby/TFYz1jkOls4GAshm7661	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	14.89 KB	MD5: 47561859cdbfbfed094520b4dd64fee4 SHA1: 7a3029740ae6405b8c8d753baf0fc143eaf85e88 SHA256: 55d7fb163ca8b98a712c5b35e30609017cf1ddf662ab6f1b2919648f766c52ed SSDeep: 384:v5P7BAR+2tN+1b4OSKMPWf8d0Pc4TYAfZ//0N:xP7BANqb48MPWkd0PzYU1/8	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	349.29 KB	MD5: f14cd0b45800442579f4a9109471a2f3 SHA1: eccacc6fdf361318f087e6614c6039b32a2d1ca4 SHA256: d0c152e0798262cf3f95c0a6c8e76e0c84c20d68ab579ccf68a54b5c8f89680a SSDeep: 6144:2ftdrtT6n4wnWBK+OohF70a2BCHUO+y5sFBG7dhA5j/18+FXV0J7aps:it+4wGF72KUikYq/1h12J7os	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	63.79 KB	MD5: 14975fc1d84dc00d1e10327ab799299b SHA1: a9de30ba4ef63b611dc7970e9c2ff196910b6c4a SHA256: 23797273406cfc5f0b4df541756a9cd65c02cfa7b88bf06d30cdd52bc9a65dea SSDeep: 1536:m32kMOLRpzFmT5m6ySN2ibitR87xLoiIHlt1esgaIs0k5z8NEI:TkMOLRJAlWSNF0udlsgaIsNt8N9	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: 05d61b42a7246844cee12a68bddfd9f1 SHA1: 32a897286284a528eb653e8a62e276f3945d1c4b SHA256: 8ab6a344d53ed9dcba40704616181c6760490f1ec9601aa033ca7d0fa4afdc70 SSDeep: 1536:84n7qzpql8v2S1hb54TYjA3uEmHkSlsWxzJkefVD7WrZ:v7qzpql8v2S1h7Qa9tTDqN	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.32 KB	MD5: 83057a0b473fd19f846e4ef8363c66dc SHA1: 2b41cec11623649f1acb7283a3daa8fae010d380 SHA256: 7a17b6f833d4e54f20c4ac5af43da02e135c6472274b74be1e76ccff9472326f SSDeep: 1536:Y+e8mDA9qHexWSV6HI3oTLjX02G8NgQRzZfvuSzyJKQdDE:Y+eRAdBeH5G8NzzZnH0XA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: 2586638456a95d106bdd115aae04c2ec SHA1: 3921dadb83727fe8e03f9ee4dc93cd990ac07213 SHA256: d660b06a39367ab5985b9ca2d893fe674751158326a41de5f65c9d5f717a0a1d SSDeep: 48:qyc2rZDk8ckRdG0zFvZuSx+E0b2WsbA1mI:3c4ZDUkDGkZuL2tM1v	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: 356cf1e7d2275d20a9b1dc7eb74c8a43 SHA1: 8e6403a807b5452b4431d09fe006cc3dec92bad9 SHA256: 0aa272a1f90c4d287d5398becf43416ee2cb4d43afbc4c83fa0e89bcfbe32eea SSDeep: 48:dCHzESHhvnWz3Zxv79WYdR1Q4T7Y6pKns8A1mI:Y4SHJoZx0wobsp1v	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: 13c7a5c787c359299793dbc8727369f0 SHA1: fe7334a16d93a50148ac030b7662e01e849e6a58 SHA256: e1ba9c8cd24c1419d276c3218a8f3897d9dbf1306d3d36428aab484dbdc83c93 SSDeep: 24:mC+/UhjeNM+0mIittiR0QAY7i9kUBQpG7uyQWJcAnSqTArbWPY1mI:J+shjeuytiR0Q6nBQp9ywiSoA+A1mI	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: 58e33cc687a0cd152f2b8b165840d773 SHA1: 888d60fda863106bf0117539c90dc66c6f8e3752 SHA256: 491206edfc65c80f246c6a38817bf7c3cf27131eaf86e3a546f139755aaf2cdb SSDeep: 48:QWaX0lNRW3+tjR9FKz7aywNYwtugptfQZtA1mI:QTX6y+zDKzG9TrfQo1v	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.29 KB	MD5: c552839f611d89e050f8ba6f0abbef18 SHA1: 293765d13b67543f0ce2a2b60db48c5c56485746 SHA256: b7352f44a4d7e242216bfec347ccd4e824b298977f77900dc686ee8ece2a0f52 SSDeep: 1536:ezh4aMQkBV+GrUTB6PoBIjLgcALGNnZGVMrFMCeHgX6XE:ezizrkNl0ZSMrKgX6U	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	9.33 KB	MD5: a02463987475a18418648a14724a116b SHA1: a8545923dc9c1e3bcc1a3aacfaacc39c933950df SHA256: 6ca88db877eb3211fe7d0237e4e0a329342fe9b2390b43abf2fbc961e23266dc SSDeep: 192:nKNSc0mQ4O6QTXdwuK39sKwJyOA23wzAdrkvS+dCJaL3inqIGFIlruR2wv:nSa4O6QTi539bOmzA1KTdC4eqMG	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.30 KB	MD5: a27160ddfd1d38f4eaf7b7fccdba1a3b SHA1: 1fc69af931fb29646e14e9a20eb5c5b18c5ae340 SHA256: 1523b388b6311976c61a78e708d72fca93143c805cae56b59bf7187514d6f905 SSDeep: 1536:CtbAd5pR6go3oopGdLv2K8vn52AFs149yPF/YYYxF2HHY/92Qh1lYL:YuwgBop+2K8wAmNPFZHHYF2Qh16L	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: 493316582ae2b04841d09bee82fd21d4 SHA1: ef156cba02661dcffc59cb49ff699c7da8cced77 SHA256: 6e6c5d02a9cb73de3eb8f237107a7ece7845987ca702be5d14e78429fbf8f808 SSDeep: 48:j/8Cy5KvfHZQX8b079dKEdPIbZn/HA1mI:YCpvfHSX8byXKZY1v	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.73 KB	MD5: 10b5d88c70bab62b9c78f8162be4439f SHA1: a619d2ebd33b390b704b62f2da6d72f4fa1da25d SHA256: da43d6fe543f35e8cce4be34d85d0d3f5f4dbbe242fed3bdf3cef2326bc5f684 SSDeep: 48:Nk4qt5o2dGSp610t12aeuyjoMgnAp8OglmXPA1mI:NkD7oNw61qQae7aAQb1v	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	390.48 KB	MD5: 7a8955e884e6995f5872a0e6873e35c8 SHA1: 167d799d00cf54cb5ff8fea8eb57543faf42b1a3 SHA256: 8c305a3b158cd69b1ce492a59ac8a1946de0bf63a145889beb3ac3cbe3c4b503 SSDeep: 12288:LLpozyBn5+jVC1M/gVNqy44WTXjKa2OuN56:Llomn531MYVNjv46OuO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.30 KB	MD5: d98a14184fb04a55c1ddf4248fe73575 SHA1: 9c0c47683532427877c844794b7b5f7d7c864707 SHA256: a03ec19a1824abd4a17762620dba64e10a0a5ab6c1152beb3d85ec294ca39e4e SSDeep: 1536:2NAPut4GnKMCEN3Yld44PWVRzvwk/+gfT6xchEB2u07uOvYll9XsTVx/:BSnzCEBYld44PW7wk/h4ciVQvYll9o	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: fd3e6627511a4927e9da84a1d2c8bc9f SHA1: 4fbc843d49524d63c41a25f2d2bd96d8e4f798b9 SHA256: bb6c41d894a971f6db74e726b9efd759a48d0e7400f663f608b5b109b73493ac SSDeep: 48:dlqRkSV9QPllq3Pf4iWPBiiUGQD68A1mI:doRkSV0q3Pfg5i0QM1v	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.32 KB	MD5: 329bbbddd8632bf6cc6b6fffa932207d SHA1: 1ebbc895a97678801fa824bbce0d84bfbe3bd691 SHA256: 51fd95eacd58c05b139868d3386048943072799120fc8301644330f78c1a46a4 SSDeep: 1536:80+y4aDAdbt3VwihioX+2g1DYY04B33y3M+1zHNH4p/KmlU1t:ETaDAdbtyiwocCY0W4zHN0/K9t	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	3.98 KB	MD5: 9274d55fa7cae3b089c0af4b229cb3c5 SHA1: 6e5e8cf23a5768051d74f153539c77597228ce8d SHA256: 832687d7fdeef4a653fcc53a3aa56e5402971ab7b44e64685ed20cdcaf217ebe SSDeep: 96:MRGvUSxUDBRHmIpqIkALsu++iKl/go6gIN9LoLvJ6bqxjoAV5d1VYP1v:avS+DBRFMkZgB9L8AqxsA14v	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: f704c8d7ff88cd4fa2257d665ea5be2e SHA1: ee7083e3d8bb32f23cbe3c97ab5b7dea73c69f11 SHA256: bea5a83dfd193252d48a2df6cb60fcc2e268f21a2efd9e5366fc7ef127a53f05 SSDeep: 48:FEM9MwBvnv1APOxbaIodeDl06e2jEuMA1mI:FEBO1APOsI7R62jEu51v	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: 2ed8f60da89440a4a9d021e0f4440ed7 SHA1: 964551e1f0fe37627926ffe97a0ab319dd998771 SHA256: d9e5b0794feb9cd4c85f9ab7b84025549228c693742857335ac9f56528ec57ab SSDeep: 48:BEQ8s7DhQhFtegjlhnT3ceDouWEEUVA1mI:1RnhQXte6lhT3IuWEE51v	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: e2947393a41c44b7efd626f8de4f2e31 SHA1: 1cacb57c64f9b863272e70af68d72323fde03f0f SHA256: 864767646d6eb0fe94b62c4229364c122dd334a2c8f1930d05d7ffbdd9d836ab SSDeep: 48:2zunrC7IaaNss7v5+R3vBrl6fGrTWJA1mI:VyEzN+R3vBB0GrT1v	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.30 KB	MD5: e625220adc58e9c4e29f022371dbebb5 SHA1: 515c9e192c002fde65bf7ecc219c860749909843 SHA256: 8f1d865006f953c45d28d479868206473b3e09b12bb2dc81b4f91553ec46fc2b SSDeep: 1536:aG+xujotC/8tUErPyDw1/6qrI/7jhrAyQs3YNU6OBYURHLBrbw:aG+ztg8OmPXIvZAyQ06CRHpc	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	515.90 KB	MD5: 74952867d9125b6c73823696bdc4a4cb SHA1: 910534025d54d11696ad1455567a81ffba0ff72e SHA256: e04cb4a1efed40daff0cd266cc71bef4206673e079504fcf2523d6e0c945a79a SSDeep: 12288:4TkORlp36m/CvxevZ1uxorEbDtwsSyCS8I1vpBfzlXa:4TPx/exiZ/eDG3yCpUXfBa	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: 55332ac91112a029121a67237a61bc3b SHA1: a2e8111e827c4729583676bc5f6fca465467b76a SHA256: c4f73c6597aa8b6a9bb83aaf73a56f996b195fc0592d27335f47765d7cd02b72 SSDeep: 24:Z3dhw51H17qYHUdZ0TT5l/3qw7Sg0b7nIUk7DxNdB1/jPKfSPFK9xsGbWPY1mI:Z3dG51MEUdZ0T9lDqbjY9rDhPA1mI	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	3.61 KB	MD5: 3973e682306a074ca5c898d09f38201d SHA1: 800fdbc4de0c0782f6f3385b250e26f19b06633c SHA256: 13e92629799649c9a5f2d4b27fd7b6aad4e262ad040bc87181b7be18f859bcce SSDeep: 96:kjncKDvg5zm/jP5etped45Gg2Sv5zmxiz7w+hlm1v:0cKbg56b5eDV5t1v5zBz7w+hlCv	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com	9.87 KB	MD5: 7a0d010ff8e43e53c868bf3bbd836769 SHA1: d13d318a7d0c93060e2cead6744930db6e2b73b2 SHA256: c2c1dd53852a85d05ea195dfdb2198d7cc96166971b7c1d0f88007c2a60f204d SSDeep: 192:W2NC2DEiQ0CxN1EdCYpKCB/MJFUgalYviyPHYIA3YIA2fKH:W2QwQ9SdCAB/MnTalY3YgIAL	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[bitcharity@protonmail.com].com	0.62 KB	MD5: d6e41d1429e096e75fa8f980d18a1a7a SHA1: 6708e05b4a0992ef63a6626749bc19b85feef586 SHA256: 3ad9d4a515b10d23aa07ebff8f07a8f6e293821dfd78a639a6150d78056b193e SSDeep: 12:KsBJb5/UygRdP59x7/k1/ywXx0bRmIXTpIwxjLq6MUXbbK+cPY1mEYk:Pl/U9VJ/kswB0bR/2squXbbWPY1me	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[bitcharity@protonmail.com].com	14.76 KB	MD5: 3354b984261bf38cb94db6b36d1cd7c7 SHA1: 1be56b4c5dfae0a776bcbf9188103619957d97e8 SHA256: 5755859ca7a49cd5743d225c9b5b4b8010613134557b94da5c0d9dbef3c57f55 SSDeep: 384:zI1HM9AoGQUPiCuWdG6UVMe9bSZKFQeSQLD17axUzwGz:ka9RGQUPiCuQGFd9+uQSQxUzwO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[bitcharity@protonmail.com].com	7.29 KB	MD5: db545a8be33d986356c4d1232f300751 SHA1: b0ae479b45c545708a4b958f349ef31ba33b13eb SHA256: b547f5e8eeea2e9b61ba4257ce593d496e1620854a434edaa82a3feb676799e7 SSDeep: 192:pVMxg8l3z0rczj/WKV3igCMb6wJ1wiVkQZslSpjkglRzap:bY//WJg5GEsEpjkglRU	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.30 KB	MD5: eca7b45fa547e7d95951b4d5682d7d2b SHA1: 9ba8c7325e65060a5be24f4d224050d183b53aab SHA256: 81e3a76cbf162dcf5d10f77adabf04a454a0556d06ad2ea72e19db2e2da9b8d0 SSDeep: 1536:/9A2q5LKCfZoelqgTWVDwCdj/YExqeYci/rCQMtjvx7O0BM0LTnar:/9/q5LzhggTSDwC+E8CxQMLM0LT0	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[bitcharity@protonmail.com].com	9.06 KB	MD5: 9105d313452c199f3730abd33419a652 SHA1: 2ba6f39be1e684498de9d069a588617a39ee654f SHA256: bf54002e3352dc71babeac92bddbdb82b3ea1ed48f39366349f3b3ab33fed84d SSDeep: 192:m1ZqkRBKFodjz/uAhaRcJP+szvC7dAfwHaHVm3kSTuU/gmyNWp:+ZqkzdP2/cJP+szvC7qSa1lSuU/LyW	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[bitcharity@protonmail.com].com	6.76 KB	MD5: eabe3742bd38fa6d4a90b15bee5310fd SHA1: 39c0c0458a49430aef0c49cbe3d3bc86ab205f94 SHA256: 87dea71dc0c390f0d088f0ad427bcf4cd2ed5236fe106810e2ef61b6ec98cd93 SSDeep: 96:8njzRtuznVzSjbd75KbtAE9bVKlzTQHNABOCq3D/UquQT0rxB1p:kjHWzSfTKWKSzTQHNAUCyD/gxrp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[bitcharity@protonmail.com].com	3.42 KB	MD5: c207b3d164e00d47096c89453588705c SHA1: c29fef9fa3e7e0c0e2324c99f05dd39ae7e0ff38 SHA256: c14caf8563cde676917ee7a6784d0d0383ba09e90afd546ecde604b4302c0f5a SSDeep: 96:Xlydm1kcG/xq2dkbZmGSXSE+h36vFuIYr3AUfQhEs1p:XlEsbG/xq2WbtSiEp9gDfQOUp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[bitcharity@protonmail.com].com	8.15 KB	MD5: 9c9f99acfca295ba7d1b91a58a4e52b1 SHA1: 55ce2ae0fbdce5fc434079f9729afacd5d20e351 SHA256: 8e4e9210fcfa0e69dbe172c186904acd645c2dff476133abd18b559d41dae7cc SSDeep: 192:FKe3bmS0un5HHH7laPPm5NQqq9sWUdZnTZoiiqT3cf6Z9ap:se3qSpnB7laXmjQuJZ15TQ60	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[bitcharity@protonmail.com].com	0.75 KB	MD5: d864ccd4ead62c9d710d54468e1f3a79 SHA1: 4d41d79931fc307737c03d2259f6b39f23e3bce4 SHA256: ab16ec10d41111e2b1b5966aca8b00698961cbda4eba3666bb59dfe9e6f03afb SSDeep: 12:mI25kpuQ07HUKMoCGMdcu77hG7pA0nOV9uqoQaahx1rxXAZ93bK+cPY1mEYYt:m1CpuB76Zq7pAyOVR3a6xxqFbWPY1m6	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[bitcharity@protonmail.com].com	0.73 KB	MD5: 6b99bb323a90f9e3a32dad2c698b5f7b SHA1: 7e7dd62f70998ed343026c1891f23a0b3bc832d4 SHA256: 19d7470816d4b9725b42f0df8e98dae5c15262d43f4ab8fb1452aad9d1fb49ea SSDeep: 12:1s/PtdRYR9jC6D1s1YvnaVouzrJNcqL4TMeSL4xDQDKpbt3BxIxIQG+xPY+PbK+9:1s/PtzmC6xuZ1NcK4AgxqKVt3BxImQGW	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[bitcharity@protonmail.com].com	11.86 KB	MD5: d7fd6ad7dfd61e5191c01023d5945d68 SHA1: 3373d51227cc7d19d71cd205ce1ecc32ff73b73a SHA256: f860aa5897fbd51c9e19ec35109ea43e66284482e6f9b81fb1da5600e9fcb23f SSDeep: 192:N0WpZ2PlOvsOt2cJJj5HlMU6mF0wB3XvWRoMx12rEnjiwL5Zopwq59Ovs22Spp:usIlO0OtRzkU6W0GPQoMqInjiwLHoZ9U	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.29 KB	MD5: c6ce3f854aa6b96bbafcaf868be2bab4 SHA1: 1182fc6e9b3c572626220e03e37a90d287199aca SHA256: a9a62761b4a556aed857893ab5bda7dc8c96915f8cc6d3338c26dd9fde9b200e SSDeep: 1536:A3MrhOubwR5fV4YhEfFC6L7sAw/aL8AYOSQIG9rO6v:+QhOu25QfFfwk8AP0G9r7v	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: 1bc87db675d9e9ceadf77af47486df1b SHA1: ecea92d2861dc615de8661e39f4539ac3b13e5a2 SHA256: c8f369cb9db3c69e773e51609d7e7f4eca10d2285138c0bb8a182efcb6b3e73f SSDeep: 1536:M5E83anI/Ns10h1syJehryTIpnmJY8NxO7TaOms/77NnPGPz//F2Y:M5ZaIVS0DZJehOTKmy8LOn+iZOPLP	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[bitcharity@protonmail.com].com	7.75 KB	MD5: 330fd1ad4028a14a84450cf83e97554e SHA1: dc55b40b5edb6a091354ac478ddcb9c66296c47a SHA256: 36f5c21f33b4223274b3f3997b10231816437e1d5603dce97d39e337473c5334 SSDeep: 192:pzDhuibXgJZnIhDPwwahlKQRVHiDiCVJOE0h1p:VDEizgJZnIRwLyQRMDlOE8	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.37 KB	MD5: 0acae90913dd9db957d6d42e249f54cf SHA1: abe5bc124c4146e84a81a4589f3353feb84edaff SHA256: 6e2eabee6d67f7184106f0e64a5046d13f1548e3b1716ac96f80e13e61db19be SSDeep: 1536:70I3WGrFBGTuNZuHcst8aAKPRVzaxCODQCjOIqUdRUh9Pg1cHA5zUbR:wI3WGhvu8BmP+DRjPDU/P7JR	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[bitcharity@protonmail.com].com	12.64 KB	MD5: fab78102daea6f74dfaa77ee77ae251a SHA1: 55b84fa7896edac6d6459157e326ece225cf251d SHA256: 20fa23f090c60a16503c1429045a9505d223640d5f7e7497af0efc210fe8cdd6 SSDeep: 384:O9wFQOVpT0aQ7hfh+TK9N2vAarD+psKZF6P:OqfYaKhoTK+AavdD	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[bitcharity@protonmail.com].com	12.43 KB	MD5: 57bc6db6104c5a708d131ed819c924e9 SHA1: 6fbd7f4ec538566be709b0045a49285c680b3496 SHA256: c8ed30cea7c3750d37368ca1bef3ce4f71b4a89f633ccfec3099c755fcd54e6d SSDeep: 192:dha0JBfAxnYKd9moWcYTyZWjuUsPCj3tavd2WYZ/Tn78axydKmVCRlCI/U4xHe0Y:7a0JQY4mhcPvUf3MvdOZrxyMDCI/U47Y	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[bitcharity@protonmail.com].com	3.64 KB	MD5: 136b82b1af3aabb07bf9279d9fd0dee3 SHA1: 41ff1b3aa8c957d2c2ed0d69a63ad3475bcc5aaf SHA256: 9552ac8f8f7d0dfc9a62839efd01b4cbe263ae5c966452e7d881fe4dee5a31f1 SSDeep: 96:/kk6HJQj/oIKOaxz20n1XFVJ/lcMGetvZl1p:34J2/oIfy20nBF7/lcLeLp	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[bitcharity@protonmail.com].com	1.00 MB	MD5: 23182a7814787222c3047d4edc329d98 SHA1: d732bc32435efc722333158ac4e91054e1ad8ac9 SHA256: 97366e5b7c0f75e4107b289edc84dc48dbca03b1cabe9fe51f03299656d453fd SSDeep: 24576:nqhON6FbSEa15LH0bwxMZXcxGWfpwKiysPdUoekdG/ckB+SP:nqG8+FHxUs8WUPBGEkMq	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: 9d0a3ed47d8fbab3aa0d3e043422a316 SHA1: 12b5fc43b34782ad1eae5b9bd76b4dd8f51ea94d SHA256: ef14396686a1ff65ea56d817214acf4d2a854f2b7ca9200cd99a99491beb8dcf SSDeep: 1536:xU0SxVRRo97v8gLA516b5qR102gxfCyHYjrlw5aInOBZX8K:xwxT6tOOb5C10JfCzrl8ni9V	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.35 KB	MD5: cf984904917d424b8644ba523d668cd1 SHA1: 60f1c753b1368ad87918f7fa56e0faca89a1313d SHA256: e280f3685ea19d9d42f68da2af49ff77c382248d0e5592fa6659660b9efd767c SSDeep: 1536:/Uc3FIYp27Pnuj10DRlw1/GNSmDeEgkanp/4vdjDrod:/Usqz7vuyD+Flp/4dDrod	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[bitcharity@protonmail.com].com	3.31 KB	MD5: 9ef43eaf0ff969c80d19af061e6803a3 SHA1: b96b6407ef0d83b354f617d1712278c0e2b9e65b SHA256: 3e1529515da7492fbc8da4d7a3600f5477e05164364e369f17e0d271ba7de804 SSDeep: 96:IFGHYR7jDekNbcGQpXOrYBOZWJqX8eLKgZ1p:ISYVDfbcGuOwq/Kgzp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[bitcharity@protonmail.com].com	2.82 MB	MD5: ed23cf2ff05f45d99df5fdc49e1718ce SHA1: 2adec118eca310fa3e589e974df0a6feb0956a62 SHA256: defe222482e8a07671cdea0ddae79667e9a2d7f23b771732aa1c56dbcf35dae6 SSDeep: 12288:K6MCnTkkmiN+P9LgXWX9cyhWeAyw9ClXtYRx2rNg6R9TAZlNKNLcTuP+D5SkH:M4I73cXWtcwYywIaR0Bg67YlNKNGXDdH	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[bitcharity@protonmail.com].com	5.37 KB	MD5: 2e24a8e08392f1318c08c02d54e49a9e SHA1: 63e02deec9a306c6619847f307161cafc4ee69d0 SHA256: 02564e1c69a5509a8ba5ce29664e6495b2e843a5cf1db042061b6fd8dc5a8900 SSDeep: 96:nY4VvMgxWr1CZSuJfNqD+cmtMR/BgG1xoVjM+BIff0oMJv/WqN1YYaqo+sU8tpqi:npegxWr1CwuJf++D3GXY/os/WqNuPvp1	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[bitcharity@protonmail.com].com	2.78 KB	MD5: a82349297772d6a3cf7e239b4e19647a SHA1: 1c349c07da8e7d31291c5d8a4dc7885cea56a2a8 SHA256: 520cc6680d0215dae8b65d21bcedb75d72d8b550662bf96e09748ae3de18bd15 SSDeep: 48:Itk3g2WFrbo4dR3dOS0DB+JnsCWotDjzYnqViGNKhdBHibNWfWTsA1m6:Z3g/vhtOzB+izot/z+qIyiH2go1p	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: eca02dd598979cea1eb5b57273926f60 SHA1: 737424eb1c982b321335dd9e0c2aa00d1d80d1a2 SHA256: 3cc7e5af071ff4ddd2d72b837b4a0a7f5a94f9ab9c24b9730c13c4ddac06ef66 SSDeep: 1536:2weT+t/q0sFlDOeRO4fZPB75WQCEzFJOPzPPH9PPOnm8:UT+VqnL5OE1B1WUFWPPdP2nm8	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[bitcharity@protonmail.com].com	15.18 KB	MD5: ac2f0ffa362db65fa8df02b9292d0201 SHA1: eef0ae67b1bc619154d943350ddda86ca20a3901 SHA256: bdf3506769be82d17e8faa8f1d207e45abd18f5610a09c2ecbf0d6b2aa7eb975 SSDeep: 384:0B1bCOpvSINolZ/DGnnRAaerdLHsnm62L1bDge3x+cxgKT1Ian:sF9pvSPjDoRAP02L1b7hjxgKxn	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[bitcharity@protonmail.com].com	5.43 KB	MD5: cdf92b50a512c04e852a117c49d60879 SHA1: 64743a5e4103b51c2885f4934689659eb97ea4af SHA256: 56e680fd6525813878ae330965e45a2d63f79e617c0144ce45f32cdb65cd8342 SSDeep: 96:N1e1IDDwvY8U55shy+DJRmwBqIBwyVUUrfy3g2WwZEp0K5xSYcJYg4vdgD11p:jewp8UXshy+XBqIBwCa3g2WwZxKvSvJX	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: 685249b51d4c9147d5960f8eb209e9ab SHA1: ecb15c3d2bec0e17bf40c14ab5ceba123e89aa3c SHA256: 9aaaf12f90e088e118c5670673dd8bebe8b26edc544de96ee4e96b38f374ad10 SSDeep: 1536:Bo3UrjOjsxRnO26dpTaBhhcRfFKLdhG/vz/9UVjFWK0M1kcM:Bocjp7n+TaBvcRfFSoIj70M10	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: 8cca0a1975992200f4a3e3cb9676e74e SHA1: 6fee6aa060fd4f91f5e2f45e5974aa75b7da8969 SHA256: 003dafbcc621571a4beaff210acfb2e287a8e62158d1c641e71743bfb2bd5a68 SSDeep: 1536:P9evq8X6wjuUqV23vxxjnnslRzIRwv/M8X/:P9y6rk3v4llIR+VX/	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[bitcharity@protonmail.com].com	10.59 KB	MD5: 01fe7d8dde7a85b22c024943883a8014 SHA1: 70873f329120ad0e18b34c04ba06c970e2ff2f30 SHA256: 64f5fe5de399f400123691a3c735109316af274228548d71f520e2270432908f SSDeep: 192:k2CXvbQmKYiLjo2Bs1MeIVeYLcMX1ntWnCfjp7Gmn3dPJxElib20kCwCv4p:k2gDXh0heIPLca1ntVjJz3dPvw7xCwEa	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[bitcharity@protonmail.com].com	5.15 KB	MD5: 3cc6005862d926a554ade4188adcfea4 SHA1: 7df9b128ff0bd32e0755538277446c9360f765b3 SHA256: c3a92f28cda52c82a8c1dc8c3e3a0d41e8480c281045d4a8e923e118f939f2dd SSDeep: 96:P9pNjNQL8t9MvpgUWghouN+OrlfhBA1Al857mTtFL/hPnwGDGOgBV1p:l2It9k3RhuOVLE5+nL/h/wGsp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[bitcharity@protonmail.com].com	5.07 KB	MD5: 2dd54e63e22ce0bf6fc5b99ad59f88b4 SHA1: 33a9b96a256e565acb1f837df45cd2e1a7200cdf SHA256: fa7c143c7c8652bc0afec7680d90fce5e510a11bec47e429df982f85733c267d SSDeep: 96:RFsfSSdgRRm8WeQKtV4zripta3EnQ2OnO2qNV8p8GId/1xGJFnyg1p:RyKSURm8WeQgififa0Q2OnO2qj8p8GIg	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[bitcharity@protonmail.com].com	1.36 KB	MD5: c27a4bd4734f78ad23a9e9a03544cb10 SHA1: a3e79bf5a195a2cbd1094b5fc4c221c35f03ebfa SHA256: 64f61877821d21184c5a947ac504addf3c881ff64e940af1e43b43fd796ee720 SSDeep: 24:vEWyFlZFOmjYpETcP7Ecxijt9jzosZdTEXr0Cd2T4nVoKNFdOVVJvrZbWPY1m6:ClFtj67x+jzoIuFdB+QFcV1rIA1m6	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[bitcharity@protonmail.com].com	7.06 KB	MD5: 020f688cd71d4bafe952cdf569fd2cd6 SHA1: 31788004c56143f1f26dc32f1b94146ba73a87f7 SHA256: 58da6992957dc6757659cfc9f24ebefa0eeaf61232dd5d5f50e4473fea30ed66 SSDeep: 192:BdiYXdXPMrtXXkKXQFQ78CESTOsmlH0YUb0p:DiWXPUHkKOQ78I5CND	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[bitcharity@protonmail.com].com	7.64 KB	MD5: 86377800cbc78c83adcbdebad150ce37 SHA1: 5adac1a810c51ead01784c3d257922d6a454595c SHA256: 52993374d2fb81ad686a8321a9e93a2bd1c0abbaf743f19a1ffdcfb7f717ce4b SSDeep: 192:DUUGfwAiPXDPbNS7WSPOLSkZhvlArRmAp:DUHfeTIqXfRlArRX	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[bitcharity@protonmail.com].com	8.62 KB	MD5: e2487e0b96f07dd3c53fd8f48a17dd87 SHA1: de88e5523e9206b3944c8f22716f82fe82729388 SHA256: 9658988aaa0723eacd0fab8c89cfd71c84a39728cd21e88506a769981c7defa2 SSDeep: 192:oC/p9Vc8a+MqWPO4wa+lEDS8OmJKLyI+DmhnI7HFmp:oOTi+MW0tJKR+2IHF8	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id-B4197730.[bitcharity@protonmail.com].com	9.28 KB	MD5: 941b383279a2a00f831dff3e2c883996 SHA1: 89af087ecbabcb4da648475856a89b43e95d79c0 SHA256: f74f542fbb73340e9cf9a75599a7b8d3a9feabae2ae949965e8751d657560324 SSDeep: 192:tZE/JQJExXo0wxYDHJdhMaPmLgIIUzZf+ubLEteFhVyb/IbaeG+Y/blWN8lac0iB:tZEh46XoB0zPmcUzZfBbDrVo/vePPN8x	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[bitcharity@protonmail.com].com	5.48 KB	MD5: 7626efd61c3edf63320dd6ffa9820237 SHA1: c33fd81196d5159d8667ab02f8ccadf78a2ae9fb SHA256: 852219aec7c6d6aa2a0ab38dfe64cb968630c818ae04bdeb3bdbe18646c7d63f SSDeep: 96:hMEi1Pzg/zlAjBcNpkHzhJLLqBc7b8OiYwWUTZ646MA7tlrG1uZ1p:HAN88zhJLYpOmV9ARA+p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[bitcharity@protonmail.com].com	4.11 KB	MD5: 8bfa2927c3e286e5ea429bd008758656 SHA1: e84ed11832c133b320096479422025e50108899a SHA256: 99cf3d8f8fb5edd2728ede45eaae6d9ac16283a090303db208a9501131fdda10 SSDeep: 96:C4fDrsGrRC1Zlg/wjKt2/S83iXqtyyUhase5FmFvg1p:C4LrAg/FtmS8y6tyyTsqFmFYp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id-B4197730.[bitcharity@protonmail.com].com	3.54 KB	MD5: 0c7f0bf7a506a4cee60d769d6e0a6a14 SHA1: bfec500a0e9e658ec631de0d541faa4bda9ef167 SHA256: 42635dceedb58f7e50d9d0a72f8269edd6460723f9da9696120bea59c54a2703 SSDeep: 48:vXWhNMJVDeiAj0JhybvpKZ3ETSY31mkYZWKpGd0E7OSxL0+5RNbw4uIkXIKd9F21:vGONA+hnqLlB1KW0E7Xx7bwH9n4ga1p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[bitcharity@protonmail.com].com	3.29 KB	MD5: c3dcaf4888ba4b95d2eb76a8dd4ff962 SHA1: e49ad6b51a06596de386128c4acb92ca7e18ef29 SHA256: 858860e0488b9a86082f61f5499562e915b1713b6be2defdfa4990b558ae029a SSDeep: 48:s/SizrUD6BJ+RbG3yCr3BeN7reAt4cuWb0j5LkE1jgUuDpNpCKIeocWKOkA1m6:uzrU2BwFCr3BGrejbW4j2UjgUYAyOh1p	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.30 KB	MD5: 65bf7eb0ef2c03d6ee199ea12cc0466b SHA1: 78da13459ad8bbdaa36ad3c57cf213948cc79f29 SHA256: 9c39f25d00b1d0290ed06d23bbc94c3c7638dace27814e63a769d2de27c2b9de SSDeep: 1536:srnQfv1b9PwyQGPXNnB0SvLA4Xf1MqXtxGgSkG:6Qx9PwyPPXNB0SvEHqd075	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: 4102ec0df0649fd5cd22789a4c8b30a6 SHA1: 1a3d292708a401d1cdd7f192e90460d4185f6ac2 SHA256: c9236c1517a2e04966dd0905d2f8db3089ec6ce4b7c293d40f0751284c29af92 SSDeep: 1536:7bjLdhiFnkKQVPaU+DyGfx9biCY5xtTbz2BFO1eN10zn:/jBcdQ5+GKx98tTboFO1S0zn	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[bitcharity@protonmail.com].com	5.14 KB	MD5: 939b97132733cc43b6e7b7221a056c11 SHA1: f9c2aa4db8ccad10365e9c49470f4ab389dcae05 SHA256: d2a83c94fd1107172b95ca7a2e0dc74a95fccd427755d402c36bffbdfad914ae SSDeep: 96:+RlfiPm0jKQQh3StvFx1YpsK94ud3ZKgOlMQKe1T3gH0P4HCQQ86NwUOI+S1p:+RlfiuOyhCFFx6psKFZ5e1TwHk4HCmU9	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[bitcharity@protonmail.com].com	4.86 KB	MD5: 19903403d540e0d4b6210014da79dc94 SHA1: 3772f7c3b058bac21f1a55b223273660e3ccc439 SHA256: fe772b434a5f99a5f7267f2c66d6ff7299b7f5d241bcb4de4832f0ae260f26c8 SSDeep: 96:9StQnJzRGnxWwNQC9mF2REtCSACN07OhELQv8C2XbDs5Cd1p:9S6nRQxLKDpC0072OFM5Cvp	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.30 KB	MD5: 8095300ffad69ae1cc5e6baf50f12b8c SHA1: e0a1d6c10c6406ec5689d2a9cbec4daef3ef1b0e SHA256: 0204f05d4b4380a6cdedd2974c59c78358e0f5cc992e43d286eeb2195c2d8678 SSDeep: 1536:XAQNB5/K/6XQECWx2v0w8nbpOwMH4oe8BS0YhGv+l+5PqyWy6Hw45Z:Q60SXCW4xYbpOqN8BS9hG5PZWyEw43	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: ec67d35b86b2d824569ebc3ad3378445 SHA1: df07f9dcb48ad07cb3d7f59ec65dc6ee32a459af SHA256: 5d4652bc3d8d60d865f3861e052d9eba416a0b4ddd3dd35a61bb20afe850d8ee SSDeep: 1536:ZeH/nv35FqKsyaiV2h5XokZZJGvadOFUthRCMG1C5wt/F+VUz:Mfv/w425XoklrOm3RCT1ywt9+Y	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: b9457157a3c16a70d8b5c6c9e232cc5a SHA1: af3d1d627cedaa9bde1c4dbc8c36d2e5f4b9510f SHA256: cbc54f9fd215d94a39dce00b5094a3e43da0443cfb808a440ff66c94ddec13d6 SSDeep: 1536:ajeRI/3KybjC2DsaVTGz9N1F3sXMJX36AOnUPDlGX91eJxxxgApw:JRI/6ybe2AaVKz9NPsXMFqAOnUPDDJXY	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.30 KB	MD5: a96a9734233fa7a4b192d38b09ef23d0 SHA1: c75dd37d08c650632eb58faca6cf1066b0578115 SHA256: f9349856be9e86ec0f9bb32e35ec71940c146f728e280258a13020f496a5e053 SSDeep: 1536:3bYw0Pr8R889yfeXU/75QhrQkXRAl+okLA2lAr+0vtWL:3BpR8uyfMCUkSRAhfRrtWL	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[bitcharity@protonmail.com].com	5.79 KB	MD5: eef47805b758785af282b7e54bd2aa46 SHA1: 28eb647e6126847698147317505af32d2a6d9cac SHA256: 418a47d2134c13c44f21fed0fd3addf4ce3b3f3b481a85b1acd12c57286c39ef SSDeep: 96:6EagylbCsrxReTAG6FHX+ha1F/iDwf+XSv3Va0gfjm2IyYEQ+k91p:6E8lbr98T8H3pqwf+XSv3Va0q5IyBQ+I	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id-B4197730.[bitcharity@protonmail.com].com	10.82 KB	MD5: a3280c13380c9143e7eb203b4f45a991 SHA1: 156f10d6d3ee3dcbd27a155a692d98f44daa0057 SHA256: 8ac72bbfeaa9851a9e3266e8f1d8808d1cf91d09b703f03b54af77cd460e702d SSDeep: 192:gPhHIzJyUfZ8tF7YKmhYDXLM4HQrVi2HwvHVGs8yvZgBdcNXXNp:2VI9fODxDzHdfPl3BgBSXz	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[bitcharity@protonmail.com].com	7.15 KB	MD5: 12cfa6621f687f8065a16fd58e84eb51 SHA1: 1ebc07a9d96e7a4177860c3b2039a5c50fde7861 SHA256: abe2dc24f3dbfe749f61e506da6702752bb4072bd377e23be4882a98c3dd6358 SSDeep: 192:/Sdz7IoToMp4Bm8fkH7oV2EOB3f+RwBip:eIApb9a2lKf	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com	14.32 KB	MD5: 87b0a7d578081b199883d7e9fb95371b SHA1: fb6d37aa37dce59ff063609f13ec509c34eab53e SHA256: e346837bfc2221393ef3d4d5be8e302aa0d0383412e75d4e55fc52cea8a91b21 SSDeep: 384:oqjUurphKgVE1c66AlJOwjF/wV3QigsDq6ihd9Wv31XbAe:bgmGgVE1MAnOEF/wVAzsDjihd9WdXz	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.51 KB	MD5: d36845494452670888df9ef1eeee4e73 SHA1: 4a1b750f8a4538940a682436e4bb2ed54ff23df2 SHA256: f5e8c1bf7c6409f56ffb96f698f44ec63ecdfd894c8236c8d35950424ede380b SSDeep: 96:jiIlCeVvPpxt5bPr7JFx56C/NnSKaq2SZyp1p:jCeV575bj7JPv/QKe5p	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.32 KB	MD5: 1cb0e4803004f09c4843a4cfc55fa136 SHA1: d82fe1b83f9a59b5c20b49423acbd7a81b58fcc9 SHA256: df68913a4fad904395d2e3a08c0bc8ede7207f68ba9df60e0a8c0cf534c0a83c SSDeep: 1536:Vf5ad+Ni7sgVgI2RZuhjjW3xxEchf74le9TIcGe/Ge1/:VY+w7sgr2RZuFS3HgsMcGWGe1/	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.36 KB	MD5: e24d12cb9a6551d806be2f230d291404 SHA1: 37a4b71b9f6bcb395d8a2f7ad7e5e44aac31e26d SHA256: db1f64f4c56026dc65a16a05e0062fae758787bc9d748378e6d5f1aebe1cfcee SSDeep: 1536:PgichRfpn18D2zRsGAOhLokcnfWqHooT8kggOge8vMRAZ:PgXhnn1o6RlAALohnZGmeGMRY	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.35 KB	MD5: 7d7428307f5c9a28c40f20764a9a7513 SHA1: 602342c06c892c0018ee328f00bd73ca4fab0dd8 SHA256: 860c24f3d2ac38a78cfc53b7bbbdf9e84169cbd31650694c57e78f15b711aa12 SSDeep: 1536:h/2IDQZGOn4AYg6f+kWD5hesXmJAkq4RjDDnygOJe+Wms:hoGO4AY9fdWD5hekm6kq4dDb2Wv	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.30 KB	MD5: 3e592cafcee51dd27c9379fa2c52e234 SHA1: 045d0b4881704253430dda070aebcbd505764345 SHA256: 648c6b2fffea0765a8d0670cf0dedf2c9566d1d77a7a1e2655bcb7132367e45a SSDeep: 1536:DwMduy8VI9GEcPGLkss8WVeJk7MOAjpIh4+:DwMAW9GzGLk5qjW4+	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.20 KB	MD5: 4fc036a17cfdea5db385a680781d5e1d SHA1: b12ed30d344e09d7e1742892bb240740e1d78a64 SHA256: ac8e390aa825c04e6614c5461df47aa474115c9edcaa1215c4f93b0f202c6774 SSDeep: 96:yfURq7nhNSl3TeiaAEHMzgHGeWCk7MFxC1Qh1J1p:WUCN+eia9MYGeWjMP+s1jp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[bitcharity@protonmail.com].com	20.34 KB	MD5: 00d2c7d8e3f8e5e64848baa9b8ce2036 SHA1: 7a84c17c95636cccafad4f40eee146e74d953f5e SHA256: 2336971cc3edbf10768bfddf0c27ce83bc53c6bde7c7e216cc82ad34382742f7 SSDeep: 384:ACvFv8+lbie/43edR+begxPvzTxpFV8Q9WEWy7CjcXRgq+Fv/ZAN0BAiaGi:A280bh/QiR+begHzFLTWhQCDnvIGBpi	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[bitcharity@protonmail.com].com	8.03 KB	MD5: 1860d065d1c3ea403db5d0b0d3819e6c SHA1: b913487e8bcf920c9b177bd7ec727ad0cba300a6 SHA256: 68bd2296f54b45dc8f3619b9bd28e8d403ed1fc6a9ab5ee48596582398e52f52 SSDeep: 192:QbrbWStCLQAwIGQAwN+cveXlL0uVEQXYGr2z7bRwJRiLp:QbPtU/nocveBxfXdqMRiV	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.79 KB	MD5: 6a8f2ee94b3a48e7ca700cadbb645871 SHA1: 69b1b5d626f18b31b5fc343884e5b3a2b41c26a3 SHA256: 60a354e392d06fb4e7abf6eb45329941eaad165725e0c1ddd7180f4cae1414b3 SSDeep: 48:OW70415TvY8+HLy1lnICQQ8YDnGGc7ZsWcZNAsLexB8A1m6:3V3vfmy1tN7bWCAHh1p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id-B4197730.[bitcharity@protonmail.com].com	25.95 KB	MD5: dbcdf0bad4af9b8708a94cba9b5a1599 SHA1: 56a85e490334fa1bcdfafba36c5109f5b9ec535b SHA256: 56d5b25862a7f7eab01536339e4aedcadb48bfdd1d7f4ec0cb912315a60b41a9 SSDeep: 768:ZmrO+ahSSW8CoZ+B0brsR5U6hsvm/pTUfb:mzanD3jbIRS6e6ofb	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.03 KB	MD5: 8907e15342602f61e106c5a74c602f27 SHA1: 9f1a02659e96f2391bcd57b9fe905ad42b7ebec9 SHA256: 91bd348479d8526d9e10a96bdb1b6cbc1eee2d3be356c5c9561b93467c4870d3 SSDeep: 48:x2gTns7yfviTIXumuRg2CFXt2jy5gQKGASollk7NZ+FZ6RA1m6:4gL+5X/C2yvzA3lulC1p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id-B4197730.[bitcharity@protonmail.com].com	27.45 KB	MD5: 2d29e75ab2643f0799fd8ce588fae83f SHA1: c5093ba84c598d138dfea127eeebe2a4f702fec1 SHA256: 6210363f922a17240a4ac718d98ffcd5d564b0382db4238c84da87b977209429 SSDeep: 768:5TqNfEBbCuLxbqDtHNI819p1Ij0rzY+1bdP1lUy3o:5qiN/yNV19p1Fp3/Y	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.90 KB	MD5: 78c63d7413f370b2ab953bb1be672120 SHA1: 56e7917e60827abc5b1aacb988e9f646524369b3 SHA256: d78133fff4ae126cb63e8e4a27eea99eaac08430dbb924b97feb29da27571271 SSDeep: 96:GuZ9H2sXL62WE9lv/dQpT+4h+MGjqRILZkgD1p:D3WKXS+YGmiLigpp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.18 KB	MD5: 6bf4cb1b7fef402e9debdb7af7ab0d52 SHA1: 7d127667ae8b469e21de1c607985c299aaffc8b8 SHA256: 441fb49e9751370ff5e03b3c4c561da240600d254e193dcfce44d5de2c40539a SSDeep: 96:9m7n5wj3gW1tbuj/oGWcPFMhytVViEgQSsWK1p:g75Iw6NziFMhytVVKQSf+p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id-B4197730.[bitcharity@protonmail.com].com	5.93 KB	MD5: 40149550c0c41f3ee1248b828a5c0acd SHA1: bd851eb846fb9bf3065606228970eedfe70d1083 SHA256: 4bc8a32fa087cec73b78460fcbb13d32f7dbb31e66a8101395683dcff60419cb SSDeep: 96:pWOagSetMxBc8M5HKJgA4jRcdF/tw49H71RSG1ErzP9YD2yNDrXSPFFMFZQ1p:0OHSeaDc8WKrbIr2zZXq8/Qp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01545_.WMF.id-B4197730.[bitcharity@protonmail.com].com	7.43 KB	MD5: 0dcbedf180d8318e0fb2266202afed2b SHA1: 7023551cc4ee130d424a7e4ed717081be57b1b00 SHA256: 290cd4c4ee5d7d8f665b19113731f41ad394e657447bfde0ab578eaebce75ac8 SSDeep: 192:2eUsRNO1/O6pTEFEcFz8m8fqmglVcRZqPp:pU6NO1/OIThGYqm2D	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.29 KB	MD5: 8bdb04e7c3a1a32030a18c18915fc1f1 SHA1: ac992943fdb10c8fe9d215113a35b68e3d1bbfb1 SHA256: a9a3937bf2a522ffb7956332911749ca2608605a8a2b059fc95548096e4bc3c4 SSDeep: 48:ErwtgSJ2/US7INnisM+lWUvJ0awl5Lpn9aGmkjFhZHEA1m6:awOSJEIVMaWUb0TVmMh1p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id-B4197730.[bitcharity@protonmail.com].com	7.61 KB	MD5: 92e1fea523894fd9585f8a3ad02a8f01 SHA1: 3fef0e8775cadc2c1ba3822f8291e7322bcd8a35 SHA256: 32b8bf39db4b0bf6ffdd460e88961eed6934956d8f9cc1b4d496e9e4e9dbf258 SSDeep: 192:FalxTjaPXICMqHCqkf7Hwk4H9kGdhwIsLRet7Rp:Fojaf1ML7Hwk4H9zAfLReR	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id-B4197730.[bitcharity@protonmail.com].com	6.71 KB	MD5: 70300e0d4cb3d659195098931f022b51 SHA1: fa08715b86a01ca44e069b18e0ff8357d2a1559b SHA256: fb91b0b2feac86f59e3f28a8f51b47ed7fb29f9e84a2dca11f290dbd1e3978e6 SSDeep: 192:7eDZbXq9giXlqtF/YcFKnWjDatgoLtwOWvZDDp:OZbOXkXNsgoLvk	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id-B4197730.[bitcharity@protonmail.com].com	9.26 KB	MD5: 69b8b51341dda532db20bca81f0c902b SHA1: 62eb2f7e365ec19506f8276981d50c0fa097c64e SHA256: ecbfc858db9f75d9e0194ca5fdb0b6141571b6bcb14c5ef68807ed73f636bfce SSDeep: 192:b4lpkBxCK12QI47ZX8HoUnCYzT4CtpDXOqW20XhavHfmPKy2Upsp:k8fC02Asoshf4C/DXOqcXMfqKy2kW	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.57 KB	MD5: e520ecaaf05d040f9d26bcbce3b80696 SHA1: 7d49d5a4a25508fb0ae712cd38dd9848281ba57b SHA256: ecf7b364369831fd29a64cbfbcbdc052a46171e583bc8895248931ab63690cbb SSDeep: 96:UGFmXeWDIxvmMb9VPAF0YU9T+NJ3u9WEE1p:UGFIeW0uM5VV5+H3bbp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.81 KB	MD5: 7856344533eac5c8b9e8b4c3b77343ae SHA1: ea76737432dc3d844ebfbc45421a14a489ec9c32 SHA256: 8ec2fc0eb89d0924eb5faab0bf7ec8acde18b764f05c3f408925c077ff973c4f SSDeep: 48:4h8X/s+9USmeWRRtilhzSDrEbbnbJbPdF4bFhc2ApZHegW9KwmMrG+4QA1m6:YC/590JilhzSDrabbZfgrc2ApkgQNd4J	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.93 KB	MD5: e2eecd80c7a545c74cba4cfd1fa08f70 SHA1: 096283a0f65d3c39364ffa2fc864238fede33c70 SHA256: 7979979be0155764d2d65b782946f978f66cebd3f49f1d3c5e26c47a56775715 SSDeep: 48:G8rU++cUxm+GgUOa1pxYH7zCNzch4H9xWAQ5DveJG/JAimHZ2VMJA1m6:d3+Rxm+RUOa1px4ge4HTIvUimkVMq1p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id-B4197730.[bitcharity@protonmail.com].com	6.15 KB	MD5: 7b2e107aaef0c484546794da154c60cb SHA1: 0215e18f0664cf79903579ff21f0c6d80b469e1b SHA256: 906d317297894838c142021fd66fbd45b12edecb0cfa9547da27f2074595952b SSDeep: 192:5ystkWup61LTYKw/rUMLZ7dd/kjsVEh4p:5ysWWup6arLL8juia	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.36 KB	MD5: 1fb841a730cf3ccd930fafdb055d7314 SHA1: 2039288274e8eb1ed7343e6464302ec086a39da5 SHA256: 70e0de87602cb6bdb74556941d21508e8147851e7ae4cf1e08e1bc400278d3cb SSDeep: 1536:zhy2/ccsL4RxflGUhHU3XN3KLABP5Ah5KQvTKgUrPZiTPT:zo2NsL4XdGWHUMLAxCPKlrU	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id-B4197730.[bitcharity@protonmail.com].com	6.71 KB	MD5: a4265f37312d0b362882a4815a526055 SHA1: 0ad9d9fcf98c0f2f2f84b469716cf362b8f303e2 SHA256: db759132d8cb40690f1432a3aa99de59568382a72c20beab568087e3be451aa9 SSDeep: 192:JDCGBhun0CT40if2gpnIO54KfwYL+YLhUSp:2024P2glrF+YLJ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.30 KB	MD5: 948ba24de5512dcf51bcbdc7f69fb39e SHA1: 50ed74d5d61eeed6f5caa0c17c7c661946a6d41e SHA256: 28ffbffbcb5029f87cf5ebbe27bb8f52aec118946751f9712786034f5fa997b7 SSDeep: 1536:48A6MTWYSrQkR9vSY12+FWL2/F3TS7GbaZURSqP8xS:4CRJrQkR9vSY12+Fj/M7MIrdS	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.37 KB	MD5: d7aa7e6140b57b8f67e396f7a75a58ea SHA1: dd51d436327641162d4042551d2f21a11b9629d0 SHA256: 1ea319a7410eff99c51ec1c9bba4cde91475f5864d8f893dc63e58520c960196 SSDeep: 1536:vTa0cjcs6T6+CRbPgZEiqfiMxqJS6cuoWs5xNExJpzm9pn:vFjs6TlCRbgZERTqoWsVExJs9pn	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.31 KB	MD5: 3dd3bd1f22c48ba81db4f63ca0a91b62 SHA1: 53974693f0be8f987165d9c61c74d751236bf38d SHA256: fb0f5456536c554d494a3b4779b5dc17595b6174d0404354190291435e0b3d11 SSDeep: 96:t75qkNTs4sR4ZYm9zcDW7WZbiaxRwOJadTB1p:tgktM4Zd9zchtxaOyTrp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id-B4197730.[bitcharity@protonmail.com].com	4.75 KB	MD5: 55eaa0d3e3fa667d5cfc797372ee1b09 SHA1: a03c5ba9a8036e46aeb0b8abe3d0d240c421a2f4 SHA256: 9653a910992b3a8bb650b8e857e2217ed260b86d4d7fcea70c5a70c58b9f81df SSDeep: 96:w1uLVRG3YdTEc0ivb4CnELzFr5e4K7o4T1vhfMhO5RymFQ7rHa1p:w1uLV/9XsvLzF5MpT15fMo5R5FQPHOp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id-B4197730.[bitcharity@protonmail.com].com	7.73 KB	MD5: ac0a9e9a7c61d108d1ce4c2e1b19d131 SHA1: f90721f3f4223cc777bbada2020dc15ba5adcd88 SHA256: 0526321f5659fe489f4a7321add4c4cf3a3d08b174d25bfb9c93e961ff5fb621 SSDeep: 192:bqbAIIz6Y8iARamCbVnDz9uXJIKAZEuAli7Y+4p:ebAJFDc5IRIWY+a	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: c636df3ba3d2caa399902c75bc52b379 SHA1: b7690aa0a8f5079725c9c5f369e00918f6913409 SHA256: 18465ab1525a061d0ba5e9e01f01ea79e3c270fe678854fdf8d95e48bc3ca8a6 SSDeep: 1536:MBQqKoTEur0uxpeICWVsbzQ9HUJsQR71RXvfY7Q47fiO2oxy0K:xUIuIWpeI3VsiHUjLXvfYk47K	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: 31debc2b945b8fe87673ac1ae9bacb98 SHA1: 3fa13c0a9cb75dea8e3a3571da87247a204a5ba7 SHA256: 116b366d2199f5cbfd3e260e9e35ca27dded54c88065a7ea5b947a6863f2f7d1 SSDeep: 1536:5oO00TF3d9K76njgu8bGgMuNPuK4Uv6ousUEgRJd9:J00TF3d9K7Mjgu8bG4eUvLusg3	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id-B4197730.[bitcharity@protonmail.com].com	8.53 KB	MD5: f62b7812d4781f8a0bb769e4fb9efde8 SHA1: bbbcdc1eabf608dbbce0d926beb5ec86be905d10 SHA256: d13f20ae91f52e20b3d3ed793c82d7f636c08e2072d3efeedc49960a84ef84dd SSDeep: 192:KL1LkdUJPPumToi6S/EVuiQ85qB9rCzG4qWocoT26dktJhMcrip:21gMumTP36s8QSzG4qXTdkLY	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended.mzz.id-B4197730.[bitcharity@protonmail.com].com	41.88 MB	MD5: b790da90d0c6c3db2d470430d72b0adf SHA1: ba28aaf3de47f780fd99f939c6190d4a029b4166 SHA256: 9079e442aee573d221fa746a405405a2553f60de994e7db863d6eb28640df578 SSDeep: 49152:cpSdqU6tLnvVqSK5G22mDgBOOmeGGiU9Erqkbnt7QTr5+Oc2EI+8dd0ZwTse9QOH:CtZKH2mALErq2nt7rvfI+vZpfQ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.33 KB	MD5: 6883e493f7882bab69e82487864c7336 SHA1: 8b97436a7973f143f45fe9d26d9a96e86b86eff9 SHA256: b57f95a10866ef551439d682b2dae340e8401c8fdebba4601ffc2f7a49a33aa4 SSDeep: 1536:zZ84+euBYxjMAGo+HbruV+N4pPVgtY/2z25XDEqs3k5VQsw9cuQx+Yp:l9uijMAYb6VngtU22VEqs3k5V1bxLp	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.33 KB	MD5: a26869aac6707213721ccf1fb0511cad SHA1: 426d6deeee46cfb409e555420736215ec6b9ef42 SHA256: dee6136550cb070e61cecc16db286e6f26a65954120b49e52dd5bf7c4491ac41 SSDeep: 1536:mow10DqBg8fw3AKCqeH/8nXsXttl71CeuRcutLkJQx:mD1v23AKFeHEyDecu1b	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.32 KB	MD5: 0e86a4ab1868429fc73d3b7617ec25d0 SHA1: 6fd8b7581b3c4e006e736e9e8055aa2a1b334b79 SHA256: 1279608fd616ea7ca106c327879fc1227195a8067f4f9e1b98380a861d1ee544 SSDeep: 1536:kDF9qU/lP9bGb4y94ti6uJFRdrM/197A/9tIY+6ZskFNfB:uHlssVsLD4YRZzfB	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: 0196549e03642af614f633c68f5eff04 SHA1: 601d62fd14bd187c36a729c1c66696b63fa7395f SHA256: 2e2dd3b1d0ce908cfe7e41557dca72a7c04e98042d9e37f90b3111c4492f96d3 SSDeep: 1536:YO85vRp23gxhYPbC+RSSnBLMAYG42AFXdbB5VkCTfZ2Q:sp24hwb/EST0BVDRxl	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id-B4197730.[bitcharity@protonmail.com].com	7.86 KB	MD5: 4fc733d161d7768a4acf3ce7b3109fdf SHA1: e048ef6f0affaedfacc31030521fe51645300fb9 SHA256: 74f21770e587d0a4ab5702219aa56f5e88c0ce875bf81a7782180a1ef57d2448 SSDeep: 192:me5R+DWgsNJPgYuVunYu1UPR52hcLJACJesF/xW/8tSxW11Wqngatyy7b0ip:JY+JPiEF165ycLJAM5xWpWHV4Ggg	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.38 KB	MD5: 1f9dd4b8398b67a46a00afa5cedf4451 SHA1: 706e420e256451b61dde04a7a102eda68c36452f SHA256: 75612537067f12c97a05d1aef7f5a341a272e18fa9cf1807485ebbb86e5e4ee6 SSDeep: 1536:kiH85LSwW/anJ7cd6pZIL7rnUxTCpR5yBt0YBJC03BKGHTt+H2lMRfbqY:tH2GeSEpZIvrQTSsLH+0zt+H2QbqY	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.33 KB	MD5: b021bd0e54498422c6f4bef1ba2a0acd SHA1: 50db7fc3761df9ca2a049652d08a7b9b06f74616 SHA256: 7c1db9152c4191c5b5f689d6e70ff15437abd18aae69a8fa88c7d0dad3a9b3d0 SSDeep: 1536:dEJEUjaFFCBZmvqiu5hj70U8krQ4vpMd2mGdOILXju0:S7WCyQXjnpMTGxb	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id-B4197730.[bitcharity@protonmail.com].com	4.43 KB	MD5: a3b71295dfe4f45c3a565635a6957e7e SHA1: 5b173c3c2dce7d4d2dccd2159faaf5a4f8848c90 SHA256: bfbbd66a1ea3d3032e10918fabe43a9ab03f71be915a09725586d5ebe0d3a361 SSDeep: 96:KvDkpjCwbzmxvBjeqYL+gplHoM1YhfpFep8LmhtuXZ1p:qkpOqyx57YQMqV0Fcp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.51 KB	MD5: 4db7ec1cb1ef3a14347c4f4ae81e2e08 SHA1: a7363b32e3df26312b8142b9cf9c542b39c057d3 SHA256: 0a4fcaa9826719dfff45349c2f8d406220e0c3d14a533f18cf2567468946f643 SSDeep: 96:w5P9BU+WCqnDBOHSEnGxF1a2o7aQwUmCruKU1p:w51BDqVOHYxTar7aQDR3sp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id-B4197730.[bitcharity@protonmail.com].com	7.86 KB	MD5: 54ba75ae575b4438918b86f95525651f SHA1: b117b608c4efcf48a225268e1e18cde34da108d6 SHA256: f4b51f935a9dd6845503661f4ced08ac8acd87e083779bece82bca5c59fc92bd SSDeep: 192:DTl+YLmnSCh4RKgsz3k+dPYYgu5PQwWZwauRsMHRYLZte0p:Hl+umnS+4RKgs7bdPYYgu54LHuaMxYLn	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.31 KB	MD5: 73cff316e88e55c310d6f0ffacf599a8 SHA1: c73cb69624937a7b32f4094a8d7117fbf84e88a1 SHA256: 9c51abe776708efce9ae98f5289d758dfd1408223d768997bd025e59176c92bb SSDeep: 1536:CU80lhBlsEL/P9/7+pfx1NrW2QFQImT7p36W+:X1lhwErgfxXW/QImHtO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.30 KB	MD5: 30eea5afba5f41d213c1dfdef7accb69 SHA1: 2fbece5b31136bd14dcd155f38f3e468ff9028a9 SHA256: 9f671b6e62f16981d28d00d587f111281c6d851753b75803def1db0a9b3bfc4c SSDeep: 1536:Ml0PUinREdW1Vvs5cRmek2GTLGdtIZJXs/UdG0KaiaV2RBzzk0glAZcEe:a0PUHdcvRI2GTLEt18Y0KtA+z3je	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id-B4197730.[bitcharity@protonmail.com].com	5.12 KB	MD5: 6db0fd29bbd3b544b7c9518e549653d5 SHA1: 56524634e7629801b84a0fe77b8f38759a43e296 SHA256: 34e9be528a812fea326a092fb20d1100adab32c26334a3e476f2b03a74fe0ed6 SSDeep: 96:HjJguumnYdaMUsloXEiyWMacjBnItNmPRIntW/weZrdQyq0Sd1p:uuuQfMxoUWBcj4YOo3QyqJp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id-B4197730.[bitcharity@protonmail.com].com	4.93 KB	MD5: 89b40525538e282f65f06ecdc3f30917 SHA1: 0042c4b1efd9af72d7e112ef8e9be682f5d5b940 SHA256: 6c2e2b6ac9724e1ef15f482e7898bde06cb58ebf7ee0607ab67a5bae18ff7509 SSDeep: 96:DuodppZxHmUi2bRL7kIaB7EMdc1501t9GfZ0xsUhjM+bDfcgfo59nzZZNO1p:6JdQV7BSZdP6ZdUhA+3kga9zzsp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04355_.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.39 KB	MD5: 91f33fce263aa5b3aaf66301b8466364 SHA1: 8d424c1e16286e26323d45386a7e9ede6773e274 SHA256: ea43bacbd5b0eb187afef8b6abe5c76de5ceb9b2e15cb31312468042a04adb78 SSDeep: 96:AQ7KNWqlruYCs9BuBnmu6DxA5Lpf9HSgYb1Z1p:AQOYXYCsumu42BS1b9p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id-B4197730.[bitcharity@protonmail.com].com	5.00 KB	MD5: 1a67ba5dd4ff0efcd0ec50b99e27a1ff SHA1: 18747b51cc39086a8bed00de035423ec8e290540 SHA256: 9b707efc027322c347a7996c665255f9c96d82ec0f0b6c86ceab205616f75305 SSDeep: 96:KzrLpL3TmgDU5Wvr4dqEuDzc7FJ6/DRmWLkDYrjoikU771zjxmMYsGlzp8r/o+oM:K9L3TmgmWT4XMzo6LRPBjoiddjxqSQ+V	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.67 KB	MD5: 7c7107e243c795f02525a8c32efc2bbc SHA1: b3f9780712312e1ba32a449dfec527eb9e493cf1 SHA256: e215c77c14c7683949fe0b3f440c1396f67c066e939f627511e7f0863919dd31 SSDeep: 48:M2QLRt3ALw52ymosKNAY4mOot5Qv8JuQ1rNHBEJ5kVRkGl7f2UachVA1m6:W7QLMfsKv4m5jK8JzHBEJCnVeUaj1p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id-B4197730.[bitcharity@protonmail.com].com	26.50 KB	MD5: 4f881e0d742cca60762438450561a3f4 SHA1: 9113d274d87f61ffb43bffa5d69a1bac798a93d8 SHA256: 24a70c7fa6ce4c9ba3199e23f49ac2d3a5e8609c757f772694ea546c0df1ecb0 SSDeep: 768:LbtoMgAHNqAo7IAJt4MgP78tWjgF4+706vX5pYZovI:t3dovJtzhtRp4B	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id-B4197730.[bitcharity@protonmail.com].com	16.04 KB	MD5: a89e5f96b66693cf10d6d8895b1147bd SHA1: 6fcf60f9eb357ec50005fa0ee81ff8d1eaa6e11d SHA256: 6642d8ad892dcee28d776db64e684442dab85e38998abf265ba58a7f2d612069 SSDeep: 384:MTCXyeeM4DTlHq3c78ExNG6kIIJOdP5Pj9WPps1:MOXyeeMQw3c7Xm6kIuOdrWhs1	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id-B4197730.[bitcharity@protonmail.com].com	11.61 KB	MD5: 7f7eab11d14fa91a35e1b2091396ff5c SHA1: de58c7fd75b57acab0ee85e3bb38f83e7e0e6ef3 SHA256: 1b78ab5c8980c1fb547cb4fe579696ae24f293961dede22d73f3f4ab7ad20945 SSDeep: 192:/Iz/X2L06ldkrz+SdxHuqFlE2j+BYu7WlH41QAfrGVIwSp8Sp:/Izi0fz+S2qFy2jUYVH41QdSp8Q	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id-B4197730.[bitcharity@protonmail.com].com	28.51 KB	MD5: 633f68ca90e72b2262eab49e37faf3b2 SHA1: 536bc7dcc850fcba46723bdb4cc772c4bc2912f9 SHA256: c994e112b6c0601abd52ab5964a2aa07e99e83150a979533c5f1b0d5e7c00300 SSDeep: 384:dBjf3tQ/d/AraxC298xl1NzJbkBT655Ao2l/ewnHWigbC3l03jTXciclVBrJ4vZZ:dlP2FW298Hjzyx6556l/hCwQPYZ/6V+q	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id-B4197730.[bitcharity@protonmail.com].com	17.07 KB	MD5: 43763932802d2afd5cc098bdfc234142 SHA1: bab5ed69542cc35c6723f9e806b667639feb8360 SHA256: 518da8605ffbe17a7a60b597d954802ae5e7cb7dea413d39adaff81bc815e49c SSDeep: 384:yTpqMsTgh5vk3ZpqK6x54p8MVisUxRg1eNw9HAop:yTpqMs7CKCcViXxq1e69gQ	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id-B4197730.[bitcharity@protonmail.com].com	15.98 KB	MD5: c61351fea3542add7ad9857445c9ff8c SHA1: 0ce2f6e582988e4fc38c93feae98e328e36ffa2f SHA256: da5ef55456e13a372e33176107f688a738623de398e9ba9c6bc022ed2d31c681 SSDeep: 192:ypmzDEGg4sxw+xOQOgoi7vtBK/E/Hwc7DEHiPo3zFcCnCml0juzF9ZmlIUxfHMQx:ylGg4sxC8BK/a1DEP3zFcyCm1mzHM0	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id-B4197730.[bitcharity@protonmail.com].com	16.53 KB	MD5: 2b9671a686fdc31a3225e84cecbed0aa SHA1: 5a407d214feb9cbeb32020c39d9ee6f35b564bdf SHA256: 86654890f3ee79e6b20b73370dbf4a1af369656af155f7a0b1e6b1086b040864 SSDeep: 384:uLjtmSfk9YiIYDC6hitAZ+QAl5gMIwfsZR56GI:uLjtVk93IYDCRCkQA95cR56GI	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[bitcharity@protonmail.com].com	1.00 MB	MD5: b8ee3c26af6b68cac5a29c632ca4f5c1 SHA1: 622b1e0f1d57429078f075469071057ef422ee77 SHA256: 8e04baf104b94d69ab6a2ca63f672838ee89af572cefe50887cad532b87b3d34 SSDeep: 24576:l7BnSpURkciw72NFh3Ysgy6+zc4yaug3zqjCJwUVIMcD2oW:l8mRNl2Nf3jgX+Yu3OjCZx42T	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id-B4197730.[bitcharity@protonmail.com].com	5.04 KB	MD5: 9e930ad3b275cc8d4621f512dbcf5b32 SHA1: c1c2c1292ae9ef2420cf7f59ffad03c208ee198c SHA256: be420b7db8009c0005135719140a5980e3d801ff4ef14bd6b99617832936946f SSDeep: 96:R656hQzwRNTBycIZg2shfJNWCloykyfl7hkKQnLns8jqYyJqlMnTyL0NnO0n1p:w56h/LTBycUg7WCkO0LiJ4MToenO01p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id-B4197730.[bitcharity@protonmail.com].com	4.21 KB	MD5: 4e9ce47e3c2393cc493da5a785fa5bcf SHA1: 456d9a3013494d7424c9b5f2b4011982fac61fdb SHA256: 6718fc3f5abe306191c457f6db66685b537e6608bc4aff1b3d489aae1b3f96fd SSDeep: 96:kMgZWjnQtShjQO3c0XAtVdCFY8Lkj1vlUGTLALrm5uX6Y1p:xgZWz6Z0XKCFPLkjP93Afp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id-B4197730.[bitcharity@protonmail.com].com	26.36 KB	MD5: 47e62da4995e16d10c494a9e267f4a19 SHA1: 7d9e2a022d15de8900bf1115a4e42e76a95a844f SHA256: c692a572f7921572f86e36c9aba43a48876386e6df4ae79b40d9ce8c3c93ff2e SSDeep: 768:h8+UaeLlQInAedVeJ+LMsHlVBPRGZfeAXcWH4+hGL+:hrUaeLKWLMsnBPOtsrs	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id-B4197730.[bitcharity@protonmail.com].com	24.00 KB	MD5: 75cd49f14c8cbae4b31fca37216e71db SHA1: ce934a62534d8dd2f0fd87c3e89fb82f6307db29 SHA256: bccc66ffe15260a87205a136dbad4360b7bddbcb2fb199298dac8cc96e665318 SSDeep: 384:AnBjqrGb4oR6gjNcPWe53xb8MaHlxBmmvF9iGOW3AiV/WDqD/2wG580mP745AEDe:AnBjuGbcgjNceOb8zbBmmvqGBTVBPoDe	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id-B4197730.[bitcharity@protonmail.com].com	39.50 KB	MD5: 1a47286b362fd398b0243756fbd698a2 SHA1: 6adc638774a6d4df1b8c034026d4e916145cee12 SHA256: 6060ea7ef7dfb7fd932a67e8978619b676ad659ace5ed0b5a740622226f39b76 SSDeep: 768:EC3G0qMyqtB6oUBLQTF4gjcqmu718Od7QwFPg2V+lCKt/:3rGoUpGF4gwYFEN2VA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id-B4197730.[bitcharity@protonmail.com].com	47.11 KB	MD5: 36517ac97b793becb471b5d4d6549c0b SHA1: 48ee9425cd6eac14de617cf6ea63fcbac7c297f7 SHA256: 53a761ad48f58fb9be8024e039b3bb66a9a7e642b1f01e99b073475d002f4b74 SSDeep: 768:j/CaH2Ymr9+QHD+4FyDYE85+8/2tOmXXeXUpPLE+aDqkpPLFu+a2+7cehKV:j/yYmr9VD+4UG4OmXOXndjVFu+aT7ceW	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id-B4197730.[bitcharity@protonmail.com].com	14.43 KB	MD5: bbaffe94d21b6381bbc707fdca03eefa SHA1: 8a0e73f134b29129075a310c4ba323f3a4abf9b8 SHA256: a6d1a12928624c5215f2d5493c54f21f4b6cc8ae3a2dda95443deef6728795a0 SSDeep: 384:fMK3MXU+juDS4hH6eLFCHU35uk1Uw2g7duTALaM:fJMXvKDzUeG+5uGXIULD	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id-B4197730.[bitcharity@protonmail.com].com	46.90 KB	MD5: 7eef62cfaff24173d4877657cf8727f7 SHA1: df669ec05e6d92040af42223f1b3d6b903c79f1e SHA256: 936d9e0543d69de6072c8a03cc082ca3ed6e0be7a46c82c312b246afc0e227ef SSDeep: 768:pRDmpBIZp9/osog254VKoj9m1ZDv0iWICSNmrpK8ZbN7vwmZDc2PB7W8+hpWbN5d:pp2IZroniVKw01ZDvWPSNpEbZ4mZDckJ	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF.id-B4197730.[bitcharity@protonmail.com].com	20.31 KB	MD5: 419a28d9a7b6720c7bc2c35f2bc0f1e9 SHA1: a9ed051597fac07ebfda86607d07ac6d491fc37a SHA256: e7b240926c208a9e06ecc020629baff11f004377c8933855891e04ac7900f90a SSDeep: 384:AczeOftRFYgekBnDp0jy3ICIRa7CMEpNmei2u+BemSQKjY5:RvfLpx3ILE2NXlYY5	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[bitcharity@protonmail.com].com	8.01 KB	MD5: 27428bf3f5d6186f520c682caa739d6d SHA1: 3b29ebaa3a715792d6c0bca7330d1d55f139635b SHA256: 997de508a1b6742fd1fd9bd1d65345d86da483bf456a94f6c97a99e7bf8d6af6 SSDeep: 192:mvZoVIcMVxURr2cYQ0BNOXQU14ngd3i7cHy4VD7VW5Pcp:mCIcUxUd2+eNeQU14gd3FHtVCO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF.id-B4197730.[bitcharity@protonmail.com].com	19.95 KB	MD5: 449489a472207a4b964e292331979ca2 SHA1: 5d89e9cf26487e001653454c18fff823a393ec45 SHA256: 05375677f256a19547a34e00d1e8d39cf4e9527b3d234847b89a04733fff6f45 SSDeep: 384:qitTQhR5JarsjGMEpuudxWU4sRRJ1upeCL7ES7bbBf9OjidBw6:qiST50rsSRuuDWU4s4LF9Oji7w6	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[bitcharity@protonmail.com].com	13.43 KB	MD5: 49ad50a41ed481ad01599032bf68b471 SHA1: b32999dea8cbf081cb272285da0e4d9a0e0505e1 SHA256: c48fe3551e58c56db25da853f19f0a855ee15b2ad4ff2a9fdafa8530a0a0016e SSDeep: 384:zXHkaJsE+jZNG3i37JHP8mmTqS4bbWrGQmaYlxHbOoEcK:zXHNEjnHmqdb5hRvvK	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[bitcharity@protonmail.com].com	20.21 KB	MD5: cb41f41bd95ca2682f45fe0706daf797 SHA1: bd5974c54aacf6205bc667f987626c1f75998f82 SHA256: 107e2a21d519914b28c3c987c1c9a9e9f08edf6a5a37e701fff9cd28f84fd2b9 SSDeep: 384:ccb4ui9BkfxYnLb208hTZucXd0Oyv7ssuGeOrRiHyWhHyw1iA9JprMQ:tEuM3vM5Zfav7ssxeqiHyWkeJp1	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id-B4197730.[bitcharity@protonmail.com].com	15.61 KB	MD5: eb9570a786d414b6bc25df818cd56890 SHA1: 53e7bf0ed95ccd87356038203a61c6f5d75319ff SHA256: 8c0da0bc273e631774bb3bef2912d2dfefab706bfe88d0d9f8dbcebe8c687c49 SSDeep: 384:GVvr/un09GbV915sC14hYjFZZIFA/S4qs8D6+mQdMJgwvfRJi:+T/A0Ab3geF/Q4PR8D6+mQ6id	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id-B4197730.[bitcharity@protonmail.com].com	12.92 KB	MD5: 77663035f88da131cda9a770a8ef7d70 SHA1: c616bd1cfdb444c2bc5b7c0a9df1096660a809f3 SHA256: bec2c2b1ed2c2b035b669e675410757c108abc29a6250bc474d2efde7533159e SSDeep: 192:rtqnjbtjtlfKf+Sl0Eq1u6yhRc4WwUEi+QBJKAPoRNc1U3d8M828ClSYEeMIFbZq:rMKWyhB6Q0K9X18287dedbcXFZg2	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id-B4197730.[bitcharity@protonmail.com].com	9.71 KB	MD5: 54702e94e3e4a6be97c12bfb054e647d SHA1: 2af47cf7429d3fc121fb8a69df128bf6f5964919 SHA256: 47160a60d8881529493259160785ce8d1cbe015c8282cd69a2b917f0f3b4d99b SSDeep: 192:lZ1kB5MEp67OQiHr8E04eTKQIfHRyU1BU2qs/U6W5as4XrqHp:o5D67N+gE0VTKQIsU1BP5W5V4i	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF.id-B4197730.[bitcharity@protonmail.com].com	8.81 KB	MD5: 9f6bdf2498ef697de78612546f3c5f68 SHA1: 0776b59662c162dd827b0af4a8a73acc5dbc920a SHA256: 01a6fa12be2960c7174e7931dd3986926e92bab405f28195a481f4617496ca77 SSDeep: 192:h4AZfkTMsVMyrxORjqLrii3bfvTXsnYa6eTuxJ7TvkBnDgcDTIip:h4AZfkJBOQr3b3TXmYETWJ7T0vIg	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id-B4197730.[bitcharity@protonmail.com].com	14.39 KB	MD5: e5207200f9f2208526fe65a956622726 SHA1: db3c8335a8b5dcfe9779d3438361d0648252a4fe SHA256: 08344a1c5f8ce13c0c131df14d919f6a53c6cea149c926dbadc497b75f97ba50 SSDeep: 384:yq9El38fTYOAEmtJ8oHYDIgcAs/VvVa8PL:IsfMzjt+oHYMes/Vx	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF.id-B4197730.[bitcharity@protonmail.com].com	18.12 KB	MD5: 29de459e5fd55194e243e0d63e2979b3 SHA1: d5b9633930be8aecc31755b7168bbafd832da4fe SHA256: 048a2b6d84ac68faa6816e3e9b9f1ae7d3a4aa73054bcc705d800364e6524b6d SSDeep: 384:RXECKyaoLSMMhTAkI1znoP62x/pucQAE7zrKgUjPW3UW/sCOv:RajEPMhTAkIzo5AcnzZKU5v	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF.id-B4197730.[bitcharity@protonmail.com].com	11.04 KB	MD5: d6101943e7cb979c9bd0afaa7c81dc5e SHA1: 66d3bfa3cdc0d5dcfed8363e8cd7e72d342f24f6 SHA256: 353d10c270ea74abac3f0220b898694d178b7d019b9d4b3924b9ad319cec850e SSDeep: 192:V+wmXp63GuASLjEkjmXaPCFN0zLElnmAcaxE3+ZpPzFP/wUDGghlu3XEaMINVp:UupjEcmqqFyzwlmek2BAcGgJBI5	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	1.00 MB	MD5: 7333fadacd98ca3de89e289508d69411 SHA1: 9d6e7fa73ae13478b18d026a4c4b9a1d85a523c8 SHA256: 825905d08f4b7c10f9c96f15832085fdf008cd0b9ad85661cec08991ecfa999f SSDeep: 24576:Cu4ILxEFksEAHBr/28eYWWVUXOK9v0MRukghpf0+4zVQveOCGwtdC:Cu4IL9AHBinjEKWwsf2JIkg	... File Actions Show Properties Download
C:\Logs\Security.evtx.id-B4197730.[bitcharity@protonmail.com].com	1.07 MB	MD5: 22bf14014f74ce64fa61d82ccdccdd06 SHA1: 50b5b79dede6959a873af27a056487cb579e5184 SHA256: 11f7338b4417f1e506eb5a4bed484bf309d80eab657d25a89084a99f9cd7adfb SSDeep: 24576:qkc1QQ0eA5nubqYmzWEWNcLPCk+lyqDNxP+/UNbkCOPkyr2ZGiO+hE/iAOw:fc3TUuoWXiL6y1UNGka2GiO2A5	... File Actions Show Properties Download
C:\Logs\Setup.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.24 KB	MD5: 260ff98c7cffc2fd483f0411d00eec99 SHA1: 991754be593f1e6b3034ca19b5af6909020d760a SHA256: 4d864dc3fc3d155813de9f18786e15cc37ade39d93fe2faf381393a2ae22a02b SSDeep: 1536:xCS/TR31XsVWSIlHqdlQFYYaI4kQovCrjaniHKBPMIqrf:kS/l36VdYqrQ/abkZCrmiqBTCf	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF.id-B4197730.[bitcharity@protonmail.com].com	9.82 KB	MD5: b8789330d7107604ed038281a8b0b7fb SHA1: 2a775ad1f4d26d50700cf078211524371002d010 SHA256: 75a7e543519b53e40ce2630227e22b5247ec1d8dd0564312fa8cac32988dc598 SSDeep: 192:xux/DYj4IGnaxKpt34Zypcbx2ZxCAEfPclRHw1j8d/Dcfk+3NbADBoTP3xPEdvMo:xwDYcGK/3PpoYEHcXWMQldbAD2SdvMo	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.23 KB	MD5: 7a4df98f7ee593932cee1a27f93c93b9 SHA1: 89f1b543c8576ddb32100c05df0f0f9f7a219872 SHA256: 5f5df79db1afcfd7a04408965bedd9bddb28b6f1e4a1c6348f1f723e587b27ef SSDeep: 24:7zmak7MpwvSRnKpIYPmW2o2MiK/ZhQiFQZWQurbWPY1m6:7y97MGaRnN3W2opHZhwgGA1m6	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[bitcharity@protonmail.com].com	7.92 KB	MD5: 8f459ed16428b99794f7238f358b6a66 SHA1: 9c1e9ab76764544e0364947e74a83b7642d6176c SHA256: fdac7f53a6680aba978baa861c2d1ed1eb5e91aeceaac036e75e494ce0604aa7 SSDeep: 192:1MmbAeYSSr3NzFRVrERqjxGeu3SmuCPLdesJcdKzwZBYp:1iSSr3NzFRRERqjIeo9P8sJcdxo	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.11 KB	MD5: 031711f4c41f021f825e2cd25b9e8ae1 SHA1: 7993609eb7729cc4b8070054569311ff6f6b34b1 SHA256: 9a9607c475e82698cea821456f666dd0238dc38519306a93421587a538ba336b SSDeep: 24:R4hJSh/3aov65+clSLyv92WsKCUYFFdCKUl14k6RfYbWPY1m6:6chNv65+clS292EMdCMBPA1m6	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF.id-B4197730.[bitcharity@protonmail.com].com	10.15 KB	MD5: 56bb66b1b1d89eb9027ab2a713a8a304 SHA1: bbfd2e9769f5da4f9150ab24bc368bba72028dd7 SHA256: 1d5870f329cc30f5cd62994b378a0e27caa4380a617b532b204f189f02271741 SSDeep: 192:4y4Bvt9aH7QEO0W1E4xQMlkvYGdn4O0hR0aHIIDILy8W63imujdfXxWGXup:x4dt9GQEOZ1EF/YGdnaoIULPWAwNxB0	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.67 KB	MD5: ea9d1193f8de9b08c1e76778085c2a70 SHA1: d30c6bf3cbd25a56d38e8b3597704fc8d386968f SHA256: a6d596b4e12fe51abcf746145667b399c6e34696034fe0876d86a03de3b38648 SSDeep: 48:DCqYvoB7+XhZ7i05gtOQfNEdDzN2aQ+JBFGqdjLKvA1m6:yvosfrecMOdMaHff9x1p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.71 KB	MD5: fe1bb4e207975a6396045fe6b4e7e7fd SHA1: 9ef0ddfd011136884d1ecdb67b9aaff7110c5531 SHA256: 4d35a93249fc13376f127f92509d68f64286a22dbf9b864cd8f100396cda271d SSDeep: 48:b+UPA4LDoLIOKYG4qCJNZ2oKQ5TanUjZ6A1m6:SeAeWIFfeZTt0Uh1p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF.id-B4197730.[bitcharity@protonmail.com].com	4.14 KB	MD5: 1b3a1466c99b823540c7278d248b47b8 SHA1: 4125cfc454c5aac76fe6c63e41c16be0beb1c621 SHA256: 7448e7838a86923483d9fcbfd7d1ed5e980deb294d66fbed17a4ede4b1c37c3a SSDeep: 96:Yilbjso8MIu29dqIUbb4qbAEsHBAvy7vvwL98E1p:YqIddb016HB57AZp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF.id-B4197730.[bitcharity@protonmail.com].com	8.12 KB	MD5: 4963bd1e59d93bf0617e05b427686c7f SHA1: 032a22528c76176d2a6e856449ed4afe63f406dd SHA256: 0f93dee57e6336e19afa3cf0024a03f2342ad16da2de24ff3f2d08eb45052d42 SSDeep: 192:E7MMk94dGBI006dCLFjUwzK3itnNSslcr3YnnNyUec6+gUW6p:eMMk944b0xR4gKSJNSH7YnnNyUec/JN	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id-B4197730.[bitcharity@protonmail.com].com	9.32 KB	MD5: ad46e4140eaced149bd7915784d0a8c5 SHA1: a2fa3823b500d455a1c67e2a563124446bf3d175 SHA256: 3c0aea97da61b9ad130313fdde8d872d62146b491e84753a192bbc90a61bdb2e SSDeep: 192:ubVTTMejruVRMbx8ISHaXnOYBD/AU05AqvyYTtYiN0ijp:uhtjr78IS6Xn7BFmAcTSU0i9	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF.id-B4197730.[bitcharity@protonmail.com].com	4.17 KB	MD5: 7598141cf0f2a7e54dda7a5c7fcf3c2b SHA1: 2c5d57b8d5ee356137915604bf66988f2056f750 SHA256: e30f1f691688efe264a7727d609c9a7cb788f0d4210c6beaa9bb3a22604af8c1 SSDeep: 96:ka0Zqwe9nQO9X/caBFMlvDORcixZp34W3ur1p:YYwe9QOp/coWvDOR7N3uhp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF.id-B4197730.[bitcharity@protonmail.com].com	14.34 KB	MD5: 38f891cdb21b14c3a99785f467236591 SHA1: cbb982d954c0e427718df3b69ccdfdd3d241e726 SHA256: 116be259b36f7651a14f3755a3d01ffbeb1bff9e9aefa3781db79e356c9e0916 SSDeep: 384:t185GZPuimPhet09V6NMytHy90avxGDjn:mOuimJyDMOIW	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.75 KB	MD5: 368ce818c9fb8164af8ac1d03f6021a3 SHA1: 6ba61f3f0ce6508b46cd4fe18e302e6ad2c2b94d SHA256: b07e177a2aedfb1fb4275320d01a87e948a98ca5b7b96bfb27c484281676273c SSDeep: 48:toXGei8uTVIZO0p1ncN2dGUjQBpSIqzfC8A1m6:iXvwqOg1a2wIQpp1p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF.id-B4197730.[bitcharity@protonmail.com].com	4.84 KB	MD5: 537609375d91bf04bc034be4a2f70c3a SHA1: 5aaf7919072165fc173975fd6e0354ca4b50c369 SHA256: bb7971eb495c936c5699faa4045eef59e7d0760a3a758a870b85fe5ab7e4604f SSDeep: 96:oanwwaX81yQ9uoDCD3Ty8eo+3siNB1br55HGS6Q0ae3mbQ1p:BwHXiG7Ty8eosDFJ50a8p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.93 KB	MD5: 3cc74157d324801640e6b1bcdba2850b SHA1: bb8d50a549d3b706b25acc2b08b95e42e496943e SHA256: 9287ff3c5256162cec7988029c9254b217202bba01b4785ce49f4f13186b621e SSDeep: 48:EraN1s/sq3qYKxZsRb0wY5GiDPbd98A1m6:Cars/Q/sRIwU91p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF.id-B4197730.[bitcharity@protonmail.com].com	12.43 KB	MD5: 8e6149aa0a3fffcfe3d0119d15545ad4 SHA1: 46ed75e728bf5f97b18fa566815fb725b23ad376 SHA256: 908093776e16fcf24848f6d2103639fe5356caf15d3bb7f00781362cf63c14f6 SSDeep: 192:/BsrnvXEGyLwwlPklJpDBumUGeeFBi7W1yr81WrKNXFQTDX7Gasp:/CrnvXEvwwIBnUGl07tfmNVYaaW	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.73 KB	MD5: 51eb0b3f1ce6a0435d01d0a23893998e SHA1: f0918d483ae4afa6470307313d8d88b454d28c77 SHA256: 3de8ef5a31793ed53bf230cd091c2ec849eb394a31c0943e7a3c1738310c6083 SSDeep: 48:iFPWsyt2aHZQFJ5VRGPaL1Mb3Osw3bV+JefsKhyopSWJWYhVxlU8lnKVRHkZtv7j:AWsyt2YGX6aLsw3AJEsKh/UIPlFK7Evj	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF.id-B4197730.[bitcharity@protonmail.com].com	5.86 KB	MD5: e589e0a83d9c7b015d8b6728d006566d SHA1: 40c287286fe648ce8952809f9b327571a5cf9433 SHA256: fb6216f0299a97ef91c51ee9df36b549bf6191a72d6707a67bdae0056304b3bf SSDeep: 96:7p7tM7oOp64EWL224JPZWlCUAU4hEDw5wu1pYp0qLVoKgJDV8OQFIE9xDzE8ww1p:7XCpFEMp0hICUAhiEyu13q5Ox8OUISJZ	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.82 KB	MD5: 889aeb79f4370e0dbaf834a3b50c4e68 SHA1: 7788d426c05c30afefd0f23260d81838a8fdad5d SHA256: e247806da8645f8774f3d1b490117232b888cc080f122c8588d42c1f0b83720f SSDeep: 48:l9qF3KUOSa0y5JZyl7JFzP2mlzTRlu9ZPuD1xCQxx57Zk4feqGBmmHvT+A1m6:iFaUOSaTJQ5JFBpRlKZPY1pxx59f1GBb	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id-B4197730.[bitcharity@protonmail.com].com	5.39 KB	MD5: 600ca3057dfc995c64af401c2074ca8c SHA1: 647096a5e327aa8c67e2c7e8b27620be9c84d2ad SHA256: 241ea58f6ec21f32ded2019a55fe3cd6d477bb37e8eea616e4d2a8ddd536f995 SSDeep: 96:CjZpaUaqYxFXg+ZQvLOeQL627MTKOiedV7QRCvJjUtBcr30x6xw4Y7pK51p:CjyUAq+ZA0L627MTK/edV70CvJceXxaY	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.93 KB	MD5: da3ca374116256c40e5d23633ca18303 SHA1: 42838d4f8865a127071d9efc005bda8ca0f5930e SHA256: 0dd2d3e6f54e427ffda7161ed41f024c26478fc715b00680f4dcb5b947adec76 SSDeep: 96:LQu4lbcppGwDcqf6zepgDDZbDGQbGtaXYtlVh2vJw1p:L3MQrGwDfWeEDZPGQbGtsYf2vmp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id-B4197730.[bitcharity@protonmail.com].com	4.31 KB	MD5: b35d1ee02c1da1eba002f2f6064aeecb SHA1: db43e1c19d2345584b31ccd55f43bee79d803854 SHA256: 002a8436697135292914af24b80f595f462b1d528db2dba7d11a0ac64d60f6b8 SSDeep: 96:teW1HTxasTHGHj0+7jCo2hxL913+Cl7aakZs09iKYaGLL1p:11HTwsTHh+CxhtH+C1aJLYaGLBp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.03 KB	MD5: 70528c43cbefc75a7d49f00864814d3c SHA1: 3cc3d2b1936774d5196a6c8495a2cd98e491dfe4 SHA256: 029eca357a7cd6edd2c8427fe4a43ef596c7c27f36d88dbf975445f5894b1e48 SSDeep: 24:3uOVURfSPRYwmbq8wy7zxx4/pfdJqVzcNWbWpcbWPY1m6:3L9PRfR8wyvxAZqVuW6ppA1m6	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.18 KB	MD5: 8862556f0f2bc5cd7a6bb8620dece38b SHA1: bb189703d29a58be9ddb9696c602de7ea24ad5df SHA256: 793a9b8128a345ee73189eba9605eb2a01b99055831f7c1fdcb15bd7ffbdd7fc SSDeep: 96:NZggxBQWm9hgEdb3/ceda4EMcXTEL15Hw1p:PgeKZh93/cAORjEL7Hwp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF.id-B4197730.[bitcharity@protonmail.com].com	13.03 KB	MD5: ccab2c66af6329c886e140abc1a7fd60 SHA1: b0561027eb7fd7c8922df225d227e9c6dfb6c0bc SHA256: 068a12474889d7e1d36571062541d7c2ba82ae16b3200cb9a4115e5082089d85 SSDeep: 384:qqgaC85wzBsyrJdLYssfK0kL8HAXo79Irb:qqgaCi6B3dssrmgXo79Sb	... File Actions Show Properties Download
C:\Logs\Windows PowerShell.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.27 KB	MD5: 920cdc53bc8791d38cd649aed4d809b7 SHA1: 2a20c458e7694d563406e6317a6bb330ae65626b SHA256: c121a2f1bf690b75990305a750878fa65b49b514d9d579096c7ac1db544f45ae SSDeep: 1536:ECzk2hl2RNs8NrEck8avtx0gggDS3+udIc9xUr7vuhG:RY22HyKIxegDqdz+r7mhG	... File Actions Show Properties Download
C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[bitcharity@protonmail.com].com	15.86 KB	MD5: c06ae140c9213a846ccf182d9ab38cb9 SHA1: e047a01ea5f4cfde49729de0ccdf832026b69627 SHA256: 9de8748ed0b9d282a2d94c5c510134c33093cd4388b13cb93a772d13dbe9a4c4 SSDeep: 384:0UM2D5b65qxte9Bhu6v0jHvdUc7KnCrWY:0X2Dt6I49BhFSUc7NR	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id-B4197730.[bitcharity@protonmail.com].com	26.65 KB	MD5: 655b20e0bcf93ee1ff989a47500d350b SHA1: 8263c69e56d5193cbe8da4303dadf64be4638070 SHA256: 3ef931172602effcde472da6ffc846f7ca47ff239524c574e127f047e92ec748 SSDeep: 768:1XSjHS4Vv6LoLBSDQT0N6RGK7H3FYP1SdKRpa7PU7:0zSXsBScIN6UK7XFc1RMP0	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com	7.07 KB	MD5: 5f5e2ebf2401f45b1d0703865d4af1aa SHA1: dccf0e9fbd5bd9f80a7646dd6f6afc0ee06c6da4 SHA256: e8c477808624994df09fcfbbe3d472386b977a533b6f1413a93a197b7ad827b7 SSDeep: 96:SB1ldNwyDgdarkH7hmjBOz0/N3ItNPZcBqHMTYTD1VL13lqZsgUpehkwjbygURu3:mvda32EAKBEYT5VFQZ5UOgb66FpQp	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	18.47 KB	MD5: 41f140080f0c8ad3832996418d3820fd SHA1: 996490c51feaa841a63e253689a23b26bf90dda9 SHA256: e979a827fa7cba0e5dc2edeb9f28947b001bb54d262f945a0fb6f778aa41c351 SSDeep: 384:a1qfyxsvzBXjKbP22ZwFk3I7UoYAczTFVpDGOj1H0CoGYnF:a9xsvAT3Zwai/YJrxGY1H05GYnF	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id-B4197730.[bitcharity@protonmail.com].com	9.61 KB	MD5: ff49e5c3caaa22dbccc567b67614093c SHA1: 64c64be58a60ce0b328274f4fec8adee89a23fec SHA256: a1ce9d5677e019f90e27dc1f2c235210e98aa8361971c5a2ba17720e5a306210 SSDeep: 192:PM873GyeJQSujulNo2xSk+/1a2sdwSuPATKKzCB+ZFOPRsp:08zGyeJQSuqpxSL1XsdwSWKKKnZsZW	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	20.99 KB	MD5: 94cd515bad9fd22a16901ba4ca29d1d8 SHA1: 2295849f2a04a453cb4b1917f23933579406b311 SHA256: dcb455f3ce47c637ad9c85f6d3f48f8125d2114ebcb81553e531ec57d5631840 SSDeep: 384:z7wnWCsogkdiQfVtfe47UyAHGYoiwO82cZIBCGI2eh8jB3t:z7wnKkYQnz7UyRrCfZCOfl3t	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[bitcharity@protonmail.com].com	18.99 KB	MD5: dfd2ce6a501f914e198fddf2c7418cc9 SHA1: 7d91bbaba9db7a82a19a10d879b4b30fb16614d9 SHA256: 5f0e3bcdad53f3b44db395fbd01757ceef90651b21e52ce5cb043dcc74cf5c4e SSDeep: 384:XdZhDHYxB72xYMNljssPWCDx/TyJcTxBMGLLdjXMq3Yw1hqBdC5:XlDHYr2xfNlDpTyJcF3dQqInK	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	18.97 KB	MD5: b3e89fadb553ff87a95ccb8804f5d655 SHA1: d89916290afa9d22242037b1495db4eaa0237dd7 SHA256: e76526171024876e6e22add1a43ac7282759b452729304770f13d99b1d45049b SSDeep: 384:xVfTQsq5nZQYhv3Hizxp3mLMccrux+3bQMw+rkh2UuEHoSA:/cQYt3Hizn3mL0rg+3bQMwikh2cDA	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	11.63 KB	MD5: adf38ca6be5e66e80f98d6f6c848d64c SHA1: f14ec0ebfae454cfbb352d101b64222b9b80c95e SHA256: 260e5f9bbbc098947de3e8f80367819c0a8d832dd74930b2f475ac79af8c003b SSDeep: 192:Edp7tiseulOJ9CO1ySTs6YQCb9QlxxZg6uZKu95aJgoB5MwJlg0UyW65bFkUfkBp:E7hiseulPKySTaJYxZn+XQJj5Dlg1yjQ	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	19.47 KB	MD5: f4a186641cd8ee6750b8b7231111013a SHA1: 0726a50a21561da54fdec8e92918dffe377fd88d SHA256: 3c9e5a743bda395b397c77f1479e0c5d22ed3634ab7b2bc3ee4db8ab9d7e4ca5 SSDeep: 384:BRq8eRY6Hf+M17qqB92Y9QyNvPC+K4tjqG7L:BLeqlcqE924PNC+K2/	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.90 KB	MD5: 3fca7c6f24e18ec1cedb78b77d69c805 SHA1: 55ddbbc3cada0a528665ab7a2b992454ec298ec6 SHA256: 2653b828b7e48bfeeaa17d9f50ad62b942b0687e815e8a655a14e0bd2013cdcf SSDeep: 48:PIzJWiVjEwFj6lzZO2Snf3w0kXjYSIbwRK9YekSYA1m6:gzJSQelvSnCPvH3Sd1p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com	27.15 KB	MD5: f8fbe162c17d4005079ff80d19e057ea SHA1: 268978b4c37bfa5c36a7b7249b6a21f4f54236d1 SHA256: 57bcaaca89c589c3afe15e427c0c926f063420668cd71867419894608bac99fe SSDeep: 768:WbhiAyjwufg97ig5AG+OuaHuyOe+wprYpvr4SiB4:whiAQYigN+OuaOyNYFjX	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id-B4197730.[bitcharity@protonmail.com].com	4.54 KB	MD5: 0463520174987d6ca6c94e908a7b7cbc SHA1: 83d2e36fefa0314c449fecc195a4d244cb3bdd89 SHA256: 08b3818bff37bcd879115cad486dfb5344e684bc0ee6a80decd3454c3593181a SSDeep: 96:2aadB7RRT4G9yXLbjli4HoNQauAhri6KSU977+lzwQSdP/A1p:8RTyXvjJEhrUSmEwQS9/Ap	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id-B4197730.[bitcharity@protonmail.com].com	11.46 KB	MD5: 2d6d47efaf41cbfa0c44f05964c9f655 SHA1: 99220e9eb25d1ac15293531be4becc705ea10950 SHA256: ee514a4be74f03e37db757bd86fdd28ea8b13f0c8951112d64cf7d85532e7c35 SSDeep: 192:UQjIhhjZsoUawM+r/rahsMlGD7kMGMvWXCkIRRdIbLtABdC4FKe4m3JH/KXawXWf:UVQo+Mu/rqsYGD7ZGdtbZABo4F7Q5XWf	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id-B4197730.[bitcharity@protonmail.com].com	6.36 KB	MD5: e0ee9386d33300821db0ae36ae1f0a62 SHA1: dfaf4e8fae1beabf603c08601613a86f3e43010a SHA256: 282a1f86fcad13e155674ab9be12b4ac8635c3ac372932fc2d45f44cf0ae0808 SSDeep: 96:dczMQsX7ijb841b8KnaSs/TE05R3BypBxd43KJQLL+yy8gV36mQj5L13BSmPW6DL:d8Ez41b4/typzd43KJQv5PTpbxp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com	19.26 KB	MD5: ae4ed8dfc2c5a2b85d0eed14253190bf SHA1: 47d7928fce24fe230dde8b6f229267595ffaed7c SHA256: 4bb30d9faff83dff1497cbca7e07e77e53cdf64feec5210be93eee050f179649 SSDeep: 384:DTkZ9sR3/cZVAx0SZFfBRWKM07jP/xIQpmrhbmEKMec/PBF7r0scW0:DTkbW3UMxldJP78tC9WRFcW0	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.50 KB	MD5: dccc0b2da8d20ea8f5ee1de4fa774c11 SHA1: 984bcfa4190225582761fd3d4de95e067f81511e SHA256: 44564e9f4872c03bea26c507f99d43fd849fd262fc3dd188a4011c295c5514e1 SSDeep: 96:UCfYNDDQoRlFCxRANnAsp2DEk63xbS4hgOAFK1R:zCfHRl0RQnA7Qk63xuf/4R	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id-B4197730.[bitcharity@protonmail.com].com	28.56 KB	MD5: 22d8f6c0bb9ea7d051fa0b8b63310ed7 SHA1: 30145441a4f824d50dc75fc08019bf8da7cd2d26 SHA256: eadfdef9d27afb293fab4870ac57f9751a3790be934690c6cdd3a36221870e59 SSDeep: 768:anLNXFfWCd7mOvmXf1fE8FM1A6quPY3GGmA0opX:aLNXFrcYmXNfED6qYW3A08X	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	18.48 KB	MD5: 0d27c81ba89c15837f7cdaf24f23ea51 SHA1: 20b32605743be3692652db1e374367cd8288d76d SHA256: a94fa21721259bd4b846ee7b1492a8d19b149c0112b4aacb4bad06a16b37d053 SSDeep: 384:9a9DqSYh+i7Lwi1S3kQzW7eEs6iYsl0LTWgQkeoOdpIW/b0:8tqSo+ALH1S3kQz+lsaFTqddpIeb0	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: 40a3e6216366cf0457eecaac9fac74d8 SHA1: a2813af394c919b18024b616c7798a366e109cf1 SHA256: d47166cf373e2963e4867a51158324965669e6b2ef52b190f3b7eae516ffac09 SSDeep: 48:3SjVIjpK8GuXybQvor/uFskZ0nwAOYSmA1m6:3SZ8GuXybQvormFskkED1p	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	18.98 KB	MD5: 2967361b2ab2132dae17d029d008b61a SHA1: 52ca1d3e2c44181bfe84803fd077f9cdeaed33e1 SHA256: d41d906daf171e26a9cbba867a32b805cb85b5bb5a26ed19694c920f85b3f964 SSDeep: 384:MihiKn2+XfV/PNERphKs1qBt4+/7rnu1R0Fqmg/jNkCG:Mip2YvERzKgQtPXu3sqz2v	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.65 KB	MD5: 48daa519386a30a116d0cd5ec710b4f6 SHA1: 3b4bf7ef046801c6b74210ffe8dc56eee0c50150 SHA256: 6cc570c8d6f0da4576590ed9e2faf005b44fc3df27d0bb95a042bf793349eeda SSDeep: 24:OKuL5QaY4SBy34Ee2TvHeQE0eK53c5K4G0ZfzxpWSnRgZfBpj/yHBbWPY1m6:OK0Q9EPT2tK5szVzrnRCv/ywA1m6	... File Actions Show Properties Download
C:\Logs\System.evtx.id-B4197730.[bitcharity@protonmail.com].com	1.07 MB	MD5: 63d38b913cdd195b823c134a2a5be813 SHA1: a828259837eb29b0347eea1e7249ddbab360d5f8 SHA256: ec55b3a9791824fe6ebea162b988f8f70aa64b28b7f440b013bee60eab875042 SSDeep: 24576:LnsurWnYsPTgV8V7Abt+/Y+ATcX1OrJ/a0lOl9ueljQ:InYs8W8b8O21OrprlCtQ	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	20.48 KB	MD5: 044d7a6a9f39a52b6bed9fad48af2cb1 SHA1: 603117b4213f1e7264a42bffa54ce9c321233e2b SHA256: 1dfee9f4467c0a66334f9a29f2c7a984100c2ab58c50a681e6dda6dc419e5fdf SSDeep: 384:GWQEd+Escqi2rbugXXJXHi2ukEKfzRkfBuaDukxiUvHUsh8uRTzdwjPUtu8WR1:GWQ8IpLbxXjh1RCyVUfU0R6so71	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	22.47 KB	MD5: a96af67fbac248cb91a3b18811b89c25 SHA1: 792c58cb6d0eb54708cb25a2584a13eea54171a1 SHA256: df4f87dc89628cccb361bc187a96992e70885357ec88cf5d6842bbdca88f324c SSDeep: 384:P9i8K1zwsDZYgG/iyUn/IY9MTrK6e483ZDYzN2J7paAaf4mtfD0c:Pg8KKUsY/5arKMsyTb94c	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id-B4197730.[bitcharity@protonmail.com].com	8.03 KB	MD5: e7d34c504752e7eb13bbc37c1942d9e5 SHA1: cdb7c59bf4aeca8d094a87bd60b0a8fff7352f93 SHA256: a04b3968f8805d6b4820283250ed01ba2007b06c09bcd4386d1c3b36b14400c3 SSDeep: 192:HsdfqkczHMctuq3G27g85XYJDAjGb6k89hkZtK68tc6hCup:HsdCXzsoz3GCg3MjGWXkx8tBI0	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	18.97 KB	MD5: f25ef9e7d68186a62a1cbcdcc759b70e SHA1: e7348d13c022317cb791dca8eae57b2266d1912d SHA256: ba9240f3f170bdeb71d17c6f14ea50f733b4f224270cea79c3f4fa79ed398cb6 SSDeep: 384:On+ONP3YnaBaG5Kxz9K6qB0OHItFR9124psgOgLc62atjYL0ZI:O+gP3SaEmN0f19pXOgLc63lI	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.26 KB	MD5: 7bd78bd4b3fa805c2c9f1a0c03ece1d6 SHA1: 6da8be71b73d8001902b58f15c8ed44eba5ef18f SHA256: d0f981604a29a6877caeda561e7c422d1558a0e20de5799fcbaafca9ce40dfe0 SSDeep: 24:iudSKzFOwSUFjcDlChqBqfLwM7dqWmGK9jrx/XkbNI2OEmqCtbWPY1m6:jdSKz+4jcDIqBqkM7dMxrhXcLOERhA1p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.56 KB	MD5: b768b7d066cf82ee8c26ce598c370f62 SHA1: 88d16f0c5601f4031bdddf55a5bba68404f25ed2 SHA256: 02da9de909d1717926959dd6fed5a20378d27c34b17619f10d79334267a2455e SSDeep: 48:55TBJoj/kL54wG8B6Sx9cKqAyUssU5XjQFyqTno2w9J3jgCqd1XwbA1m6:nbM/k91fStQF5o73jbQ1gM1p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.36 KB	MD5: 2eef92d8ac1a02948ea2dba358c55798 SHA1: 2236d4bb726dfac241fe3b4b2b5f4e7d4bc7a566 SHA256: b5c3e6549afb8e49e764b66873a6a52027da6e498e4978348a3de8c7385d7208 SSDeep: 48:dkn4kv1avdr05jMSdEJYXYrUiRZRkZTjp51ErF5A1m6:ev1avCInYIrUi3iZ/pfEBa1p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id-B4197730.[bitcharity@protonmail.com].com	8.40 KB	MD5: 5d2ebb9a04c647112c1f492ce4090419 SHA1: d280db5f6311614b05fe727d181d54395a5a403f SHA256: adac4eecd38590d3e5859c8f7250af6c00a32360bec3b16c1f02494f17656dde SSDeep: 192:+w5GsZMz0eEfhITNIWq1ZWTHym4r2wIxIKbR1p:L5zZMz0equCBxydxL5	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.92 KB	MD5: e27df62512350e4f60566fe4256f2fa5 SHA1: e70a67b1ce4a09f8948ca26c11066553e591200d SHA256: a43dd2e80ce4f79a93ebdbc3cf696003b0937ecc67a5f6e1dbe1bd716cb42c80 SSDeep: 48:8LWQ81o0Ad4Jbmj6M8+EUtNAloqW4GjjA1m6:5Q8/Ad4JKmM+UcW4mE1p	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	27.47 KB	MD5: 861abee2dbb13aa37ee03448bae7baa6 SHA1: 131281cdd9426617e06ac60d4664a82bd91938f3 SHA256: b04752df128a3d1012e65c3365c594fe828708b9672236a9c4716c28bbbff808 SSDeep: 768:5N0f3Q0FKJEY648vG29N3F3TGaXVRGC+J2HE:83Q0F1hvG03TzR+J2HE	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id-B4197730.[bitcharity@protonmail.com].com	12.73 KB	MD5: 6384f1d10b1ba135a09646f787a71a99 SHA1: 8eb63d6c00e8137b1923fba54874c4af85f7af11 SHA256: ba76305ed5ae12b7d3fd385595355c70ffe00a764fe1538e01f6a5c19ea962e1 SSDeep: 384:0vfEHgp1oplzoLG02PtPO6S3NnMEhb4zP/BH7XfzxTZZ4w:0vfEHK1Yly2pC35Mm4jBH7LxvD	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com	5.11 KB	MD5: aab0ecf0e4806503d4be971a9bd617e6 SHA1: 2b40b074efbd65bd77e330ff35d8622d3eda2944 SHA256: b1f6d33c009a70f48042e035288b34796cddc6f1a630cd61f3f3a598aa430243 SSDeep: 96:X0x4finiiFC+riNJMNKsVxvTPYIFduqClVGAE/gSjLAgDRjrMvcuomIZAg0du7cN:X0x4sLri3M92q3AMjLAgDRrMEDmUAndn	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.79 KB	MD5: c7e4061b69b1490d36e3562f227228cb SHA1: 783bf4be88a3583d0cee9081d1ef43bcabe91c16 SHA256: 5d7e1fc92bad195df45e227dfd35fbfb9ff236e5e1422180356c998058992ca4 SSDeep: 48:Z+eX14nM9QnREqWEVGBeXZdqvCYYikpQA1m6:Z+K14n0QRPWBeXZdqlAH1p	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	26.48 KB	MD5: 01863e7657a6838ffc7bfb888d286d70 SHA1: d731a214e709969dc464f6fd217edbfb97ddb44d SHA256: de7c507bd46eec4cffe3bbe30ca4de6e68010e5eea0be43c0857665b35e0d164 SSDeep: 768:PXcMtvHs0mJQH9d89PBaIYy4aN6d0nUz3r5j:nOlBqyRYTr5j	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.25 KB	MD5: 459e72a4e063349681cac70a6e296929 SHA1: ae37645fe479f8aec22c1abaa1cf9b0b3dd58b2a SHA256: fef025aa7716c52210e56554580bce14c945b8947fa3c71595cfc023bdfa1b4d SSDeep: 48:0A4WIpkMoxaJde+St/kob2v1qCAtAEsmEwcXhqs80ZAWqJEA1m6:05rpZyR+StsBlBmEPXws8aS1p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id-B4197730.[bitcharity@protonmail.com].com	5.68 KB	MD5: 29bb96ee3813773add72c91425839671 SHA1: cbc7afdbe9163068241ed69b48ab69922e5d79e9 SHA256: 220a83eb6eda5977daeff4647220cb70cd6bc0d6885bf6623e70bb4c32b0e4af SSDeep: 96:h2FYOkb0rxov0yifqAilROyqQVqlzMekciv9dN72+7V3Cli1p:hAdwcqbOyqQVql4dX7clmp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.42 KB	MD5: 23df2bc116883638e726fe38490a6c19 SHA1: 323212143c1e24920627434a51dea29353892a62 SHA256: de191f35dc036fa316718db5e8f91977b4c389b2c65b4590a80b2cc1349b8175 SSDeep: 24:blkg0sDBDn6d9adbobIUuyYm+cKziwAVYehswAUCGI/DQ8NIJggVJ3LbWPY1m6:blkglRwIVUu7mh2iwpehsnwIE8NEVJuS	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.28 KB	MD5: 04b4d064cd8f5140e90b59c384ef6276 SHA1: e563f36ba254d6db8813d237ba16569959073e32 SHA256: fec5b3ceccbd4bd0d51b55ccaf3bb9f787b4f4b5ae265bb344a0d787a11658b4 SSDeep: 96:ETFg2aMpGuOyL2ebvTPchxxVST89u7Ns51p:ETFat7t5lm89NTp	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	69.47 KB	MD5: 6ee5f33419ae2a18319162dcee318245 SHA1: 0d22dff5757fcff7dbae2a61696a8e4884f022c5 SHA256: d1a48b825d82e1edaeb25363777ee351fc78193899615e551a835cf52bd65956 SSDeep: 1536:IrbughhBPuuU8zOrh9QXXqKjzyupvX8rx9SboTztP1VDVg:9Q9U8zO9iXTnygX8rx9/FO	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.68 KB	MD5: b334912cbe4276923d2636b8bd02aebd SHA1: 049de2b59d3c38a7919e3dca1817de7df0539670 SHA256: 10b5c205b0b9074b30739f7443fa1e3f285d3204ae444c3e4ac52854bae61d3e SSDeep: 96:2QICSOHb9H5VsaS6+8uoEfXRFAqzrnPVd1DyB0t0Saw4H1p:2jc9H5I6+8u/f7Pf1Dy7RVp	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.67 KB	MD5: 701c61029de18c40bc5ab3e89edb1ecb SHA1: b503319cfd43839589835d26c3a1b326b1f2c4a8 SHA256: 1bd06a1b7156ad614f054758400bd3332bec8c382ebd19b9ab17737b03c3730d SSDeep: 48:1PhjQxUQA4NR2bqebDRUd+tkU4BlAJO2RqCRKwLBRBjipQAktL5LbWA1m6:15C0SRlQypbvv2RqCPFTuuVvz1p	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	19.47 KB	MD5: 5f37f2d35f33a757f269d25b0f90c267 SHA1: ccaf96b70ff236029748b81bba5603d49af365d8 SHA256: 53df19ac043f0340e08ed2dea48d60a5f6541e9c26394a6a3b3aaccedd843b83 SSDeep: 384:CQEU/wxbpioqXY9WKV9dhIpzdrvwdmVZphgG7/XcBuyDomA5:CQSxnnhydzwd2phNCPVo	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id-B4197730.[bitcharity@protonmail.com].com	4.04 KB	MD5: 9ec738e5904ca5dc58b901d24fd100af SHA1: 56cc92b074df3993752b61c79fc7995a11f4dacd SHA256: 16e2202453a54e7183e820fb77f0879ba8ebb381a8495d052b86d7e05f00cda2 SSDeep: 96:aJUs+4KlD2UUJxihVndJ27pzQK1n5SXGeYXMEvt2E09u1p:aJUHvvUDihVnzeaK1gXDSjvj5p	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.87 KB	MD5: 240a51401232b59c2a54e1195867ecda SHA1: 66bd998c0547e2f97b0f6f3986dd869fc267e716 SHA256: fa1379d94d61a732faf6cf8d2fbc363e95e3dfb10d14389d1cb2a7be9b1ccacd SSDeep: 48:Rh7kfRyXHQnpdqa0gwaBmxgDdVYBm1fgCmrIA1m6:DCcXHQGa0UBmanYLC21p	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	19.47 KB	MD5: 0b95f083d8ade739064a741e1ca4fda2 SHA1: a3f3b1f63d9d79a365dce5489b8efb293c261da7 SHA256: 8dd584491cd95af3ce5b7f5d43ea8c7a5326fc3853a78569f7e8d149e3498229 SSDeep: 384:quMR+r1ILxH2pVsebvFItRV95PlZYNeZN1jxkuL5h0fhW89d53k9mkakCSB806nn:jMQhILJkseePla0NFxkkh0co5g9sV0un	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.95 KB	MD5: a60e801e1b100c0fd7dfac14211c3e4c SHA1: 9bd525c09bcd5a6939a3ec4e41d62eea546ce3dd SHA256: d0c9fe33ac2702e358cdd81af75a5abda8ffffe1022d11264ef5cb2553bbec7a SSDeep: 96:D5zi2sPZkwlzHYFHTXG47+hXwjOTEj2b4Ae1Am1p:Fzi2sBkWObG4yhXwaAycrp	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	22.97 KB	MD5: 2392515de63904f9446db1292d99385e SHA1: 88200cdbe7dbbdff2e9a56aac24088767ca3613c SHA256: 682dfe5bd2ee898b70e2b1ca2fddbd349d0c281c154fb8cbe343a28d406c0c4d SSDeep: 384:PiTZBh2hdIsH8OOLfH+aacNOjEYJxC+B4T3CUbbFdbD7vvd0Z62CD63aPZv:PiLh2hdncA9jEYxjB4HbWGD+EZv	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.90 KB	MD5: 6eed5e291c247026250eeda6b4cd2fb5 SHA1: 01a313bed670f50a98346035f4c4f59d9de31b4a SHA256: dd92c7f9f24484e7754663996603ee8eaa68288c7050a820edcea499ee2dbf1d SSDeep: 48:ekm0TfJwVsDeyUBob78vmkORdCLU801PzUD/BkyGHKkDcmmGP2dBAVBZIUa0UZ9S:Nm0TCQUen8OkMdCLTSzwqJ7qdB4BXafe	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.62 KB	MD5: 3000d32f9432e47dde6db15eb0ac26af SHA1: 3b9ac513e6abd4c1b170577518a383c88dcc49d8 SHA256: 08cb11e1ac84bf7b2e751678255b3dc7687269266f4f3cc42447e54a275e9cd6 SSDeep: 48:cmRY6BAPKVfekdoDTtpoM/t+h/uxiUz4zo1bbNE/Jqofn2CM6F+eH/PA1m6:VRDBAKdonUM/txxV4zo1bbNEdDMD1p	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	24.47 KB	MD5: 0444927be5231b62afb33d02eb495872 SHA1: 9cbcae81bd67dd8ad7ea59889363387df39099da SHA256: c29bcd5f6b9aa6119e66668028d5842f3008529483cb1515424a185fb262da2c SSDeep: 384:Id+7geDNsKWaL2tvaSmWqAAlGGgYkJVLtUxkrvTNKaTUFkGBg4RVQRO/vW0cWMRU:Ik7geBs5a13g/dPgaTiBb/vW01UEd	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF.id-B4197730.[bitcharity@protonmail.com].com	14.89 KB	MD5: d17d0c18b06c86e7e6b54adba7991d85 SHA1: 76c3045e47b4fb4f25f33d68fa29241761947b1c SHA256: c78b9a5f193aada69f29c81d5df6ae8af4ac52277ad6a3f502adf2cf8aff1190 SSDeep: 192:xO/xVf8XEyFgEf6r0CpWFTP671Wx1MPrBzndjtq5l6Timk8lbokXEjTKDNUVpwmM:SCXGz4ApWx1yrBpjtwgimb7eu+re5rlF	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	18.97 KB	MD5: 570fdbb0ec619da0b54a9734077d6e95 SHA1: fdab1a6cda170d7c0890545c3d60f0665d320f10 SHA256: f9fca90dc0d82456e9fa61881274e75f8f2d21844cddb8317e4ec3252dc4f608 SSDeep: 384:BVvvL9Rm7S0PK3T7mIwg8xCYqc1JYSZ9fSNv6jHcAfdXXQ:B5m7S0PKXtLa1nowjHcwpA	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.07 KB	MD5: 3f2c96fd334fd271d65ce12c2b1bd8da SHA1: fb88ddef7e9838215faa7cd9605bb0ce4d0097ce SHA256: 2096fb12010c0888432882ef399ba72cb6a7e5aa8ba66be4deaa002651e84f19 SSDeep: 48:LrTQcVIBSR8oT96Yy5tqOP5hJ/CcOSEDiGPzFxbBA1m6:vThVIM+5VE6hJ/CcOxv7y1p	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	20.97 KB	MD5: d19dda9d89221099abf26c393fc339c6 SHA1: 6ba5a477fca2657d88e8ff5acb177f49a3df7742 SHA256: 8a21a5cf4aefe3ffbbd451124d096ae9acb69f3a392b6578a02f7fa5806c2f6e SSDeep: 384:SMrg0g0GOv//Iu+twybh1ywy9u8vTy7FbziwGN6U851xx63YiIlH/Hgb:Sv07PIuLyl1Zy9u8vGG0U81xjVHM	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.65 KB	MD5: 2e3ea2c4d89bc5fd0bd93689fa4b5602 SHA1: fc9792c9caeb640c655f7df666ad6c6f23e93958 SHA256: e31c9d9ca086f285debca2770a21a33f0a8c5344bc2fc0ab3e18d3d391cde4c6 SSDeep: 96:bQgC9Q0jiTAdT3pStsVXW9iOhnvoGnmeyf8NM1p:bQgGQ0j4A5Itom91hnd/yfVp	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[bitcharity@protonmail.com].com	387.92 KB	MD5: 8924819e0b6e598edf149fe7a209191d SHA1: 5b3f1c108e1ad1cdd7dbcd7479b0013997cbc233 SHA256: e0e72f15ce9f1e50cb06a5e7bccb51dfda335f1dc2848197624fc036e497eb0c SSDeep: 12288:mmky1wxtITGoNOVmA9WbLOAHIB/gKffzQm:mmCxyTGUOVuXOxzQm	... File Actions Show Properties Download
C:\Logs\Windows PowerShell.evtx.id-B4197730.[bitcharity@protonmail.com].com	68.27 KB	MD5: e8930971ee35a12533f1d23c5adb1b05 SHA1: f90287948d716d713bb05b5aa0f28c8ff8a247c3 SHA256: 8cd20e6754a71e2617599f5edff49c02ff52bc88443efd483ce3565044fa79c7 SSDeep: 1536:OgbK5uEayIsYMij7Sz6q8XrN2ymrK6666JbY3M4ep8:OIeuEDIsYMqNvXrINrF+JOM41	... File Actions Show Properties Download
C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[bitcharity@protonmail.com].com	15.86 KB	MD5: 53bf40c1a9da8459398ed5697cc032ff SHA1: 5822d290a981f62b84730541982282b7ba0327bc SHA256: ce4d031e045225de65c50534ba0a69899bea6f759e0b7d064009513d57aaae7a SSDeep: 384:cAdwfAi7JEo0zGOHEISJ4dgKuYM/aABl3ixWiD0iVol:cywDVQGOHeJfKuYMSABlSFV4	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	18.47 KB	MD5: b040fb3eab72452b888290281560ad7e SHA1: 66e07501d65625aa289d55ddeb5ad237929c832a SHA256: c7a90310f3537cc0f416b4ec68a90341fb169cf8bcf46f1373f901b42769f66b SSDeep: 384:18vLR0fy348LN6dBWm3yBFeS8zugbLX5CwZP+OlNOxh9cSxMem:Iwa6dj3KknbLpVd+OqxzcSxRm	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id-B4197730.[bitcharity@protonmail.com].com	26.65 KB	MD5: 1b20cb196755d9d631e44237f37bdc05 SHA1: 3268e1b8562b9901c02732a42eb5a13bb21f5cb5 SHA256: da6a2c81ed60e080cbf5bb759eb8817a2df727b9d2e90851c41609f2b749c587 SSDeep: 768:tBGWfZvAvoxwGG4K4sB7JPsQgCSBeap4fr:tBGImQxPG8UuQgJeaS	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com	7.07 KB	MD5: 5b85314a64402cc7a0d6e26898c8807d SHA1: a16e1668d2332718fb80111be83f188675ab46c4 SHA256: d4dc2a26390c41cd974e308c47c540cad2a9d21428a807582b251cffd01a314d SSDeep: 192:Kj8WiahSygYM59Efm5E16rmKr0Yrzra8QXpSRQTJvi:ZWiyAEe+16JAY6XpSRz	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id-B4197730.[bitcharity@protonmail.com].com	11.46 KB	MD5: 4280194b47894949c2bff41c648d82e3 SHA1: d7078ee3e9a4f65543e2f735ad76c37529df305e SHA256: 019fa15b883008a5ae37a48d4dac71dae99c168ab037440c82b839d6f938306b SSDeep: 192:1w1SPhwnXdCMhgxBJ0JaCnqgXsGhY0V+DluFDo2StusjjFTaxXss3GMqV21EJ3QF:K1SgThgnJ0PiFDYLijpTMX53Fq41d	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id-B4197730.[bitcharity@protonmail.com].com	4.54 KB	MD5: 5a0a3e4292c2689de17b755117f3027d SHA1: a659545c22d90e2b51cb69606fb518dcdd125720 SHA256: 11603223fd6a9f100673455a7b2deeb234ecb933c3a7fe38ab842ba94c9fb355 SSDeep: 96:yOmfTH9I88YNm7RxzlSqOEybUqsW/7nOPQCnxGJA4:yOmfTHD8YkxzlSCyb/EPOT	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com	19.26 KB	MD5: d5992024983e9ab44b663a6f21301c99 SHA1: 4da942807ad0a57a43399f5f10502a810501e7cc SHA256: a69f119bed4690d7fa098dfefa69f6f252028ba65f57c16c004901f56400e052 SSDeep: 384:nV4yE0LTGShto+iTN2sni3k92yLhx8WMjk9BgcILQHP4wX+BiSScJol7FCv:nVXBLTGwtIFTZs6BgcIkHP4iOJ2FS	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.92 KB	MD5: 864468c3ae82124f4f82df7a6c699346 SHA1: 8a97b85b1b8644a9a6dd62667994a9d1fbd82dcf SHA256: 0a0fdfe06b8b2a3638aa3e72be0e27098faf62f0a59e18cc95621d3fc95e6047 SSDeep: 96:LC5zhX1o/mc0uBGp9moxJsEO44e5PE/wxtcM4Ylz4:LC5gap9mqJv4wPE+tc7Y6	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id-B4197730.[bitcharity@protonmail.com].com	3.50 KB	MD5: a62884f951129acc68ba929a7f694b5b SHA1: 41454b9d8255c38550d8ee3234da3c979ecfb1b9 SHA256: 659db49b69b54b99b757334f9df07f30515fd4c62c97c3c1d95cb1c0733cfac6 SSDeep: 48:dQstGRIHLOc4EG+8kjX6k1y4Uoe/6fT0+/JhkzBjKxpq8uZoWO0VNfqxOMdUTsk5:dvtBsEhX6b4Mu0aYZ3O2wTUgk7MIF8Dg	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id-B4197730.[bitcharity@protonmail.com].com	28.56 KB	MD5: 4513aac1f53e30dfb3da3190ba47cec1 SHA1: 2ebc4d8bca85d38151ab5cccca98546db6ff38ad SHA256: 9856eb4d2a791f57a797d85be6b3a461658396dd9f97bffdd6b48740e60cb68e SSDeep: 768:fKi+S/pc6Yzf0UBL3g9ZjvVxQ1NkxrlvLtV9dXp13E:fK+/pct8UBjg9Zb8AxdfzDU	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.54 KB	MD5: 0ff2d92988c7c943b1e8e1733aa104da SHA1: 477a1274bc3372d226007318006b0694419bb1eb SHA256: 216659429da41501eff3963511fb3670e76e987fd6ca72e1aa750b3ccc5f749e SSDeep: 24:Mi3KaguvnGL/3U17KyIDQq/YxkaWBUkvsIzRHASh/oS0CcJDY0ghdqmFCvn:M3agmnGL/TDPgxWzRgCgS0jjQB4n	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	20.99 KB	MD5: 6f87ba5a16deabac67ab80e9b79ec26e SHA1: f73ad7a1a3d834cadf99f581a4aed30268b12abb SHA256: 0cba8f54ac7f652869f246c08bb43976470f82a2fed54524e4c78ab16111c8b0 SSDeep: 384:XQwXE1oMpHon0d4dpsBebr9miOaKQZZGb6xN9Gir7/uZOz++8+t0PvHwh2:XQwU1LpGSUdWabZkGzgOi+3h2	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id-B4197730.[bitcharity@protonmail.com].com	1.65 KB	MD5: 2636cd13723db30a244ad20d348a8a19 SHA1: 2abfcd3a07e162d4efb785f86db39eb1960cd965 SHA256: dd112a7b9bbec7ca1cecd9d483c4b39289c6aa4d4d850abaf7ced00a729bf185 SSDeep: 48:9pVgOr9Gm2iKDWgFNuQK9chJAwrjbEI03HB4n:9sOZGpn6iq9CAwjEI03h4	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	18.48 KB	MD5: 97acbb095953c1a47b2232bf00704d5e SHA1: 25bfcd24edd6dbfdda7c9dea68aea93bceacf245 SHA256: b0d5ff37415c5c196aee865f746beebb9f6bd4ebc4a1446d3821a4c3239f31dd SSDeep: 384:IL2OsOJ2zBqwmTn6LXKMBhdNK08MJqULCr2MnSEtWHbU+jA4eCAgBqq4dmBp9QW7:IVJHT86MBhdNK0ZVCKZE0vAtCAR6B/77	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id-B4197730.[bitcharity@protonmail.com].com	8.03 KB	MD5: 45b9b43ef9445e17046d83dd386073ab SHA1: 117175c0044104d83b23240d9ad7320c5e7316b4 SHA256: b0f823e5804002eb84355661193f3d2f3839515a0ac99f6550efe5dd7c0b125d SSDeep: 192:VEtVtiNWhzpRap3W7ngqbNP8PJpuvUB6hU2LrtMBU/2nB:4iIdRaungq58PJpuvRZ+B	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.56 KB	MD5: 5794b66366c38cbb9619de0007518985 SHA1: 4273e52ffe901ef29bfa256ec1f275c767ea12a8 SHA256: d472c4d0f1a57b49b8762df38f67a977dc293d79be98b8df8fdd4be7c17b90b3 SSDeep: 48:kwBvzG2U0H8vfdPSkHY6aQDqEUtHf3ku4dkVIpOyI8ibjgMKwRgrhCB4n:kmFU+2VqMbY/3kvdonT8ilKwRgrh24	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id-B4197730.[bitcharity@protonmail.com].com	2.36 KB	MD5: 71eb380d478862aa0e806132742d8805 SHA1: d47b056df3dce4eec65c9197425a248888c2868c SHA256: a9f2c2f431102fc02361d6ac20fb677c26b49d79fbd76a46f4ad4ad169b4642a SSDeep: 48:XPD0TQNbsG+MbKaJ4Kxg/u5JqqNwVT8UaSSQGHfyuvgdnxdNqtrAVB4n:/DgARKaBxgyqqgk7Q+KIeVfL4	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	18.97 KB	MD5: 19a53e8e9770151d2331e15910260a58 SHA1: 71eb8349d8d5a2c0d000b9b78c391f2196e44e91 SHA256: 5bc3343f7c7541e4fbc5ae3fe475b5d082f6369b03d6d468b4a1ddea7f38aef4 SSDeep: 384:ZRmezzSS0F6g5eAk6wrErj+xsCmwSKD6WPXl+fYYOUXIfEnNQ:ZlzzSS3g59kPorj+xpx+WPX8fpIENQ	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	19.47 KB	MD5: 2afd5c5010960a721c6507b5b1e057bf SHA1: 2fa6c04afb9bbfa70138f054ae9de49b658bb66c SHA256: e675e241feccc7866417b6f3435198509703a073a9be82974f0686a397e4cd58 SSDeep: 384:2L2Db1v90W7lxx/JY9eJP13fWz98Li/i+yqDrYIQm:vZVlDx/JPJRfWjyqD4m	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[bitcharity@protonmail.com].com	18.99 KB	MD5: 4240febc0de820c15bad6ff4905d766b SHA1: fa8ac9a173db63a47b60e7bed311d4da9d8605b1 SHA256: 993c760571c28a5d7e9dacd152aad5d8a8ade33a0f6b9b99a1ea8f20bc6d051e SSDeep: 384:RUW2NKRv6it2ypeQB+gMJBIZcG9u7MtSG5jps1rgM09fGASpmrZbK3i:RZ2G642SewPuId9u8VvtGaZ+i	... File Actions Show Properties Download
C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	18.98 KB	MD5: d37fc2d5acdcd4e20c408cef761d16a9 SHA1: 2301152b3fe97abe9dcd7d71e06b34405ea85700 SHA256: 6845b66b147c65cb1f4ad9a6915220c0aaacb6052ca7265c65c1eb931b0097a0 SSDeep: 384:1688kT11Y/sX67PfVfN2E6U+3vhcYwxWgXND5u8e01xiJ9nObV/rcGO5vvEq:16G11qsX6rfVfB+/hcYwxWyB57jKXOb6	... File Actions Show Properties Download
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id-B4197730.[bitcharity@protonmail.com].com	9.61 KB	MD5: 4fefd75b1460fb7fd780702ab210c019 SHA1: 6a1a348247862795d40b1144fb03daacf51deb77 SHA256: 9123240ef553ee386935eed2d654b925f33a6030fb019685f604b66486d1b675 SSDeep: 192:JspmG5G7niK8W1FFzOi+UroUlJh4pND0qEPBfjBg+7FRvyj9TS90:JKP5GbiRW1FFzOi+UkgEl0qEPxO+5Zyx	... File Actions Show Properties Download

Host Behavior

File (4490)

Operation	Filename	Additional Information	Count	Logfile
Create	C:\Users\FD1HVy\Desktop\load0.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\WINDOWS\System32\load0.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Users\FD1HVy\Desktop\load0.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	2	Fn
Create	C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\GetCurrentRollback.ini	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\preoobe.cmd	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\SetupComplete.cmd	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$Recycle.Bin\S-1-5-18\desktop.ini	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$Recycle.Bin\S-1-5-18\desktop.ini	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$Recycle.Bin\S-1-5-18\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\preoobe.cmd	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\preoobe.cmd.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$WINRE_BACKUP_PARTITION.MARKER	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\GetCurrentRollback.ini	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\SetupComplete.cmd	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$GetCurrent\SafeOS\SetupComplete.cmd.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1025\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1028\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1029\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1030\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1031\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1033\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1032\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1035\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1036\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1037\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1038\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1041\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\SetupResources.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\SetupResources.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\SetupResources.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\DisplayIcon.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\DisplayIcon.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\DisplayIcon.ico.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1040\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Print.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Print.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Print.ico.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate1.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate2.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1043\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate3.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate4.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate3.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate3.ico.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate2.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate2.ico.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate4.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate4.ico.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1044\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate1.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate1.ico.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate5.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate5.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate5.ico.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate6.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate6.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate6.ico.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate7.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate7.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate7.ico.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1045\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate8.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1046\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Save.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Save.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Save.ico.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate8.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Rotate8.ico.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Setup.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Setup.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\Setup.ico.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\stop.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\stop.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\stop.ico.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1049\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\SysReqMet.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\SysReqMet.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\SysReqMet.ico.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1042\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\warn.ico	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\warn.ico	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Graphics\warn.ico.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Core.mzz	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Core.mzz.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\588bce7c90097ed212\1053\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1053\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\1055\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2052\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Core_x64.msi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Core_x86.msi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Extended.mzz	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Core_x86.msi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Core_x86.msi.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\2070\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3076\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Core_x64.msi.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\588bce7c90097ed212\netfx_Extended.mzz.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\588bce7c90097ed212\3082\eula.rtf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\eula.rtf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\eula.rtf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\LocalizedData.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\LocalizedData.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\3082\LocalizedData.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Client\Parameterinfo.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Client\Parameterinfo.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Client\Parameterinfo.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Client\UiInfo.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Client\UiInfo.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Client\UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\DHtmlHeader.html	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\DHtmlHeader.html	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\DHtmlHeader.html.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Extended\Parameterinfo.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Extended\Parameterinfo.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Extended\Parameterinfo.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Extended\UiInfo.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Extended\UiInfo.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Extended\UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\header.bmp	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\ParameterInfo.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUi.xsd	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Extended_x64.msi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Extended_x64.msi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Extended_x64.msi.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUi.xsd	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUi.xsd.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\header.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\header.bmp.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SplashScreen.bmp	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SplashScreen.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SplashScreen.bmp.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Strings.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Strings.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Strings.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\UiInfo.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\UiInfo.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\UiInfo.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\ParameterInfo.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\ParameterInfo.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\watermark.bmp	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\watermark.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\watermark.bmp.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Boot\BCD.LOG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BOOTSTAT.DAT	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\updaterevokesipolicy.p7b	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\BOOTSECT.BAK	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\BOOTSECT.BAK	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\BOOTSECT.BAK.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Boot\updaterevokesipolicy.p7b	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Boot\BOOTSTAT.DAT	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BOOTSTAT.DAT.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Extended_x86.msi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Extended_x86.msi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\netfx_Extended_x86.msi.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\RGB9RAST_x64.msi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\RGB9RAST_x64.msi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\RGB9RAST_x64.msi.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\RGB9Rast_x86.msi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\RGB9Rast_x86.msi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\RGB9Rast_x86.msi.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Setup.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Setup.exe	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Setup.exe.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupEngine.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupEngine.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupEngine.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUi.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUi.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUi.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUtility.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUtility.exe	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\SetupUtility.exe.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\sqmapi.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\sqmapi.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\sqmapi.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD.LOG1	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD.LOG2	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bg-BG\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootspaces.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bg-BG\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootvhd.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootvhd.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\cs-CZ\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\cs-CZ\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\cs-CZ\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\cs-CZ\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\da-DK\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\da-DK\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\da-DK\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\da-DK\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\de-DE\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\de-DE\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\de-DE\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\de-DE\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootspaces.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\jpn_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\msyhn_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\msyhn_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\msyh_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\msyh_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\segmono_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\segmono_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\fr-CA\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\fr-CA\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\fr-FR\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\fr-FR\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\fr-FR\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\fr-FR\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\bootmgr	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Application.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\BOOTNXT.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\HardwareEvents.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\HardwareEvents.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\HardwareEvents.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Internet Explorer.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Internet Explorer.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Internet Explorer.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Key Management Service.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Key Management Service.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Key Management Service.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\msadc\adcvbs.inc	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\msadc\adcvbs.inc	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\README.txt	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\README.txt	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\Welcome.html	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\Welcome.html	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\Welcome.html.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\AppXManifest.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Microsoft Office\FileSystemMetadata.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\FileSystemMetadata.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\OSPP.VBS	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\SLERROR.XML	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\OSPP.VBS	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\SLERROR.XML	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-International%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-International%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Known Folders API Service.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Known Folders API Service.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-MUI%4Admin.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-MUI%4Admin.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-MUI%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-MUI%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Store%4Operational.evtx	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Store%4Operational.evtx	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Read	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com	size = 1048560, size_out = 129	1	Fn Data
Read	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com	size = 1048560, size_out = 0	1	Fn
Write	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com	size = 144	1	Fn Data
Write	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com	size = 234	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 4784	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 4144	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 4464	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 264	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 256	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeUpdateSchedule.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 260	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	size = 96096	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	size = 244	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-B4197730.[bitcharity@protonmail.com].com	size = 656	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-B4197730.[bitcharity@protonmail.com].com	size = 234	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm	size = 69648	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm	size = 306	1	Fn Data
Write	C:\Program Files\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com	size = 176	1	Fn Data
Write	C:\Program Files\desktop.ini.id-B4197730.[bitcharity@protonmail.com].com	size = 234	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[bitcharity@protonmail.com].com	size = 69648	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[bitcharity@protonmail.com].com	size = 368	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[bitcharity@protonmail.com].com	size = 1424	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt.id-B4197730.[bitcharity@protonmail.com].com	size = 232	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 8592	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 232	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id-B4197730.[bitcharity@protonmail.com].com	size = 14160	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip.id-B4197730.[bitcharity@protonmail.com].com	size = 234	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 160	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\invalid32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 244	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 7808	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 246	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 12256	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 252	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 15280	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 238	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 176	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 258	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 160	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 258	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 160	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 262	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 160	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 176	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 258	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 160	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 262	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[bitcharity@protonmail.com].com	size = 4240	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt.id-B4197730.[bitcharity@protonmail.com].com	size = 238	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[bitcharity@protonmail.com].com	size = 105504	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-B4197730.[bitcharity@protonmail.com].com	size = 262	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\lib\tzdb.dat.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[bitcharity@protonmail.com].com	size = 48	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\README.txt.id-B4197730.[bitcharity@protonmail.com].com	size = 232	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id-B4197730.[bitcharity@protonmail.com].com	size = 145184	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.id-B4197730.[bitcharity@protonmail.com].com	size = 266	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[bitcharity@protonmail.com].com	size = 63936	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[bitcharity@protonmail.com].com	size = 280	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\Welcome.html.id-B4197730.[bitcharity@protonmail.com].com	size = 960	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\Welcome.html.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 288	1	Fn Data
Write	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 256	1	Fn Data
Write	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[bitcharity@protonmail.com].com	size = 174544	1	Fn Data
Write	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[bitcharity@protonmail.com].com	size = 36352	1	Fn Data
Write	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.id-B4197730.[bitcharity@protonmail.com].com	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[bitcharity@protonmail.com].com	size = 94480	1	Fn Data
Write	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1536	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 387360	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 786700	1	Fn Data
Write	C:\Program Files\Microsoft Office\AppXManifest.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 262144	3	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 496528	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 800880	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 253728	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 19456	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 763376	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1048560	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 2160	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 76384	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 343344	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 14928	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 357360	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 65008	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 9232	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1456	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 399536	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 3760	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 527968	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 3376	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 318	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 384	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 256	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 9840	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.en-us.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 262	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 14880	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 7232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 9040	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 6688	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF	size = 3264	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 786714	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 8112	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 528	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 512	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 11904	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 7696	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.xml.id-B4197730.[bitcharity@protonmail.com].com	size = 262144	3	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 3488	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 12704	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 12496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 3152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 5264	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 2608	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 15312	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 5328	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 10608	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 5040	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 4960	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 1152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 6992	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 13264	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 7584	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 8592	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 9264	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 4896	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 5376	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 4400	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 3968	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 3392	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 3136	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 5024	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4736	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00015_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5696	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00790_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 10848	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00914_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7088	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00965_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 14432	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3360	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01039_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3040	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00010_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 20592	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN00853_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7984	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01060_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1600	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01044_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 26336	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01173_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1840	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01084_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 27872	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01174_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3760	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01184_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3024	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01218_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5840	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01216_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7376	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	2	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02122_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7552	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2112	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 6640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02724_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN02559_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2352	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04108_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 9248	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN03500_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3424	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04134_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04174_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2768	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN01251_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 6064	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04117_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 6640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04191_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04196_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4624	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04195_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7680	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04206_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 8496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04225_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7808	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04267_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2032	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04269_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4304	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04332_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3360	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04326_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7808	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04235_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04384_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4816	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04369_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF	size = 3232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4880	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00116_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04385_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AN04323_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 26896	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00141_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 16192	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00173_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 11648	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00155_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 28960	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00146_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 22528	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD00160_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 17248	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD05119_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 16128	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06102_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 16688	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD06200_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4928	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07804_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4080	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07831_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 26752	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD07761_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 24784	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08773_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 24336	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08758_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 40208	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08868_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 48000	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD08808_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 14544	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09194_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 47792	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09031_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 20560	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09662_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7968	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD09664_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 20192	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 13520	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 20464	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 15744	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 12992	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19695_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 9712	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19827_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 8784	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19828_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 14496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19986_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 18320	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19988_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 11072	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD20013_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 12528	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00008_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 9824	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00012_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1024	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00098_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7872	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00045_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 896	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00105_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 10160	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00122_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1472	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00130_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1520	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00152_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4000	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00194_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 8080	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00195_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 9312	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00234_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4032	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00242_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 14448	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00247_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1552	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00248_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4720	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00252_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1744	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00254_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 12496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00261_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2560	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00262_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5760	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00265_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2656	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00267_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5280	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00269_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3792	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00273_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4176	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00274_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 816	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3024	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00270_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 13104	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[bitcharity@protonmail.com].com	size = 16000	1	Fn Data
Write	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 27056	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 18640	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 274	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 18640	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 274	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 9600	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 21200	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 290	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19152	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 294	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19152	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 276	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 11632	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 278	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19664	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 274	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1712	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 27568	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4416	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 11504	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 6272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 19488	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3776	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3360	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 29008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 18640	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 282	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1344	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19152	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 286	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1456	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 20688	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 284	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 22736	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7984	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19152	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 276	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1056	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2384	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2176	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 8368	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1728	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 27856	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 12800	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4992	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3120	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1600	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 26832	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 282	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2064	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5584	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1216	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 70864	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3536	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19664	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3904	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1680	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19664	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3808	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 23248	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2736	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2448	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 24784	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 274	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 15008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19152	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1888	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 21200	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3504	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7184	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 396976	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 250	1	Fn Data
Delete	C:\588bce7c90097ed212\1053\eula.rtf	-	1	Fn
Delete	C:\588bce7c90097ed212\1055\LocalizedData.xml	-	1	Fn
For performance reasons, the remaining 3307 entries are omitted. The remaining entries can be found in glog.xml.

Registry (8)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Startup, data = 83, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ	1	Fn
Write Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	value_name = load0.exe, data = C:\WINDOWS\System32\load0.exe, size = 58, type = REG_SZ	1	Fn

Process (1910)

Operation	Process	Additional Information	Count	Logfile
Create	C:\WINDOWS\system32\cmd.exe	os_pid = 0x1be4, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE	1	Fn
Enumerate Processes	-	-	1884	Fn
Enumerate Processes	-	-	25	Fn

Module (146)

Operation	Module	Additional Information	Count	Logfile
Load	KERNEL32.dll	base_address = 0x75e90000	1	Fn
Load	kernel32.dll	base_address = 0x75e90000	1	Fn
Load	advapi32.dll	base_address = 0x761b0000	1	Fn
Load	user32.dll	base_address = 0x74b70000	1	Fn
Load	Shell32.dll	base_address = 0x76480000	1	Fn
Load	ntdll.dll	base_address = 0x77bb0000	1	Fn
Load	mpr.dll	base_address = 0x72fd0000	1	Fn
Load	ws2_32.dll	base_address = 0x746a0000	1	Fn
Get Handle	c:\users\fd1hvy\desktop\load0.exe	base_address = 0x400000	1	Fn
Get Handle	c:\windows\syswow64\kernel32.dll	base_address = 0x75e90000	16	Fn
Get Filename	-	process_name = c:\users\fd1hvy\desktop\load0.exe, file_name_orig = C:\Users\FD1HVy\Desktop\load0.exe, size = 32767	3	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetProcAddress, address_out = 0x75ea51b0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = LoadLibraryA, address_out = 0x75ea5a80	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WaitForSingleObject, address_out = 0x75efeca0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = InitializeCriticalSectionAndSpinCount, address_out = 0x75efebb0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = LeaveCriticalSection, address_out = 0x77bfb250	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetLastError, address_out = 0x75ea5010	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = EnterCriticalSection, address_out = 0x77bfb2d0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ReleaseMutex, address_out = 0x75efec20	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CloseHandle, address_out = 0x75efeab0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetModuleHandleW, address_out = 0x75ea50d0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindNextFileW, address_out = 0x75efee40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindClose, address_out = 0x75efed70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = MoveFileW, address_out = 0x75ede500	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetFileSizeEx, address_out = 0x75efef40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetModuleFileNameW, address_out = 0x75ea5090	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetFileAttributesW, address_out = 0x75efef10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ExitProcess, address_out = 0x75ea3cb0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCommandLineW, address_out = 0x75ea4cc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetComputerNameW, address_out = 0x75ed32c0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetComputerNameA, address_out = 0x75ed3780	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateMutexW, address_out = 0x75efeb70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrlenW, address_out = 0x75ea6c70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrlenA, address_out = 0x75ea6c50	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCurrentProcess, address_out = 0x75efea10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetLogicalDrives, address_out = 0x75ea0d20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetTickCount, address_out = 0x75efdd50	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = DeleteFileW, address_out = 0x75efed40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WideCharToMultiByte, address_out = 0x75ea6b10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Sleep, address_out = 0x75ea6760	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ReadFile, address_out = 0x75eff090	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateFileW, address_out = 0x75efed10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = OpenMutexW, address_out = 0x75efebf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WaitForMultipleObjects, address_out = 0x75efec80	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrcmpiW, address_out = 0x75ea6bf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrcmpiA, address_out = 0x75ea6bd0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = DeleteCriticalSection, address_out = 0x77bdfb90	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetVersion, address_out = 0x75ea56c0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateThread, address_out = 0x75ea46b0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ExpandEnvironmentStringsW, address_out = 0x75ea4a40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = QueryPerformanceCounter, address_out = 0x75ea5da0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = QueryPerformanceFrequency, address_out = 0x75ea5dc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCurrentProcessId, address_out = 0x75efea20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetFileAttributesW, address_out = 0x75eff100	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetVolumeInformationW, address_out = 0x75eff020	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WriteFile, address_out = 0x75eff180	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetFilePointerEx, address_out = 0x75eff130	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetEndOfFile, address_out = 0x75eff0e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindFirstFileW, address_out = 0x75efedf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetProcessHeap, address_out = 0x75ea51f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapReAlloc, address_out = 0x77bef630	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapAlloc, address_out = 0x77bf2dc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapFree, address_out = 0x75ea57f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreatePipe, address_out = 0x75ea4590	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetHandleInformation, address_out = 0x75efeae0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateProcessW, address_out = 0x75ea4610	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CompareStringW, address_out = 0x75ea4430	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CompareStringA, address_out = 0x75ea4410	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = OpenProcess, address_out = 0x75ea5cc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = TerminateProcess, address_out = 0x75ea67e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetSystemTime, address_out = 0x75ea54e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SystemTimeToFileTime, address_out = 0x75ea67a0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateToolhelp32Snapshot, address_out = 0x75ededc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Process32NextW, address_out = 0x75edf8f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Process32FirstW, address_out = 0x75edf750	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegOpenKeyExW, address_out = 0x761ce580	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegQueryValueExW, address_out = 0x761ce5a0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegSetValueExW, address_out = 0x761cf530	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegCloseKey, address_out = 0x761ced60	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenProcessToken, address_out = 0x761cefb0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = GetTokenInformation, address_out = 0x761cee90	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenSCManagerW, address_out = 0x761d0540	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenServiceW, address_out = 0x761cfa20	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = CloseServiceHandle, address_out = 0x761cfc00	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = ControlService, address_out = 0x761e26d0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = QueryServiceStatus, address_out = 0x761d2380	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = EnumDependentServicesW, address_out = 0x761e2f70	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = EnumServicesStatusExW, address_out = 0x761cfc80	1	Fn
Get Address	c:\windows\syswow64\user32.dll	function = SystemParametersInfoW, address_out = 0x74b9f210	1	Fn
Get Address	c:\windows\syswow64\shell32.dll	function = ShellExecuteExW, address_out = 0x765e4730	1	Fn
Get Address	c:\windows\syswow64\ntdll.dll	function = NtQuerySystemInformation, address_out = 0x77c22070	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetCloseEnum, address_out = 0x72fd2640	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetOpenEnumW, address_out = 0x72fd2790	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetEnumResourceW, address_out = 0x72fd2410	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = WSAStartup, address_out = 0x746a5b40	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = socket, address_out = 0x746b4510	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = send, address_out = 0x746a5030	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = recv, address_out = 0x746b0c50	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = connect, address_out = 0x746a5410	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = closesocket, address_out = 0x746b0910	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = gethostbyname, address_out = 0x746d6cb0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = inet_addr, address_out = 0x746b9160	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = ntohl, address_out = 0x746a49d0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = htonl, address_out = 0x746a49d0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = htons, address_out = 0x746b8ff0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Wow64DisableWow64FsRedirection, address_out = 0x75ea6b30	16	Fn

Service (78)

Operation	Additional Information	Count	Logfile
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn

System (1191)

Operation	Additional Information	Count	Logfile
Get Computer Name	result_out = NQDPDE	1	Fn
Sleep	duration = 0 milliseconds (0.000 seconds)	840	Fn
Sleep	duration = -1 (infinite)	1	Fn
Sleep	duration = 500 milliseconds (0.500 seconds)	24	Fn
Sleep	duration = 100 milliseconds (0.100 seconds)	75	Fn
Get Time	type = Performance Ctr, time = 13889663881	1	Fn
Get Time	type = Ticks, time = 138859	3	Fn
Get Time	type = Ticks, time = 144703	1	Fn
Get Time	type = Ticks, time = 144718	1	Fn
Get Time	type = Ticks, time = 146015	4	Fn
Get Time	type = Ticks, time = 146281	2	Fn
Get Time	type = Ticks, time = 146453	2	Fn
Get Time	type = Ticks, time = 146578	2	Fn
Get Time	type = Ticks, time = 146921	2	Fn
Get Time	type = Ticks, time = 147031	4	Fn
Get Time	type = Ticks, time = 147140	2	Fn
Get Time	type = Ticks, time = 147250	2	Fn
Get Time	type = Ticks, time = 147656	2	Fn
Get Time	type = Ticks, time = 147859	2	Fn
Get Time	type = Ticks, time = 148265	4	Fn
Get Time	type = Ticks, time = 148484	2	Fn
Get Time	type = Ticks, time = 148609	2	Fn
Get Time	type = Ticks, time = 148734	2	Fn
Get Time	type = Ticks, time = 148890	2	Fn
Get Time	type = Ticks, time = 149015	2	Fn
Get Time	type = Ticks, time = 149359	4	Fn
Get Time	type = Ticks, time = 149687	2	Fn
Get Time	type = Ticks, time = 149921	2	Fn
Get Time	type = Ticks, time = 150156	2	Fn
Get Time	type = Ticks, time = 150296	2	Fn
Get Time	type = Ticks, time = 150406	4	Fn
Get Time	type = Ticks, time = 150625	2	Fn
Get Time	type = Ticks, time = 150750	2	Fn
Get Time	type = Ticks, time = 150859	2	Fn
Get Time	type = Ticks, time = 151000	2	Fn
Get Time	type = Ticks, time = 151109	2	Fn
Get Time	type = Ticks, time = 151218	2	Fn
Get Time	type = Ticks, time = 151328	2	Fn
Get Time	type = Ticks, time = 151484	4	Fn
Get Time	type = Ticks, time = 151625	2	Fn
Get Time	type = Ticks, time = 151734	2	Fn
Get Time	type = Ticks, time = 151843	2	Fn
Get Time	type = Ticks, time = 151968	2	Fn
Get Time	type = Ticks, time = 152093	2	Fn
Get Time	type = Ticks, time = 152203	2	Fn
Get Time	type = Ticks, time = 152328	2	Fn
Get Time	type = Ticks, time = 152437	2	Fn
Get Time	type = Ticks, time = 152546	4	Fn
Get Time	type = Ticks, time = 152671	2	Fn
Get Time	type = Ticks, time = 153140	2	Fn
Get Time	type = Ticks, time = 153265	2	Fn
Get Time	type = Ticks, time = 153421	2	Fn
Get Time	type = Ticks, time = 153531	2	Fn
Get Time	type = Ticks, time = 153656	4	Fn
Get Time	type = Ticks, time = 153781	2	Fn
Get Time	type = Ticks, time = 153906	2	Fn
Get Time	type = Ticks, time = 154390	2	Fn
Get Time	type = Ticks, time = 154859	4	Fn
Get Time	type = Ticks, time = 155187	2	Fn
Get Time	type = Ticks, time = 155468	2	Fn
Get Time	type = Ticks, time = 155671	1	Fn
Get Time	type = Ticks, time = 155687	1	Fn
Get Time	type = Ticks, time = 155796	2	Fn
Get Time	type = Ticks, time = 156250	4	Fn
Get Time	type = Ticks, time = 156640	2	Fn
Get Time	type = Ticks, time = 156843	2	Fn
Get Time	type = Ticks, time = 157078	2	Fn
Get Time	type = Ticks, time = 157500	4	Fn
Get Time	type = Ticks, time = 157671	2	Fn
Get Time	type = Ticks, time = 158015	2	Fn
Get Time	type = Ticks, time = 158484	2	Fn
Get Time	type = Ticks, time = 158593	4	Fn
Get Time	type = Ticks, time = 158718	2	Fn
Get Time	type = Ticks, time = 159046	2	Fn
Get Time	type = Ticks, time = 159265	2	Fn
Get Time	type = Ticks, time = 159453	2	Fn
Get Time	type = Ticks, time = 159687	4	Fn
Get Time	type = Ticks, time = 159828	2	Fn
Get Time	type = Ticks, time = 159937	2	Fn
Get Time	type = Ticks, time = 160046	2	Fn
Get Time	type = Ticks, time = 160156	2	Fn
Get Time	type = Ticks, time = 160265	2	Fn
Get Time	type = Ticks, time = 160468	2	Fn
Get Time	type = Ticks, time = 160593	2	Fn
Get Time	type = Ticks, time = 161812	4	Fn
Get Time	type = Ticks, time = 162468	2	Fn
Get Time	type = Ticks, time = 162890	4	Fn
Get Time	type = Ticks, time = 163312	2	Fn
Get Time	type = Ticks, time = 163937	4	Fn
Get Time	type = Ticks, time = 164781	2	Fn
Get Time	type = Ticks, time = 165234	4	Fn
Get Time	type = Ticks, time = 165812	2	Fn
Get Time	type = Ticks, time = 166125	2	Fn
Get Time	type = Ticks, time = 166437	4	Fn
Get Time	type = Ticks, time = 166656	2	Fn
Get Time	type = Ticks, time = 167078	2	Fn
Get Time	type = Ticks, time = 167421	2	Fn
Get Time	type = Ticks, time = 167546	4	Fn
Get Time	type = Ticks, time = 168250	2	Fn
Get Time	type = Ticks, time = 168921	4	Fn
Get Time	type = Ticks, time = 169421	2	Fn
Get Time	type = Ticks, time = 169671	2	Fn
Get Time	type = Ticks, time = 170093	4	Fn
Get Time	type = Ticks, time = 170671	2	Fn
Get Time	type = Ticks, time = 171515	4	Fn
Get Time	type = Ticks, time = 172437	2	Fn
Get Time	type = Ticks, time = 173140	4	Fn
Get Time	type = Ticks, time = 173953	2	Fn
Get Info	type = Operating System	2	Fn

Mutex (4)

Operation	Additional Information	Count	Logfile
Create	mutex_name = Global\syncronize_Q25317A	1	Fn
Create	mutex_name = Global\syncronize_Q25317U	1	Fn
Open	mutex_name = Global\syncronize_Q25317A, desired_access = SYNCHRONIZE	1	Fn
Open	mutex_name = Global\syncronize_Q25317U, desired_access = SYNCHRONIZE	1	Fn

Process #2: cmd.exe

249

Information	Value
ID	#2
File Name	c:\windows\system32\cmd.exe
Command Line	"C:\WINDOWS\system32\cmd.exe"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:01, Reason: Child Process
Unmonitor	End Time: 00:05:03, Reason: Terminated by Timeout
Monitor Duration	00:03:02

OS Process Information

Information	Value
PID	0x1be4
Parent PID	0x794 (c:\users\fd1hvy\desktop\load0.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1BE8 0x 1C3C

Host Behavior

File (188)

Operation	Filename	Additional Information	Count	Logfile
Get Info	C:\Users\FD1HVy\Desktop	type = file_attributes	2	Fn
Get Info	STD_OUTPUT_HANDLE	type = file_type	11	Fn
Get Info	STD_INPUT_HANDLE	type = file_type	5	Fn
Open	STD_OUTPUT_HANDLE	-	28	Fn
Open	STD_INPUT_HANDLE	-	72	Fn
Read	STD_INPUT_HANDLE	size = 1, size_out = 1	60	Fn Data
Write	STD_OUTPUT_HANDLE	size = 38	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 2	4	Fn Data
Write	STD_OUTPUT_HANDLE	size = 52	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 24	3	Fn Data
Write	STD_OUTPUT_HANDLE	size = 36	1	Fn Data

Registry (17)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data = 4, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = AutoRun, data = 9, type = REG_NONE	1	Fn

Process (4)

Operation	Process	Additional Information	Count	Logfile
Create	C:\WINDOWS\system32\mode.com	os_pid = 0x1c6c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Create	C:\WINDOWS\system32\vssadmin.exe	os_pid = 0x1c94, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Get Info	C:\WINDOWS\system32\mode.com	type = PROCESS_BASIC_INFORMATION	1	Fn
Get Info	C:\WINDOWS\system32\vssadmin.exe	type = PROCESS_BASIC_INFORMATION	1	Fn

Memory (2)

Operation	Process	Additional Information	Success	Count	Logfile
Read	C:\WINDOWS\system32\mode.com	address = 333438554112, size = 1952		1	Fn Data
Read	C:\WINDOWS\system32\vssadmin.exe	address = 1066388754432, size = 1952		1	Fn Data

Module (10)

Operation	Module	Additional Information	Count	Logfile
Load	NTDLL.DLL	base_address = 0x7ff931f40000	1	Fn
Get Handle	c:\windows\system32\cmd.exe	base_address = 0x7ff72b9b0000	1	Fn
Get Handle	c:\windows\system32\kernel32.dll	base_address = 0x7ff92fdd0000	2	Fn
Get Filename	-	process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetThreadUILanguage, address_out = 0x7ff92fdea990	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CopyFileExW, address_out = 0x7ff92fdee830	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = IsDebuggerPresent, address_out = 0x7ff92fdee300	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetConsoleInputExeNameW, address_out = 0x7ff92f1b0a40	1	Fn
Get Address	c:\windows\system32\ntdll.dll	function = NtQueryInformationProcess, address_out = 0x7ff931fe56b0	1	Fn

System (1)

Operation	Additional Information	Success	Count	Logfile
Get Info	type = Operating System		1	Fn

Environment (25)

Operation	Additional Information	Count	Logfile
Get Environment String	-	8	Fn Data
Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	3	Fn
Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	3	Fn
Get Environment String	name = PROMPT	1	Fn
Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Get Environment String	name = KEYS	1	Fn
Get Environment String	name = PROMPT, result_out = $P$G	2	Fn
Set Environment String	name = PROMPT, value = $P$G	1	Fn
Set Environment String	name = =C:, value = C:\Users\FD1HVy\Desktop	1	Fn
Set Environment String	name = COPYCMD	2	Fn
Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Set Environment String	name = =ExitCodeAscii	1	Fn

Process #4: mode.com

Information	Value
ID	#4
File Name	c:\windows\system32\mode.com
Command Line	mode con cp select=1251
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:14, Reason: Child Process
Unmonitor	End Time: 00:02:21, Reason: Self Terminated
Monitor Duration	00:00:06
Remark	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0x1c6c
Parent PID	0x1be4 (c:\windows\system32\cmd.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1C70 0x 1C74 0x 1C78

Process #5: vssadmin.exe

Information	Value
ID	#5
File Name	c:\windows\system32\vssadmin.exe
Command Line	vssadmin delete shadows /all /quiet
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:02:22, Reason: Child Process
Unmonitor	End Time: 00:05:03, Reason: Terminated by Timeout
Monitor Duration	00:02:40
Remark	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0x1c94
Parent PID	0x1be4 (c:\windows\system32\cmd.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 1C98 0x 1CD0

Process #6: load0.exe

Information	Value
ID	#6
File Name	c:\windows\system32\load0.exe
Command Line	"C:\Windows\System32\load0.exe"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:03:38, Reason: Autostart
Unmonitor	End Time: 00:03:48, Reason: Self Terminated
Monitor Duration	00:00:09
Remark	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0xda0
Parent PID	0x9c8 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x DA4

Process #7: load0.exe

29562

Information	Value
ID	#7
File Name	c:\programdata\microsoft\windows\start menu\programs\startup\load0.exe
Command Line	"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:03:40, Reason: Autostart
Unmonitor	End Time: 00:04:48, Reason: Self Terminated
Monitor Duration	00:01:07

OS Process Information

Information	Value
PID	0xdac
Parent PID	0x9c8 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x DB0 0x DB8 0x DF8 0x DFC 0x E00 0x E04 0x E08 0x E0C 0x E10 0x E14 0x E18 0x E1C 0x E20 0x E24 0x E28 0x E2C 0x E30 0x E34 0x E38 0x E3C 0x E40 0x E44 0x E7C 0x E80 0x E84 0x E88 0x E8C 0x E90 0x E94 0x E98 0x E9C 0x EA0 0x EA4 0x EA8 0x EAC 0x EB0 0x EB4 0x EB8 0x EBC 0x EC0 0x EC4 0x EC8 0x EE8 0x EEC 0x EF0 0x EF4 0x EF8 0x EFC 0x F00 0x F04 0x F08 0x F0C 0x F10 0x F14 0x F18 0x F1C 0x F20 0x F24 0x F28 0x F2C 0x F30 0x F34 0x F88 0x F8C 0x F90 0x F94 0x F98 0x F9C 0x FA0 0x FA4 0x FA8 0x FAC 0x FB0 0x FB4 0x FB8 0x FBC 0x FC0 0x FC4 0x FC8 0x FCC 0x FD0 0x FD4 0x 5B8 0x 5C0 0x 5C4 0x 5A8 0x 598 0x 59C 0x 470 0x 480 0x 488 0x 444 0x 46C 0x 370 0x 380 0x 394 0x 448 0x 478 0x 5A0 0x 5B4 0x 5B0 0x CA8 0x 904 0x 8F0 0x AF8 0x CB4 0x C74 0x CAC 0x CB8 0x CB0 0x CE0 0x CC4 0x C80 0x C70 0x D8C 0x D88 0x D98 0x D80 0x D90 0x D94 0x D9C 0x D84 0x BF8 0x 8A4 0x CF4 0x CFC 0x D00 0x D0C 0x D10 0x D08 0x CF8 0x DE0 0x DDC 0x CF0 0x 1004 0x 1008 0x 100C 0x 1010 0x 1014 0x 1018 0x 101C 0x 1020 0x 1074 0x 1078 0x 107C 0x 1080 0x 1084 0x 1088 0x 108C 0x 1090 0x 1094 0x 1098 0x 109C 0x 10A0 0x 10A4 0x 10A8 0x 10AC 0x 10B0 0x 10B4 0x 10B8 0x 10BC 0x 10C0 0x 1114 0x 1118 0x 111C 0x 1120 0x 1124 0x 1128 0x 112C 0x 1130 0x 1134 0x 1138 0x 113C 0x 1140 0x 1144 0x 1148 0x 114C 0x 1150 0x 1154 0x 1158 0x 115C 0x 1160 0x 11B4 0x 11B8 0x 11BC 0x 11C0 0x 11C4 0x 11C8 0x 11CC 0x 11D0 0x 11D4 0x 11D8 0x 11DC 0x 11E0 0x 11E4 0x 11E8 0x 11EC 0x 11F0 0x 11F4 0x 11F8 0x 11FC 0x 1200 0x 1254 0x 1258 0x 125C 0x 1260 0x 1264 0x 1268 0x 126C 0x 1270 0x 1274 0x 1278 0x 127C 0x 1280 0x 1284 0x 1288 0x 128C 0x 1290 0x 1294 0x 1298 0x 129C 0x 12A0 0x 12F4 0x 12F8 0x 12FC 0x 1300 0x 1304 0x 1308 0x 130C 0x 1310 0x 1314 0x 1318 0x 131C 0x 1320 0x 1324 0x 1328 0x 132C 0x 1330 0x 1334 0x 1338 0x 133C 0x 1340 0x 1394 0x 1398 0x 139C 0x 13A0 0x 13A4 0x 13A8 0x 13AC 0x 13B0 0x 13B4 0x 13B8 0x 13BC 0x 13C0 0x 13C4 0x 13C8 0x 13CC 0x 13D0 0x 13D4 0x 13D8 0x 13DC 0x 13E0 0x 1420 0x 1424 0x 1428 0x 142C 0x 1430 0x 1434 0x 1438 0x 143C 0x 1440 0x 1444 0x 1448 0x 144C 0x 1450 0x 1454 0x 1458 0x 145C 0x 1460 0x 1464 0x 1468 0x 146C 0x 14C0 0x 14C4 0x 14C8 0x 14CC 0x 14D0 0x 14D4 0x 14D8 0x 14DC 0x 14E0 0x 14E4 0x 14E8 0x 14EC 0x 14F0 0x 14F4 0x 14F8 0x 14FC 0x 1500 0x 1504 0x 1508 0x 150C 0x 1560 0x 1564 0x 1568 0x 156C 0x 1570 0x 1574 0x 1578 0x 157C 0x 1580 0x 1584 0x 1588 0x 158C 0x 1590 0x 1594 0x 1598 0x 159C 0x 15A0 0x 15A4 0x 15A8 0x 15AC 0x 1600 0x 1604 0x 1608 0x 160C 0x 1610 0x 1614 0x 1618 0x 161C 0x 1620 0x 1624 0x 1628 0x 162C 0x 1630 0x 1634 0x 1638 0x 163C 0x 1640 0x 1644 0x 1648 0x 164C 0x 16A0 0x 16A4 0x 16A8 0x 16AC 0x 16B0 0x 16B4 0x 16B8 0x 16BC 0x 16C0 0x 16C4 0x 16C8 0x 16CC 0x 16D0 0x 16D4 0x 16D8 0x 16DC 0x 16E0 0x 16E4 0x 16E8 0x 16EC 0x 1744 0x 1748 0x 174C 0x 1750 0x 1754 0x 1758 0x 175C 0x 1760 0x 1764 0x 1768 0x 176C 0x 1770 0x 1774 0x 1778 0x 177C 0x 1780 0x 1784 0x 1788 0x 178C 0x 1790 0x 17E4 0x 17E8 0x 17EC 0x 17F0 0x 17F4 0x 17F8 0x 17FC 0x 9B8 0x 9C4 0x D34 0x D38 0x D3C 0x D2C 0x D30 0x D28 0x 1804 0x 1808 0x 180C 0x 1810 0x 1814 0x 1868 0x 186C 0x 1870 0x 1874 0x 1878 0x 187C 0x 1880 0x 1884 0x 1888 0x 188C 0x 1890 0x 1894 0x 1898 0x 189C 0x 18A0 0x 18A4 0x 18A8 0x 18AC 0x 18B0 0x 18B4 0x 1968 0x 196C 0x 1970 0x 1974 0x 1978 0x 197C 0x 1980 0x 1984 0x 1988 0x 198C 0x 1990 0x 1994 0x 1998 0x 199C 0x 19A0 0x 19A4 0x 19A8 0x 19AC 0x 19B0 0x 19B4 0x 1A08 0x 1A0C 0x 1A10 0x 1A14 0x 1A18 0x 1A1C 0x 1A20 0x 1A24 0x 1A28 0x 1A2C 0x 1A30 0x 1A34 0x 1A38 0x 1A3C 0x 1A40 0x 1A44 0x 1A48 0x 1A4C 0x 1A50 0x 1A54 0x 1AA8 0x 1AAC 0x 1AB0 0x 1AB4 0x 1AB8 0x 1ABC 0x 1AC0 0x 1AC4 0x 1AC8 0x 1ACC 0x 1AD0 0x 1AD4 0x 1AD8 0x 1ADC 0x 1AE0 0x 1AE4 0x 1AE8 0x 1AEC 0x 1AF0 0x 1AF4 0x 1B48 0x 1B4C 0x 1B50 0x 1B54 0x 1B58 0x 1B5C 0x 1B60 0x 1B64 0x 1B68 0x 1B6C 0x 1B70 0x 1B74 0x 1B78 0x 1B7C 0x 1B80 0x 1B84 0x 1B88 0x 1B8C 0x 1B90 0x 1B94 0x 1BE8 0x 1BEC 0x 1BF0 0x 1BF4 0x 1BF8 0x 1BFC 0x AA4 0x 195C 0x 1960 0x 1A4 0x 200 0x 210 0x 580 0x 260 0x 26C 0x 1C04 0x 1C08 0x 1C0C 0x 1C10 0x 1C14 0x 1C68 0x 1C6C 0x 1C70 0x 1C74 0x 1C78 0x 1C7C 0x 1C80 0x 1C84 0x 1C88 0x 1C8C 0x 1C90 0x 1C94 0x 1C98 0x 1C9C 0x 1CA0 0x 1CA4 0x 1CA8 0x 1CAC 0x 1CB0 0x 1CB4 0x 1D08 0x 1D0C 0x 1D10 0x 1D14 0x 1D18 0x 1D1C 0x 1D20 0x 1D24 0x 1D28 0x 1D2C 0x 1D30 0x 1D34 0x 1D38 0x 1D3C 0x 1D40 0x 1D44 0x 1D48 0x 1D4C 0x 1D50 0x 1D54 0x 1DA8 0x 1DAC 0x 1DB0 0x 1DB4 0x 1DB8 0x 1DBC 0x 1DC0 0x 1DC4 0x 1DC8 0x 1DCC 0x 1DD0 0x 1DD4 0x 1DD8 0x 1DDC 0x 1DE0 0x 1DE4 0x 1DE8 0x 1DEC 0x 1DF0 0x 1DF4 0x 1E48 0x 1E4C 0x 1E50 0x 1E54 0x 1E58 0x 1E5C 0x 1E60 0x 1E64 0x 1E68 0x 1E6C 0x 1E70 0x 1E74 0x 1E78 0x 1E7C 0x 1E80 0x 1E84 0x 1E88 0x 1E8C 0x 1E90 0x 1E94 0x 1EE8 0x 1EEC 0x 1EF0 0x 1EF4 0x 1EF8 0x 1EFC 0x 1F00 0x 1F04 0x 1F08 0x 1F0C 0x 1F10 0x 1F14 0x 1F18 0x 1F1C 0x 1F20 0x 1F24 0x 1F28 0x 1F2C 0x 1F30 0x 1F34 0x 1F88 0x 1F8C 0x 1F90 0x 1F94 0x 1F98 0x 1F9C 0x 1FA0 0x 1FA4 0x 1FA8 0x 1FAC 0x 1FB0 0x 1FB4 0x 1FB8 0x 1FBC 0x 1FC0 0x 1FC4 0x 1FC8 0x 1FCC 0x 1FD0 0x 1FD4 0x 2028 0x 202C 0x 2030 0x 2034 0x 2038 0x 203C 0x 2040 0x 2044 0x 2048 0x 204C 0x 2050 0x 2054 0x 2058 0x 205C 0x 2060 0x 2064 0x 2068 0x 206C 0x 2070 0x 2074 0x 20C8 0x 20CC 0x 20D0 0x 20D4 0x 20D8 0x 20DC 0x 20E0 0x 20E4 0x 20E8 0x 20EC 0x 20F0 0x 20F4 0x 20F8 0x 20FC 0x 2100 0x 2104 0x 2108 0x 210C 0x 2110 0x 2114 0x 2168 0x 216C 0x 2170 0x 2174 0x 2178 0x 217C 0x 2180 0x 2184 0x 2188 0x 218C 0x 2190 0x 2194 0x 2198 0x 219C 0x 21A0 0x 21A4 0x 21A8 0x 21AC 0x 21B0 0x 21B4 0x 2208 0x 220C 0x 2210 0x 2214 0x 2218 0x 221C 0x 2220 0x 2224 0x 2228 0x 222C 0x 2230 0x 2234 0x 2238 0x 223C 0x 2240 0x 2244 0x 2248 0x 224C 0x 2250 0x 2254 0x 22A8 0x 22AC 0x 22B0 0x 22B4 0x 22B8 0x 22BC 0x 22C0 0x 22C4 0x 22C8 0x 22CC 0x 22D0 0x 22D4 0x 22D8 0x 22DC 0x 22E0 0x 22E4 0x 22E8 0x 22EC 0x 22F0 0x 22F4 0x 2348 0x 234C 0x 2350 0x 2354 0x 2358 0x 235C 0x 2360 0x 2364 0x 2368 0x 236C 0x 2370 0x 2374 0x 2378 0x 237C 0x 2380 0x 2384 0x 2388 0x 238C 0x 2390 0x 2394 0x 23E8 0x 23EC 0x 23F0 0x 23F4 0x 23F8 0x 23FC 0x 1958 0x 324 0x 374 0x 1964 0x 2404 0x 2408 0x 240C 0x 2410 0x 2414 0x 2418 0x 241C 0x 2420 0x 2424 0x 2428 0x 247C 0x 2480 0x 2484 0x 2488 0x 248C 0x 2490 0x 2494 0x 2498 0x 249C 0x 24A0 0x 24A4 0x 24A8 0x 24AC 0x 24B0 0x 24B4 0x 24B8 0x 24BC 0x 24C0 0x 24C4 0x 24C8 0x 251C 0x 2520 0x 2524 0x 2528 0x 252C 0x 2530 0x 2534 0x 2538 0x 253C 0x 2540 0x 2544 0x 2548 0x 254C 0x 2550 0x 2554 0x 2558 0x 255C 0x 2560 0x 2564 0x 2568 0x 25BC 0x 25C0 0x 25C4 0x 25C8 0x 25CC 0x 25D0 0x 25D4 0x 25D8 0x 25DC 0x 25E0 0x 25E4 0x 25E8 0x 25EC 0x 25F0 0x 25F4 0x 25F8 0x 25FC 0x 2600 0x 2604 0x 2608 0x 26A0 0x C58 0x 26A4 0x 26A8 0x 26B8 0x 26BC 0x 26C0 0x 26C4 0x 26C8 0x 26CC 0x 26D4 0x 26D8 0x 26DC 0x 26E0 0x 26E4 0x 26E8 0x 26F4 0x 2700 0x 2708 0x 270C 0x 2710 0x 2714

Memory Dumps

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	Actions
load0.exe	0x00400000	0x00441FFF	Relevant Image	-	32-bit	-	... Region Actions Download Dump
buffer	0x05120000	0x05149FFF	First Execution	-	32-bit	0x0512622F, 0x0512542C	... Region Actions Download Dump
load0.exe	0x00400000	0x00441FFF	Process Termination	-	32-bit	-	... Region Actions Download Dump

Dropped Files

Filename	File Size	Hash Values	YARA Match	Actions
C:\Users\FD1HVy\Desktop\load0.exe	249.50 KB	MD5: a722665c4fc7298f00a31ac652dc02d2 SHA1: 4aec87eb4d697b398b0d602194cdd45cd595e502 SHA256: 9266d4bdcb7351e4c4025371b968e96197628b342e37c3c428787d47217a8896 SSDeep: 3072:Jm7kVpR2W/G4nqjrpThO0L+3vuZGe0Mp6U924SFcszDnVZlIKG0:8AVpznqj9hO0LAdOt/YHz7TG		... File Actions Show Properties Download

Host Behavior

File (1955)

Operation	Filename	Additional Information	Count	Logfile
Create	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	2	Fn
Create	C:\WINDOWS\System32\load0.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Users\FD1HVy\AppData\Roaming\load0.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	2	Fn
Create	C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$WINRE_BACKUP_PARTITION.MARKER	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD.LOG1	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD.LOG2	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bg-BG\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootspaces.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootvhd.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootvhd.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\cs-CZ\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\cs-CZ\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\cs-CZ\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\cs-CZ\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\da-DK\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\da-DK\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\da-DK\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\da-DK\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\de-DE\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\de-DE\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\de-DE\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\de-DE\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\el-GR\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\el-GR\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\el-GR\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\el-GR\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\en-GB\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\en-GB\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\en-US\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\en-US\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\en-US\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\en-US\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\es-ES\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\es-ES\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\es-ES\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\es-ES\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\es-MX\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\es-MX\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\et-EE\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\et-EE\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\fi-FI\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\fi-FI\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\fi-FI\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\fi-FI\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\chs_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\cht_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\jpn_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\kor_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\malgunn_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\malgunn_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\malgun_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\malgun_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\meiryon_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\meiryon_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\meiryo_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\meiryo_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\msjhn_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\msjhn_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\msjh_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\msjh_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\msyhn_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\msyhn_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\msyh_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\msyh_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\segmono_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\segmono_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\segoen_slboot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\segoen_slboot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\segoe_slboot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\segoe_slboot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\wgl4_boot.ttf	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\Fonts\wgl4_boot.ttf	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\fr-CA\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\fr-CA\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\fr-FR\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\fr-FR\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\fr-FR\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\fr-FR\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\hr-HR\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\hr-HR\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\hu-HU\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\hu-HU\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\hu-HU\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\hu-HU\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\it-IT\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\it-IT\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\it-IT\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\it-IT\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bg-BG\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootspaces.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\bootmgr	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD.LOG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\updaterevokesipolicy.p7b	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\updaterevokesipolicy.p7b	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Logs\Windows PowerShell.evtx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\pagefile.sys	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\IPSEventLogMsg.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00448_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\COPYRIGHT.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\accessibility.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\amd64\jvm.cfg.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\calendars.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\classlist.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\cmm\CIEXYZ.pf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\cmm\GRAY.pf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\cmm\LINEAR_RGB.pf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\cmm\PYCC.pf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\cmm\sRGB.pf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\content-types.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\currency.data.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01178_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_de.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_fr.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_it.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ja.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_ko.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00074_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00077_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00086_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00090_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00096_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00296_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00297_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00306_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00336_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00361_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00369_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00382_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00403_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00419_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00428_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00435_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00455_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00459_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00543_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00544_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00564_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00586_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00775_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00779_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00799_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00814_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00965_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01074_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01084_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01176_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01191_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01193_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01196_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01548_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01657_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01658_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00414_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01660_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02068_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02071_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02075_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02088_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02097_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02115_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02116_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02141_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02153_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02158_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02161_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FLAP.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00057_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00084_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00231_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00235_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00236_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00241_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00276_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00334_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00513_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00527_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00546_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00601_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00602_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00612_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00623_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00625_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00636_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00669_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00681_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00685_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00687_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01659_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00693_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01013_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01015_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01058_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01065_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01242_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01291_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01329_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01461_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01618_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01759_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01875_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01923_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02155_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02166_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02282_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02298_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02312_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02313_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00005_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00260_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00114_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00116_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00172_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00426_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00046_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00118_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00177_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00204_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00233_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00343_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00346_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00351_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00557_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00915_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00919_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00956_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00957_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0075478.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0086384.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0086420.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0086424.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0086426.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0086428.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0086432.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0086478.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0089945.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0089992.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0090027.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0090089.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0090149.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0090390.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0090777.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0090779.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0090781.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0090783.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0093905.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0098497.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099145.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099146.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099147.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099148.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099149.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099150.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099151.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099152.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099153.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099154.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099155.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099156.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099157.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099158.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099159.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099160.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099161.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099162.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099163.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099164.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_es.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_pt_BR.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00688_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099166.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099167.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099168.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099169.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099170.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099171.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099172.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099173.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099174.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099175.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099176.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099177.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099178.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099179.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099180.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099181.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099182.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099183.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099184.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099185.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099186.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099187.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0090087.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099189.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099190.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099191.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099192.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099193.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099194.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099195.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099196.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099197.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099198.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099199.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099200.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099201.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099202.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099203.GIF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099204.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099205.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101856.BMP.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101857.BMP.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101858.BMP.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101859.BMP.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101860.BMP.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101861.BMP.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101862.BMP.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101863.BMP.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101864.BMP.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101865.BMP.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101867.BMP.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101980.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0102002.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0102594.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0102762.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0102984.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0103058.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0103262.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0103402.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0103812.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0103850.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105230.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105232.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105234.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105238.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105240.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105244.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105246.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105250.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105266.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105272.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105276.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105280.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105282.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105286.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105288.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099165.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105292.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105294.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105298.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105306.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105320.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105328.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105332.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105336.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105338.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105348.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105360.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105368.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105376.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105378.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105380.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105384.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105386.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105388.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105390.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099188.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105396.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105398.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105410.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105412.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105414.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105490.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105496.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105502.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105504.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105506.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105520.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105526.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105530.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105588.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105600.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105638.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105710.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105846.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105912.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0105974.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106020.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106124.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106146.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106208.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106222.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_HK.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_TW.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\ext\access-bridge-64.jar.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\ext\dnsns.jar.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_sv.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\ext\jaccess.jar.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\ext\meta-index.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\ext\sunec.jar.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\ext\sunjce_provider.jar.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\ext\sunmscapi.jar.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\ext\sunpkcs11.jar.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\ext\zipfs.jar.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\flavormap.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.bfc.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fontconfig.properties.src.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiBold.ttf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightDemiItalic.ttf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightItalic.ttf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaBrightRegular.ttf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansDemiBold.ttf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaSansRegular.ttf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterBold.ttf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\fonts\LucidaTypewriterRegular.ttf.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\hijrah-config-umalqura.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\deploy\messages_zh_CN.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\cursors.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\javafx.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\javaws.jar.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jce.jar.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfr\default.jfc.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfr\profile.jfc.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfr.jar.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jfxswt.jar.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\jsse.jar.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\logging.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.access.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\jmxremote.password.template.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\management.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management\snmp.acl.template.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\management-agent.jar.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\meta-index.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\net.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\psfont.properties.ja.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\psfontj2d.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\blacklist.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\blacklisted.certs.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\cacerts.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101866.BMP.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107024.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107026.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107042.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107090.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107130.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107132.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107134.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107138.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107146.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107148.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107150.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107152.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107154.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107158.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107182.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107188.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107192.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107254.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107258.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107262.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107264.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107266.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107280.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107282.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107288.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\java.security.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\local_policy.jar.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\US_export_policy.jar.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\sound.properties.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\tzmappings.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\LICENSE.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\release.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\java.policy.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106958.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\lib\security\javaws.policy.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106816.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107290.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107300.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107302.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107308.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107314.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107316.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107328.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107342.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107344.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107350.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107358.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107364.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107426.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107446.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107450.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107452.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BABY_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CARBN_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CMNTY_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EAST_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EXPLR_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FALL_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FINCL_02.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRDEN_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\GRID_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HTECH_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\INDST_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JAVA_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\JNGLE_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107456.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\NBOOK_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OUTDR_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PAPER_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_02.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_03.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_04.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\MUSIC_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0106572.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107468.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107480.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107482.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107484.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107488.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107490.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107492.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107494.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107496.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107500.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107502.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107512.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107514.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107516.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107526.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107528.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107544.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107658.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107708.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107712.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107718.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107722.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\OCEAN_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_07.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_08.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_09.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_10.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ROAD_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SAFRI_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SCHOL_02.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SHOW_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SPACE_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SPRNG_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SUMER_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\SWEST_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\URBAN_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\VCTRN_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\WNTER_01.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107730.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107734.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107742.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107744.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107746.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107748.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107750.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0136865.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0144773.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_05.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145168.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145212.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145272.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145361.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145373.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145669.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107728.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145810.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107724.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145895.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145904.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0146142.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148309.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148757.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148798.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0149018.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0149118.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0150150.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0150861.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151041.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151045.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151047.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151055.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151061.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151063.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151067.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151073.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145879.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152414.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152430.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152432.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152436.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152556.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152558.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152560.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152568.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152570.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152590.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152594.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152600.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152602.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Flattener\AppVOpcServices.dll.manifest.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Flattener\AppVPackaging.dll.manifest.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0151581.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152608.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0107458.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Integration\Windows6.1-KB2999226-x64.msu.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\PARNT_06.MID.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145707.JPG.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152610.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152622.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Integration\Windows6.1-KB2999226-x86.msu.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152606.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Integration\Windows8-RT-KB2999226-x64.msu.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Integration\Windows8.1-KB2999226-x86.msu.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152628.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152694.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152696.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152698.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152702.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152704.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152708.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152716.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152722.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152876.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152878.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152882.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152884.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152890.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152892.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152894.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152898.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153047.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153087.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153089.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153091.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153093.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Integration\Windows8-RT-KB2999226-x86.msu.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Integration\Windows8.1-KB2999226-x64.msu.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0152626.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153095.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153273.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153299.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153302.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153305.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153307.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0153313.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Get Info	C:\Program Files\Mozilla Firefox\application.ini	type = size, size_out = 718	1	Fn
Get Info	C:\Program Files\Mozilla Firefox\application.ini	type = file_attributes	1	Fn
Get Info	C:\Program Files\Mozilla Firefox\application.ini.id-B4197730.[bitcharity@protonmail.com].com	type = file_attributes	1	Fn
Move	C:\Program Files\Mozilla Firefox\browser\omni.ja.id-B4197730.[bitcharity@protonmail.com].com	source_filename = C:\Program Files\Mozilla Firefox\browser\omni.ja	1	Fn
Move	C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll.id-B4197730.[bitcharity@protonmail.com].com	source_filename = C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll	1	Fn
Move	C:\Program Files\Mozilla Firefox\libGLESv2.dll.id-B4197730.[bitcharity@protonmail.com].com	source_filename = C:\Program Files\Mozilla Firefox\libGLESv2.dll	1	Fn
Move	C:\Program Files\Mozilla Firefox\omni.ja.id-B4197730.[bitcharity@protonmail.com].com	source_filename = C:\Program Files\Mozilla Firefox\omni.ja	1	Fn
Move	C:\Program Files\Mozilla Firefox\xul.dll.id-B4197730.[bitcharity@protonmail.com].com	source_filename = C:\Program Files\Mozilla Firefox\xul.dll	1	Fn
For performance reasons, the remaining 953 entries are omitted. The remaining entries can be found in glog.xml.

Registry (10)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	-	2	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Startup, data = 83, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ	1	Fn
Write Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	value_name = load0.exe, data = 6998912, size = 82, type = REG_SZ	1	Fn
Write Value	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run	value_name = load0.exe, data = C:\Users\FD1HVy\AppData\Roaming\load0.exe, size = 82, type = REG_SZ	1	Fn

Process (1868)

Operation	Process	Additional Information	Count	Logfile
Create	C:\WINDOWS\system32\cmd.exe	os_pid = 0x2698, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE	1	Fn
Create	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe	show_window = SW_SHOWNORMAL	1	Fn
Create	C:\WINDOWS\system32\cmd.exe	os_pid = 0x27b0, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE	1	Fn
Enumerate Processes	-	-	1822	Fn
Enumerate Processes	-	-	43	Fn

Module (175)

Operation	Module	Additional Information	Count	Logfile
Load	KERNEL32.dll	base_address = 0x75420000	1	Fn
Load	kernel32.dll	base_address = 0x75420000	1	Fn
Load	advapi32.dll	base_address = 0x77a40000	1	Fn
Load	user32.dll	base_address = 0x752e0000	1	Fn
Load	Shell32.dll	base_address = 0x76060000	1	Fn
Load	ntdll.dll	base_address = 0x77da0000	1	Fn
Load	mpr.dll	base_address = 0x74600000	1	Fn
Load	ws2_32.dll	base_address = 0x75d40000	1	Fn
Get Handle	c:\programdata\microsoft\windows\start menu\programs\startup\load0.exe	base_address = 0x400000	1	Fn
Get Handle	c:\windows\syswow64\kernel32.dll	base_address = 0x75420000	30	Fn
Get Filename	-	process_name = c:\programdata\microsoft\windows\start menu\programs\startup\load0.exe, file_name_orig = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe, size = 32767	4	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetProcAddress, address_out = 0x754351b0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = LoadLibraryA, address_out = 0x75435a80	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WaitForSingleObject, address_out = 0x7548eca0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = InitializeCriticalSectionAndSpinCount, address_out = 0x7548ebb0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = LeaveCriticalSection, address_out = 0x77deb250	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetLastError, address_out = 0x75435010	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = EnterCriticalSection, address_out = 0x77deb2d0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ReleaseMutex, address_out = 0x7548ec20	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CloseHandle, address_out = 0x7548eab0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetModuleHandleW, address_out = 0x754350d0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindNextFileW, address_out = 0x7548ee40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindClose, address_out = 0x7548ed70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = MoveFileW, address_out = 0x7546e500	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetFileSizeEx, address_out = 0x7548ef40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetModuleFileNameW, address_out = 0x75435090	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetFileAttributesW, address_out = 0x7548ef10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ExitProcess, address_out = 0x75433cb0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCommandLineW, address_out = 0x75434cc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetComputerNameW, address_out = 0x754632c0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetComputerNameA, address_out = 0x75463780	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateMutexW, address_out = 0x7548eb70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrlenW, address_out = 0x75436c70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrlenA, address_out = 0x75436c50	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCurrentProcess, address_out = 0x7548ea10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetLogicalDrives, address_out = 0x75430d20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetTickCount, address_out = 0x7548dd50	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = DeleteFileW, address_out = 0x7548ed40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WideCharToMultiByte, address_out = 0x75436b10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Sleep, address_out = 0x75436760	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ReadFile, address_out = 0x7548f090	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateFileW, address_out = 0x7548ed10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = OpenMutexW, address_out = 0x7548ebf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WaitForMultipleObjects, address_out = 0x7548ec80	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrcmpiW, address_out = 0x75436bf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrcmpiA, address_out = 0x75436bd0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = DeleteCriticalSection, address_out = 0x77dcfb90	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetVersion, address_out = 0x754356c0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateThread, address_out = 0x754346b0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ExpandEnvironmentStringsW, address_out = 0x75434a40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = QueryPerformanceCounter, address_out = 0x75435da0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = QueryPerformanceFrequency, address_out = 0x75435dc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCurrentProcessId, address_out = 0x7548ea20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetFileAttributesW, address_out = 0x7548f100	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetVolumeInformationW, address_out = 0x7548f020	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WriteFile, address_out = 0x7548f180	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetFilePointerEx, address_out = 0x7548f130	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetEndOfFile, address_out = 0x7548f0e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindFirstFileW, address_out = 0x7548edf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetProcessHeap, address_out = 0x754351f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapReAlloc, address_out = 0x77ddf630	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapAlloc, address_out = 0x77de2dc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapFree, address_out = 0x754357f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreatePipe, address_out = 0x75434590	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetHandleInformation, address_out = 0x7548eae0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateProcessW, address_out = 0x75434610	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CompareStringW, address_out = 0x75434430	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CompareStringA, address_out = 0x75434410	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = OpenProcess, address_out = 0x75435cc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = TerminateProcess, address_out = 0x754367e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetSystemTime, address_out = 0x754354e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SystemTimeToFileTime, address_out = 0x754367a0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateToolhelp32Snapshot, address_out = 0x7546edc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Process32NextW, address_out = 0x7546f8f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Process32FirstW, address_out = 0x7546f750	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegOpenKeyExW, address_out = 0x77a5e580	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegQueryValueExW, address_out = 0x77a5e5a0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegSetValueExW, address_out = 0x77a5f530	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegCloseKey, address_out = 0x77a5ed60	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenProcessToken, address_out = 0x77a5efb0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = GetTokenInformation, address_out = 0x77a5ee90	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenSCManagerW, address_out = 0x77a60540	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenServiceW, address_out = 0x77a5fa20	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = CloseServiceHandle, address_out = 0x77a5fc00	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = ControlService, address_out = 0x77a726d0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = QueryServiceStatus, address_out = 0x77a62380	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = EnumDependentServicesW, address_out = 0x77a72f70	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = EnumServicesStatusExW, address_out = 0x77a5fc80	1	Fn
Get Address	c:\windows\syswow64\user32.dll	function = SystemParametersInfoW, address_out = 0x7530f210	1	Fn
Get Address	c:\windows\syswow64\shell32.dll	function = ShellExecuteExW, address_out = 0x761c4730	1	Fn
Get Address	c:\windows\syswow64\ntdll.dll	function = NtQuerySystemInformation, address_out = 0x77e12070	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetCloseEnum, address_out = 0x74602640	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetOpenEnumW, address_out = 0x74602790	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetEnumResourceW, address_out = 0x74602410	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = WSAStartup, address_out = 0x75d45b40	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = socket, address_out = 0x75d54510	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = send, address_out = 0x75d45030	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = recv, address_out = 0x75d50c50	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = connect, address_out = 0x75d45410	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = closesocket, address_out = 0x75d50910	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = gethostbyname, address_out = 0x75d76cb0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = inet_addr, address_out = 0x75d59160	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = ntohl, address_out = 0x75d449d0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = htonl, address_out = 0x75d449d0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = htons, address_out = 0x75d58ff0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Wow64DisableWow64FsRedirection, address_out = 0x75436b30	30	Fn

Service (129)

Operation	Additional Information	Count	Logfile
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	4	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	4	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	7	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	7	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	5	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	5	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	5	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	5	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	4	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	4	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	4	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	7	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	5	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	5	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	4	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	2	Fn

System (1445)

Operation	Additional Information	Count	Logfile
Get Computer Name	result_out = NQDPDE	1	Fn
Sleep	duration = 0 milliseconds (0.000 seconds)	840	Fn
Sleep	duration = -1 (infinite)	3	Fn
Sleep	duration = 500 milliseconds (0.500 seconds)	68	Fn
Sleep	duration = 100 milliseconds (0.100 seconds)	150	Fn
Get Time	type = Performance Ctr, time = 8178113909	1	Fn
Get Time	type = Ticks, time = 81750	3	Fn
Get Time	type = Ticks, time = 82625	1	Fn
Get Time	type = Ticks, time = 82906	1	Fn
Get Time	type = Ticks, time = 83062	1	Fn
Get Time	type = Ticks, time = 83390	2	Fn
Get Time	type = Ticks, time = 83593	2	Fn
Get Time	type = Ticks, time = 83921	1	Fn
Get Time	type = Ticks, time = 84015	2	Fn
Get Time	type = Ticks, time = 84421	3	Fn
Get Time	type = Ticks, time = 84703	2	Fn
Get Time	type = Ticks, time = 85031	3	Fn
Get Time	type = Ticks, time = 85453	3	Fn
Get Time	type = Ticks, time = 85703	2	Fn
Get Time	type = Ticks, time = 85968	2	Fn
Get Time	type = Ticks, time = 86546	4	Fn
Get Time	type = Ticks, time = 87000	2	Fn
Get Time	type = Ticks, time = 87375	2	Fn
Get Time	type = Ticks, time = 87671	4	Fn
Get Time	type = Ticks, time = 88125	2	Fn
Get Time	type = Ticks, time = 88468	2	Fn
Get Time	type = Ticks, time = 88671	2	Fn
Get Time	type = Ticks, time = 89125	4	Fn
Get Time	type = Ticks, time = 89500	2	Fn
Get Time	type = Ticks, time = 89750	2	Fn
Get Time	type = Ticks, time = 90062	2	Fn
Get Time	type = Ticks, time = 90296	4	Fn
Get Time	type = Ticks, time = 90500	2	Fn
Get Time	type = Ticks, time = 90671	2	Fn
Get Time	type = Ticks, time = 90890	2	Fn
Get Time	type = Ticks, time = 91171	2	Fn
Get Time	type = Ticks, time = 91453	4	Fn
Get Time	type = Ticks, time = 91593	2	Fn
Get Time	type = Ticks, time = 91718	2	Fn
Get Time	type = Ticks, time = 91859	2	Fn
Get Time	type = Ticks, time = 92031	2	Fn
Get Time	type = Ticks, time = 92156	2	Fn
Get Time	type = Ticks, time = 92281	2	Fn
Get Time	type = Ticks, time = 92515	4	Fn
Get Time	type = Ticks, time = 92937	2	Fn
Get Time	type = Ticks, time = 93359	2	Fn
Get Time	type = Ticks, time = 93796	4	Fn
Get Time	type = Ticks, time = 94140	2	Fn
Get Time	type = Ticks, time = 94296	2	Fn
Get Time	type = Ticks, time = 94531	2	Fn
Get Time	type = Ticks, time = 94968	4	Fn
Get Time	type = Ticks, time = 95390	2	Fn
Get Time	type = Ticks, time = 95781	2	Fn
Get Time	type = Ticks, time = 96093	4	Fn
Get Time	type = Ticks, time = 96437	2	Fn
Get Time	type = Ticks, time = 97203	4	Fn
Get Time	type = Ticks, time = 97750	2	Fn
Get Time	type = Ticks, time = 98421	4	Fn
Get Time	type = Ticks, time = 98765	2	Fn
Get Time	type = Ticks, time = 99328	2	Fn
Get Time	type = Ticks, time = 99953	4	Fn
Get Time	type = Ticks, time = 100078	2	Fn
Get Time	type = Ticks, time = 100312	2	Fn
Get Time	type = Ticks, time = 100468	2	Fn
Get Time	type = Ticks, time = 100812	2	Fn
Get Time	type = Ticks, time = 100953	2	Fn
Get Time	type = Ticks, time = 101109	2	Fn
Get Time	type = Ticks, time = 101125	2	Fn
Get Time	type = Ticks, time = 101234	2	Fn
Get Time	type = Ticks, time = 101468	2	Fn
Get Time	type = Ticks, time = 102187	4	Fn
Get Time	type = Ticks, time = 103093	2	Fn
Get Time	type = Ticks, time = 103218	4	Fn
Get Time	type = Ticks, time = 103390	2	Fn
Get Time	type = Ticks, time = 103718	2	Fn
Get Time	type = Ticks, time = 104140	2	Fn
Get Time	type = Ticks, time = 104656	4	Fn
Get Time	type = Ticks, time = 105125	2	Fn
Get Time	type = Ticks, time = 105390	2	Fn
Get Time	type = Ticks, time = 105562	2	Fn
Get Time	type = Ticks, time = 105921	4	Fn
Get Time	type = Ticks, time = 106187	2	Fn
Get Time	type = Ticks, time = 106437	2	Fn
Get Time	type = Ticks, time = 106546	2	Fn
Get Time	type = Ticks, time = 106765	2	Fn
Get Time	type = Ticks, time = 107000	4	Fn
Get Time	type = Ticks, time = 107390	2	Fn
Get Time	type = Ticks, time = 107562	2	Fn
Get Time	type = Ticks, time = 107890	2	Fn
Get Time	type = Ticks, time = 108000	2	Fn
Get Time	type = Ticks, time = 108125	4	Fn
Get Time	type = Ticks, time = 108312	2	Fn
Get Time	type = Ticks, time = 108531	2	Fn
Get Time	type = Ticks, time = 108921	2	Fn
Get Time	type = Ticks, time = 109609	4	Fn
Get Time	type = Ticks, time = 109765	2	Fn
Get Time	type = Ticks, time = 110046	2	Fn
Get Time	type = Ticks, time = 110234	2	Fn
Get Time	type = Ticks, time = 110406	2	Fn
Get Time	type = Ticks, time = 110609	2	Fn
Get Time	type = Ticks, time = 110812	4	Fn
Get Time	type = Ticks, time = 111078	2	Fn
Get Time	type = Ticks, time = 111390	2	Fn
Get Time	type = Ticks, time = 111625	2	Fn
Get Time	type = Ticks, time = 111781	2	Fn
Get Time	type = Ticks, time = 111921	4	Fn
Get Time	type = Ticks, time = 112062	2	Fn
Get Time	type = Ticks, time = 112343	2	Fn
Get Time	type = Ticks, time = 112531	2	Fn
Get Time	type = Ticks, time = 112734	2	Fn
Get Time	type = Ticks, time = 113000	4	Fn
Get Time	type = Ticks, time = 113234	2	Fn
Get Time	type = Ticks, time = 113453	2	Fn
Get Time	type = Ticks, time = 113796	2	Fn
Get Time	type = Ticks, time = 114000	2	Fn
Get Time	type = Ticks, time = 114250	4	Fn
Get Time	type = Ticks, time = 114562	2	Fn
Get Time	type = Ticks, time = 114890	2	Fn
Get Time	type = Ticks, time = 115046	2	Fn
Get Time	type = Ticks, time = 115234	2	Fn
Get Time	type = Ticks, time = 115421	4	Fn
Get Time	type = Ticks, time = 115703	2	Fn
Get Time	type = Ticks, time = 116140	2	Fn
Get Time	type = Ticks, time = 116640	4	Fn
Get Time	type = Ticks, time = 116906	2	Fn
Get Time	type = Ticks, time = 117109	2	Fn
Get Time	type = Ticks, time = 117281	2	Fn
Get Time	type = Ticks, time = 117421	2	Fn
Get Time	type = Ticks, time = 117671	4	Fn
Get Time	type = Ticks, time = 117828	2	Fn
Get Time	type = Ticks, time = 118062	2	Fn
Get Time	type = Ticks, time = 118250	2	Fn
Get Time	type = Ticks, time = 118468	2	Fn
Get Time	type = Ticks, time = 118625	2	Fn
Get Time	type = Ticks, time = 118812	4	Fn
Get Time	type = Ticks, time = 119031	2	Fn
Get Time	type = Ticks, time = 119171	2	Fn
Get Time	type = Ticks, time = 119312	2	Fn
Get Time	type = Ticks, time = 119875	4	Fn
Get Time	type = Ticks, time = 120203	2	Fn
Get Time	type = Ticks, time = 120937	4	Fn
Get Time	type = Ticks, time = 121265	2	Fn
Get Time	type = Ticks, time = 121656	2	Fn
Get Time	type = Ticks, time = 121953	4	Fn
Get Time	type = Ticks, time = 122359	2	Fn
Get Time	type = Ticks, time = 122750	2	Fn
Get Time	type = Ticks, time = 123156	4	Fn
Get Time	type = Ticks, time = 123500	2	Fn
Get Time	type = Ticks, time = 123984	2	Fn
Get Time	type = Ticks, time = 124390	4	Fn
Get Time	type = Ticks, time = 124687	2	Fn
Get Time	type = Ticks, time = 124890	2	Fn
Get Time	type = Ticks, time = 125031	2	Fn
Get Time	type = Ticks, time = 125281	2	Fn
Get Time	type = Ticks, time = 125453	4	Fn
Get Time	type = Ticks, time = 125703	2	Fn
Get Time	type = Ticks, time = 125906	2	Fn
Get Time	type = Ticks, time = 126046	2	Fn
Get Time	type = Ticks, time = 126359	2	Fn
Get Time	type = Ticks, time = 126765	4	Fn
Get Time	type = Ticks, time = 127125	2	Fn
Get Time	type = Ticks, time = 127281	2	Fn
Get Info	type = Operating System	2	Fn

Mutex (30)

Operation	Additional Information	Count	Logfile
Create	mutex_name = Global\syncronize_Q25317A	1	Fn
Create	mutex_name = Global\syncronize_Q25317U	1	Fn
Open	mutex_name = Global\syncronize_Q25317A, desired_access = SYNCHRONIZE	1	Fn
Open	mutex_name = Global\syncronize_Q25317U, desired_access = SYNCHRONIZE	1	Fn
Release	mutex_name = Global\syncronize_Q25317A	26	Fn

Process #8: load0.exe

3924

Information	Value
ID	#8
File Name	c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\load0.exe
Command Line	"C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:03:41, Reason: Autostart
Unmonitor	End Time: 00:04:01, Reason: Self Terminated
Monitor Duration	00:00:20

OS Process Information

Information	Value
PID	0xdbc
Parent PID	0x9c8 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x DC0 0x DEC 0x E48 0x E4C 0x E50 0x E54 0x E58 0x E5C 0x E60 0x E64 0x E68 0x E6C 0x E70 0x E74 0x E78 0x ECC 0x ED0 0x ED4 0x ED8 0x EDC 0x EE0 0x EE4 0x F38 0x F3C 0x F40 0x F44 0x F48 0x F4C 0x F50 0x F54 0x F58 0x F5C 0x F60 0x F64 0x F68 0x F6C 0x F70 0x F74 0x F78 0x F7C 0x F80 0x F84 0x FD8 0x FDC 0x FE0 0x FE4 0x FE8 0x FEC 0x FF0 0x FF4 0x FF8 0x FFC 0x BE0 0x C28 0x B74 0x C64 0x 8CC 0x C8C 0x 390 0x C90 0x C94 0x C98 0x 378 0x 5BC 0x CBC 0x 47C 0x 36C 0x CC0 0x CD4 0x CD8 0x CDC 0x D14 0x D18 0x D1C 0x 868 0x 940 0x 928 0x B80 0x 8F4 0x B78 0x B7C 0x CE8 0x D20 0x D7C 0x B54 0x 8C0 0x CC8 0x D24 0x 8BC 0x 84C 0x D04 0x C9C 0x DD8 0x BF0 0x BC8 0x AF0 0x 5F0 0x 854 0x BF4 0x 758 0x 838 0x BC0 0x 1024 0x 1028 0x 102C 0x 1030 0x 1034 0x 1038 0x 103C 0x 1040 0x 1044 0x 1048 0x 104C 0x 1050 0x 1054 0x 1058 0x 105C 0x 1060 0x 1064 0x 1068 0x 106C 0x 1070 0x 10C4 0x 10C8 0x 10CC 0x 10D0 0x 10D4 0x 10D8 0x 10DC 0x 10E0 0x 10E4 0x 10E8 0x 10EC 0x 10F0 0x 10F4 0x 10F8 0x 10FC 0x 1100 0x 1104 0x 1108 0x 110C 0x 1110 0x 1164 0x 1168 0x 116C 0x 1170 0x 1174 0x 1178 0x 117C 0x 1180 0x 1184 0x 1188 0x 118C 0x 1190 0x 1194 0x 1198 0x 119C 0x 11A0 0x 11A4 0x 11A8 0x 11AC 0x 11B0 0x 1204 0x 1208 0x 120C 0x 1210 0x 1214 0x 1218 0x 121C 0x 1220 0x 1224 0x 1228 0x 122C 0x 1230 0x 1234 0x 1238 0x 123C 0x 1240 0x 1244 0x 1248 0x 124C 0x 1250 0x 12A4 0x 12A8 0x 12AC 0x 12B0 0x 12B4 0x 12B8 0x 12BC 0x 12C0 0x 12C4 0x 12C8 0x 12CC 0x 12D0 0x 12D4 0x 12D8 0x 12DC 0x 12E0 0x 12E4 0x 12E8 0x 12EC 0x 12F0 0x 1344 0x 1348 0x 134C 0x 1350 0x 1354 0x 1358 0x 135C 0x 1360 0x 1364 0x 1368 0x 136C 0x 1370 0x 1374 0x 1378 0x 137C 0x 1380 0x 1384 0x 1388 0x 138C 0x 1390 0x 13E4 0x 13E8 0x 13EC 0x 13F0 0x 13F4 0x 13F8 0x 13FC 0x A50 0x A48 0x A4C 0x A5C 0x DA4 0x DA0 0x 1404 0x 1408 0x 140C 0x 1410 0x 1414 0x 1418 0x 141C 0x 1470 0x 1474 0x 1478 0x 147C 0x 1480 0x 1484 0x 1488 0x 148C 0x 1490 0x 1494 0x 1498 0x 149C 0x 14A0 0x 14A4 0x 14A8 0x 14AC 0x 14B0 0x 14B4 0x 14B8 0x 14BC 0x 1510 0x 1514 0x 1518 0x 151C 0x 1520 0x 1524 0x 1528 0x 152C 0x 1530 0x 1534 0x 1538 0x 153C 0x 1540 0x 1544 0x 1548 0x 154C 0x 1550 0x 1554 0x 1558 0x 155C 0x 15B0 0x 15B4 0x 15B8 0x 15BC 0x 15C0 0x 15C4 0x 15C8 0x 15CC 0x 15D0 0x 15D4 0x 15D8 0x 15DC 0x 15E0 0x 15E4 0x 15E8 0x 15EC 0x 15F0 0x 15F4 0x 15F8 0x 15FC 0x 1650 0x 1654 0x 1658 0x 165C 0x 1660 0x 1664 0x 1668 0x 166C 0x 1670 0x 1674 0x 1678 0x 167C 0x 1680 0x 1684 0x 1688 0x 168C 0x 1690 0x 1694 0x 1698 0x 169C 0x 16F4 0x 16F8 0x 16FC 0x 1700 0x 1704 0x 1708 0x 170C 0x 1710 0x 1714 0x 1718 0x 171C 0x 1720 0x 1724 0x 1728 0x 172C 0x 1730 0x 1734 0x 1738 0x 173C 0x 1740 0x 1794 0x 1798 0x 179C 0x 17A0 0x 17A4 0x 17A8 0x 17AC 0x 17B0 0x 17B4 0x 17B8 0x 17BC 0x 17C0 0x 17C4 0x 17C8 0x 17CC 0x 17D0 0x 17D4 0x 17D8 0x 17DC 0x 17E0 0x 1818 0x 181C 0x 1820 0x 1824 0x 1828 0x 182C 0x 1830 0x 1834 0x 1838 0x 183C 0x 1840 0x 1844 0x 1848 0x 184C 0x 1850 0x 1854 0x 1858 0x 185C 0x 1860 0x 1864 0x 18B8 0x 18BC 0x 18C0 0x 18C4 0x 18C8 0x 18CC 0x 18D0 0x 18D4 0x 18D8 0x 18DC 0x 18E0 0x 18E4 0x 18E8 0x 18EC 0x 18F0 0x 18F4 0x 18F8 0x 18FC 0x 1900 0x 1904 0x 1908 0x 190C 0x 1910 0x 1914 0x 1918 0x 191C 0x 1920 0x 1924 0x 1928 0x 192C 0x 1930 0x 1934 0x 1938 0x 193C 0x 1940 0x 1944 0x 1948 0x 194C 0x 1950 0x 1954 0x 19B8 0x 19BC 0x 19C0 0x 19C4 0x 19C8 0x 19CC 0x 19D0 0x 19D4 0x 19D8 0x 19DC 0x 19E0 0x 19E4 0x 19E8 0x 19EC 0x 19F0 0x 19F4 0x 19F8 0x 19FC 0x 1A00 0x 1A04 0x 1A58 0x 1A5C 0x 1A60 0x 1A64 0x 1A68 0x 1A6C 0x 1A70 0x 1A74 0x 1A78 0x 1A7C 0x 1A80 0x 1A84 0x 1A88 0x 1A8C 0x 1A90 0x 1A94 0x 1A98 0x 1A9C 0x 1AA0 0x 1AA4 0x 1AF8 0x 1AFC 0x 1B00 0x 1B04 0x 1B08 0x 1B0C 0x 1B10 0x 1B14 0x 1B18 0x 1B1C 0x 1B20 0x 1B24 0x 1B28 0x 1B2C 0x 1B30 0x 1B34 0x 1B38 0x 1B3C 0x 1B40 0x 1B44 0x 1B98 0x 1B9C 0x 1BA0 0x 1BA4 0x 1BA8 0x 1BAC 0x 1BB0 0x 1BB4 0x 1BB8 0x 1BBC 0x 1BC0 0x 1BC4 0x 1BC8 0x 1BCC 0x 1BD0 0x 1BD4 0x 1BD8 0x 1BDC 0x 1BE0 0x 1BE4 0x 1C18 0x 1C1C 0x 1C20 0x 1C24 0x 1C28 0x 1C2C 0x 1C30 0x 1C34 0x 1C38 0x 1C3C 0x 1C40 0x 1C44 0x 1C48 0x 1C4C 0x 1C50 0x 1C54 0x 1C58 0x 1C5C 0x 1C60 0x 1C64 0x 1CB8 0x 1CBC 0x 1CC0 0x 1CC4 0x 1CC8 0x 1CCC 0x 1CD0 0x 1CD4 0x 1CD8 0x 1CDC 0x 1CE0 0x 1CE4 0x 1CE8 0x 1CEC 0x 1CF0 0x 1CF4 0x 1CF8 0x 1CFC 0x 1D00 0x 1D04 0x 1D58 0x 1D5C 0x 1D60 0x 1D64 0x 1D68 0x 1D6C 0x 1D70 0x 1D74 0x 1D78 0x 1D7C 0x 1D80 0x 1D84 0x 1D88 0x 1D8C 0x 1D90 0x 1D94 0x 1D98 0x 1D9C 0x 1DA0 0x 1DA4 0x 1DF8 0x 1DFC 0x 1E00 0x 1E04 0x 1E08 0x 1E0C 0x 1E10 0x 1E14 0x 1E18 0x 1E1C 0x 1E20 0x 1E24 0x 1E28 0x 1E2C 0x 1E30 0x 1E34 0x 1E38 0x 1E3C 0x 1E40 0x 1E44 0x 1E98 0x 1E9C 0x 1EA0 0x 1EA4 0x 1EA8 0x 1EAC 0x 1EB0 0x 1EB4 0x 1EB8 0x 1EBC 0x 1EC0 0x 1EC4 0x 1EC8 0x 1ECC 0x 1ED0 0x 1ED4 0x 1ED8 0x 1EDC 0x 1EE0 0x 1EE4 0x 1F38 0x 1F3C 0x 1F40 0x 1F44 0x 1F48 0x 1F4C 0x 1F50 0x 1F54 0x 1F58 0x 1F5C 0x 1F60 0x 1F64 0x 1F68 0x 1F6C 0x 1F70 0x 1F74 0x 1F78 0x 1F7C 0x 1F80 0x 1F84 0x 1FD8 0x 1FDC 0x 1FE0 0x 1FE4 0x 1FE8 0x 1FEC 0x 1FF0 0x 1FF4 0x 1FF8 0x 1FFC 0x 2E0 0x 2004 0x 2008 0x 200C 0x 2010 0x 2014 0x 2018 0x 201C 0x 2020 0x 2024 0x 2078 0x 207C 0x 2080 0x 2084 0x 2088 0x 208C 0x 2090 0x 2094 0x 2098 0x 209C 0x 20A0 0x 20A4 0x 20A8 0x 20AC 0x 20B0 0x 20B4 0x 20B8 0x 20BC 0x 20C0 0x 20C4 0x 2118 0x 211C 0x 2120 0x 2124 0x 2128 0x 212C 0x 2130 0x 2134 0x 2138 0x 213C 0x 2140 0x 2144 0x 2148 0x 214C 0x 2150 0x 2154 0x 2158 0x 215C 0x 2160 0x 2164 0x 21B8 0x 21BC 0x 21C0 0x 21C4 0x 21C8 0x 21CC 0x 21D0 0x 21D4 0x 21D8 0x 21DC 0x 21E0 0x 21E4 0x 21E8 0x 21EC 0x 21F0 0x 21F4 0x 21F8 0x 21FC 0x 2200 0x 2204 0x 2258 0x 225C 0x 2260 0x 2264 0x 2268 0x 226C 0x 2270 0x 2274 0x 2278 0x 227C 0x 2280 0x 2284 0x 2288 0x 228C 0x 2290 0x 2294 0x 2298 0x 229C 0x 22A0 0x 22A4 0x 22F8 0x 22FC 0x 2300 0x 2304 0x 2308 0x 230C 0x 2310 0x 2314 0x 2318 0x 231C 0x 2320 0x 2324 0x 2328 0x 232C 0x 2330 0x 2334 0x 2338 0x 233C 0x 2340 0x 2344 0x 2398 0x 239C 0x 23A0 0x 23A4 0x 23A8 0x 23AC 0x 23B0 0x 23B4 0x 23B8 0x 23BC 0x 23C0 0x 23C4 0x 23C8 0x 23CC 0x 23D0 0x 23D4 0x 23D8 0x 23DC 0x 23E0 0x 23E4 0x 242C 0x 2430 0x 2434 0x 2438 0x 243C 0x 2440 0x 2444 0x 2448 0x 244C 0x 2450 0x 2454 0x 2458 0x 245C 0x 2460 0x 2464 0x 2468 0x 246C 0x 2470 0x 2474 0x 2478 0x 24CC 0x 24D0 0x 24D4 0x 24D8 0x 24DC 0x 24E0 0x 24E4 0x 24E8 0x 24EC 0x 24F0 0x 24F4 0x 24F8 0x 24FC 0x 2500 0x 2504 0x 2508 0x 250C 0x 2510 0x 2514 0x 2518 0x 256C 0x 2570 0x 2574 0x 2578 0x 257C 0x 2580 0x 2584 0x 2588 0x 258C 0x 2590 0x 2594 0x 2598 0x 259C 0x 25A0 0x 25A4 0x 25A8 0x 25AC 0x 25B0 0x 25B4 0x 25B8 0x 260C 0x 2610 0x 2614 0x 2618 0x 261C 0x 2620 0x 2624 0x 2628 0x 262C 0x 2630 0x 2634 0x 2638 0x 263C 0x 2640 0x 2644 0x 2648 0x 264C 0x 2650 0x 2654 0x 2658

Memory Dumps

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
buffer	0x05140000	0x05169FFF	First Execution	-	32-bit	0x0514622F, 0x0514542C			... Region Actions Download Dump
load0.exe	0x00400000	0x00441FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Host Behavior

Module (111)

Operation	Module	Additional Information	Count	Logfile
Load	KERNEL32.dll	base_address = 0x75420000	1	Fn
Load	kernel32.dll	base_address = 0x75420000	1	Fn
Load	advapi32.dll	base_address = 0x77a40000	1	Fn
Load	user32.dll	base_address = 0x752e0000	1	Fn
Load	Shell32.dll	base_address = 0x76060000	1	Fn
Load	ntdll.dll	base_address = 0x77da0000	1	Fn
Load	mpr.dll	base_address = 0x74600000	1	Fn
Load	ws2_32.dll	base_address = 0x75d40000	1	Fn
Get Handle	c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\load0.exe	base_address = 0x400000	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetProcAddress, address_out = 0x754351b0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = LoadLibraryA, address_out = 0x75435a80	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WaitForSingleObject, address_out = 0x7548eca0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = InitializeCriticalSectionAndSpinCount, address_out = 0x7548ebb0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = LeaveCriticalSection, address_out = 0x77deb250	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetLastError, address_out = 0x75435010	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = EnterCriticalSection, address_out = 0x77deb2d0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ReleaseMutex, address_out = 0x7548ec20	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CloseHandle, address_out = 0x7548eab0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetModuleHandleW, address_out = 0x754350d0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindNextFileW, address_out = 0x7548ee40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindClose, address_out = 0x7548ed70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = MoveFileW, address_out = 0x7546e500	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetFileSizeEx, address_out = 0x7548ef40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetModuleFileNameW, address_out = 0x75435090	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetFileAttributesW, address_out = 0x7548ef10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ExitProcess, address_out = 0x75433cb0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCommandLineW, address_out = 0x75434cc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetComputerNameW, address_out = 0x754632c0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetComputerNameA, address_out = 0x75463780	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateMutexW, address_out = 0x7548eb70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrlenW, address_out = 0x75436c70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrlenA, address_out = 0x75436c50	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCurrentProcess, address_out = 0x7548ea10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetLogicalDrives, address_out = 0x75430d20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetTickCount, address_out = 0x7548dd50	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = DeleteFileW, address_out = 0x7548ed40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WideCharToMultiByte, address_out = 0x75436b10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Sleep, address_out = 0x75436760	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ReadFile, address_out = 0x7548f090	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateFileW, address_out = 0x7548ed10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = OpenMutexW, address_out = 0x7548ebf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WaitForMultipleObjects, address_out = 0x7548ec80	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrcmpiW, address_out = 0x75436bf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrcmpiA, address_out = 0x75436bd0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = DeleteCriticalSection, address_out = 0x77dcfb90	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetVersion, address_out = 0x754356c0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateThread, address_out = 0x754346b0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ExpandEnvironmentStringsW, address_out = 0x75434a40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = QueryPerformanceCounter, address_out = 0x75435da0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = QueryPerformanceFrequency, address_out = 0x75435dc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCurrentProcessId, address_out = 0x7548ea20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetFileAttributesW, address_out = 0x7548f100	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetVolumeInformationW, address_out = 0x7548f020	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WriteFile, address_out = 0x7548f180	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetFilePointerEx, address_out = 0x7548f130	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetEndOfFile, address_out = 0x7548f0e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindFirstFileW, address_out = 0x7548edf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetProcessHeap, address_out = 0x754351f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapReAlloc, address_out = 0x77ddf630	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapAlloc, address_out = 0x77de2dc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapFree, address_out = 0x754357f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreatePipe, address_out = 0x75434590	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetHandleInformation, address_out = 0x7548eae0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateProcessW, address_out = 0x75434610	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CompareStringW, address_out = 0x75434430	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CompareStringA, address_out = 0x75434410	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = OpenProcess, address_out = 0x75435cc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = TerminateProcess, address_out = 0x754367e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetSystemTime, address_out = 0x754354e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SystemTimeToFileTime, address_out = 0x754367a0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateToolhelp32Snapshot, address_out = 0x7546edc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Process32NextW, address_out = 0x7546f8f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Process32FirstW, address_out = 0x7546f750	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegOpenKeyExW, address_out = 0x77a5e580	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegQueryValueExW, address_out = 0x77a5e5a0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegSetValueExW, address_out = 0x77a5f530	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegCloseKey, address_out = 0x77a5ed60	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenProcessToken, address_out = 0x77a5efb0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = GetTokenInformation, address_out = 0x77a5ee90	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenSCManagerW, address_out = 0x77a60540	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenServiceW, address_out = 0x77a5fa20	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = CloseServiceHandle, address_out = 0x77a5fc00	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = ControlService, address_out = 0x77a726d0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = QueryServiceStatus, address_out = 0x77a62380	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = EnumDependentServicesW, address_out = 0x77a72f70	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = EnumServicesStatusExW, address_out = 0x77a5fc80	1	Fn
Get Address	c:\windows\syswow64\user32.dll	function = SystemParametersInfoW, address_out = 0x7530f210	1	Fn
Get Address	c:\windows\syswow64\shell32.dll	function = ShellExecuteExW, address_out = 0x761c4730	1	Fn
Get Address	c:\windows\syswow64\ntdll.dll	function = NtQuerySystemInformation, address_out = 0x77e12070	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetCloseEnum, address_out = 0x74602640	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetOpenEnumW, address_out = 0x74602790	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetEnumResourceW, address_out = 0x74602410	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = WSAStartup, address_out = 0x75d45b40	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = socket, address_out = 0x75d54510	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = send, address_out = 0x75d45030	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = recv, address_out = 0x75d50c50	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = connect, address_out = 0x75d45410	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = closesocket, address_out = 0x75d50910	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = gethostbyname, address_out = 0x75d76cb0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = inet_addr, address_out = 0x75d59160	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = ntohl, address_out = 0x75d449d0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = htonl, address_out = 0x75d449d0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = htons, address_out = 0x75d58ff0	1	Fn

System (846)

Operation	Additional Information	Count	Logfile
Sleep	duration = 0 milliseconds (0.000 seconds)	840	Fn
Get Time	type = Performance Ctr, time = 8184304929	1	Fn
Get Time	type = Ticks, time = 81812	3	Fn
Get Info	type = Operating System	2	Fn

Mutex (2)

Operation	Additional Information	Success	Count	Logfile
Open	mutex_name = Global\syncronize_Q25317A, desired_access = SYNCHRONIZE		1	Fn
Open	mutex_name = Global\syncronize_Q25317U, desired_access = SYNCHRONIZE		1	Fn

Process #9: cmd.exe

284

Information	Value
ID	#9
File Name	c:\windows\system32\cmd.exe
Command Line	"C:\WINDOWS\system32\cmd.exe"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:04:00, Reason: Child Process
Unmonitor	End Time: 00:04:20, Reason: Self Terminated
Monitor Duration	00:00:19

OS Process Information

Information	Value
PID	0x2698
Parent PID	0xdac (c:\programdata\microsoft\windows\start menu\programs\startup\load0.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 269C 0x 2704

Host Behavior

File (218)

Operation	Filename	Additional Information	Count	Logfile
Get Info	C:\WINDOWS\system32	type = file_attributes	1	Fn
Get Info	C:\Windows\System32	type = file_attributes	1	Fn
Get Info	STD_OUTPUT_HANDLE	type = file_type	14	Fn
Get Info	STD_INPUT_HANDLE	type = file_type	7	Fn
Open	STD_OUTPUT_HANDLE	-	36	Fn
Open	STD_INPUT_HANDLE	-	81	Fn
Read	STD_INPUT_HANDLE	size = 1, size_out = 1	65	Fn Data
Write	STD_OUTPUT_HANDLE	size = 38	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 2	5	Fn Data
Write	STD_OUTPUT_HANDLE	size = 52	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 20	3	Fn Data
Write	STD_OUTPUT_HANDLE	size = 24	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 36	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 5	1	Fn Data

Registry (17)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data = 4, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = AutoRun, data = 9, type = REG_NONE	1	Fn

Process (4)

Operation	Process	Additional Information	Count	Logfile
Create	C:\WINDOWS\system32\mode.com	os_pid = 0x2718, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Create	C:\WINDOWS\system32\vssadmin.exe	os_pid = 0x2738, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Get Info	C:\WINDOWS\system32\mode.com	type = PROCESS_BASIC_INFORMATION	1	Fn
Get Info	C:\WINDOWS\system32\vssadmin.exe	type = PROCESS_BASIC_INFORMATION	1	Fn

Memory (2)

Operation	Process	Additional Information	Success	Count	Logfile
Read	C:\WINDOWS\system32\mode.com	address = 853609795584, size = 1952		1	Fn Data
Read	C:\WINDOWS\system32\vssadmin.exe	address = 53993377792, size = 1952		1	Fn Data

Module (10)

Operation	Module	Additional Information	Count	Logfile
Load	NTDLL.DLL	base_address = 0x7ffa99050000	1	Fn
Get Handle	c:\windows\system32\cmd.exe	base_address = 0x7ff783ff0000	1	Fn
Get Handle	c:\windows\system32\kernel32.dll	base_address = 0x7ffa96710000	2	Fn
Get Filename	-	process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetThreadUILanguage, address_out = 0x7ffa9672a990	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CopyFileExW, address_out = 0x7ffa9672e830	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = IsDebuggerPresent, address_out = 0x7ffa9672e300	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetConsoleInputExeNameW, address_out = 0x7ffa961b0a40	1	Fn
Get Address	c:\windows\system32\ntdll.dll	function = NtQueryInformationProcess, address_out = 0x7ffa990f56b0	1	Fn

System (1)

Operation	Additional Information	Success	Count	Logfile
Get Info	type = Operating System		1	Fn

Environment (30)

Operation	Additional Information	Count	Logfile
Get Environment String	-	10	Fn Data
Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps;	3	Fn
Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	3	Fn
Get Environment String	name = PROMPT	1	Fn
Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Get Environment String	name = KEYS	1	Fn
Get Environment String	name = PROMPT, result_out = $P$G	3	Fn
Set Environment String	name = PROMPT, value = $P$G	1	Fn
Set Environment String	name = =C:, value = C:\Windows\System32	1	Fn
Set Environment String	name = COPYCMD	2	Fn
Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Set Environment String	name = =ExitCodeAscii	2	Fn
Set Environment String	name = =ExitCode, value = 00000002	1	Fn

Process #12: mode.com

Information	Value
ID	#12
File Name	c:\windows\system32\mode.com
Command Line	mode con cp select=1251
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:04:08, Reason: Child Process
Unmonitor	End Time: 00:04:11, Reason: Self Terminated
Monitor Duration	00:00:02
Remark	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0x2718
Parent PID	0x2698 (c:\windows\system32\cmd.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 271C 0x 2728

Process #13: vssadmin.exe

Information	Value
ID	#13
File Name	c:\windows\system32\vssadmin.exe
Command Line	vssadmin delete shadows /all /quiet
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:04:10, Reason: Child Process
Unmonitor	End Time: 00:04:20, Reason: Self Terminated
Monitor Duration	00:00:09
Remark	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0x2738
Parent PID	0x2698 (c:\windows\system32\cmd.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 273C 0x 2740 0x 2744 0x 2750 0x 2760 0x 2764

Process #14: load0.exe

30279

Information	Value
ID	#14
File Name	c:\programdata\microsoft\windows\start menu\programs\startup\load0.exe
Command Line	"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe" -a
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:04:27, Reason: Child Process
Unmonitor	End Time: 00:05:03, Reason: Terminated by Timeout
Monitor Duration	00:00:36

OS Process Information

Information	Value
PID	0xc6c
Parent PID	0xdac (c:\programdata\microsoft\windows\start menu\programs\startup\load0.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 530 0x 534 0x 266C 0x 2670 0x 2674 0x 2678 0x 267C 0x 2680 0x 2684 0x 2688 0x 268C 0x 2690 0x 2694 0x 550 0x DEC 0x E48 0x E4C 0x E50 0x E54 0x E58 0x E5C 0x E60 0x E64 0x E68 0x E6C 0x E70 0x E74 0x E78 0x ECC 0x ED0 0x ED4 0x ED8 0x EDC 0x EE0 0x EE4 0x F38 0x F3C 0x F40 0x F44 0x F48 0x F4C 0x F50 0x F54 0x F58 0x F5C 0x F60 0x F64 0x F68 0x F6C 0x F70 0x F74 0x F78 0x F7C 0x F80 0x F84 0x FD8 0x FDC 0x FE0 0x FE4 0x FE8 0x FEC 0x FF0 0x FF4 0x FF8 0x FFC 0x BE0 0x C28 0x B74 0x C64 0x 8CC 0x C8C 0x 390 0x C90 0x C94 0x C98 0x 378 0x 5BC 0x CBC 0x 47C 0x 36C 0x CC0 0x CD4 0x CD8 0x CDC 0x D14 0x D18 0x D1C 0x 868 0x 940 0x 928 0x B80 0x 8F4 0x B78 0x B7C 0x CE8 0x D20 0x D7C 0x B54 0x 8C0 0x CC8 0x D24 0x 8BC 0x 84C 0x D04 0x C9C 0x DD8 0x BF0 0x BC8 0x AF0 0x 5F0 0x 854 0x BF4 0x 758 0x 838 0x BC0 0x 1024 0x 1028 0x 102C 0x 1030 0x 1034 0x 1038 0x 103C 0x 1040 0x 1044 0x 1048 0x 104C 0x 1050 0x 1054 0x 1058 0x 105C 0x 1060 0x 1064 0x 1068 0x 106C 0x 1070 0x 10C4 0x 10C8 0x 10CC 0x 10D0 0x 10D4 0x 10D8 0x 10DC 0x 10E0 0x 10E4 0x 10E8 0x 10EC 0x 10F0 0x 10F4 0x 10F8 0x 10FC 0x 1100 0x 1104 0x 1108 0x 110C 0x 1110 0x 1164 0x 1168 0x 116C 0x 1170 0x 1174 0x 1178 0x 117C 0x 1180 0x 1184 0x 1188 0x 118C 0x 1190 0x 1194 0x 1198 0x 119C 0x 11A0 0x 11A4 0x 11A8 0x 11AC 0x 11B0 0x 1204 0x 1208 0x 120C 0x 1210 0x 1214 0x 1218 0x 121C 0x 1220 0x 1224 0x 1228 0x 122C 0x 1230 0x 1234 0x 1238 0x 123C 0x 1240 0x 1244 0x 1248 0x 124C 0x 1250 0x 12A4 0x 12A8 0x 12AC 0x 12B0 0x 12B4 0x 12B8 0x 12BC 0x 12C0 0x 12C4 0x 12C8 0x 12CC 0x 12D0 0x 12D4 0x 12D8 0x 12DC 0x 12E0 0x 12E4 0x 12E8 0x 12EC 0x 12F0 0x 1344 0x 1348 0x 134C 0x 1350 0x 1354 0x 1358 0x 135C 0x 1360 0x 1364 0x 1368 0x 136C 0x 1370 0x 1374 0x 1378 0x 137C 0x 1380 0x 1384 0x 1388 0x 138C 0x 1390 0x 13E4 0x 13E8 0x 13EC 0x 13F0 0x 13F4 0x 13F8 0x 13FC 0x A50 0x A48 0x A4C 0x A5C 0x DA4 0x DA0 0x 1404 0x 1408 0x 140C 0x 1410 0x 1414 0x 1418 0x 141C 0x 1470 0x 1474 0x 1478 0x 147C 0x 1480 0x 1484 0x 1488 0x 148C 0x 1490 0x 1494 0x 1498 0x 149C 0x 14A0 0x 14A4 0x 14A8 0x 14AC 0x 14B0 0x 14B4 0x 14B8 0x 14BC 0x 1510 0x 1514 0x 1518 0x 151C 0x 1520 0x 1524 0x 1528 0x 152C 0x 1530 0x 1534 0x 1538 0x 153C 0x 1540 0x 1544 0x 1548 0x 154C 0x 1550 0x 1554 0x 1558 0x 155C 0x 15B0 0x 15B4 0x 15B8 0x 15BC 0x 15C0 0x 15C4 0x 15C8 0x 15CC 0x 15D0 0x 15D4 0x 15D8 0x 15DC 0x 15E0 0x 15E4 0x 15E8 0x 15EC 0x 15F0 0x 15F4 0x 15F8 0x 15FC 0x 1650 0x 1654 0x 1658 0x 165C 0x 1660 0x 1664 0x 1668 0x 166C 0x 1670 0x 1674 0x 1678 0x 167C 0x 1680 0x 1684 0x 1688 0x 168C 0x 1690 0x 1694 0x 1698 0x 169C 0x 16F4 0x 16F8 0x 16FC 0x 1700 0x 1704 0x 1708 0x 170C 0x 1710 0x 1714 0x 1718 0x 171C 0x 1720 0x 1724 0x 1728 0x 172C 0x 1730 0x 1734 0x 1738 0x 173C 0x 1740 0x 1794 0x 1798 0x 179C 0x 17A0 0x 17A4 0x 17A8 0x 17AC 0x 17B0 0x 17B4 0x 17B8 0x 17BC 0x 17C0 0x 17C4 0x 17C8 0x 17CC 0x 17D0 0x 17D4 0x 17D8 0x 17DC 0x 17E0 0x 1818 0x 181C 0x 1820 0x 1824 0x 1828 0x 182C 0x 1830 0x 1834 0x 1838 0x 183C 0x 1840 0x 1844 0x 1848 0x 184C 0x 1850 0x 1854 0x 1858 0x 185C 0x 1860 0x 1864 0x 18B8 0x 18BC 0x 18C0 0x 18C4 0x 18C8 0x 18CC 0x 18D0 0x 18E0 0x 18E4 0x 18E8 0x 18EC 0x 18F0 0x 18F8 0x 18FC 0x 1900 0x 1904 0x 1908 0x 190C 0x 1910 0x 1914 0x 1918 0x 191C 0x 1920 0x 1924 0x 1928 0x 192C 0x 1930 0x 1938 0x 193C 0x 1940 0x 1944 0x 1948 0x 194C 0x 1950 0x 1954 0x 19B8 0x 19BC 0x 19C0 0x 19C4 0x 19C8 0x 19CC 0x 19D0 0x 19D4 0x 19D8 0x 19DC 0x 19E0 0x 19E4 0x 19E8 0x 19EC 0x 19F0 0x 19F4 0x 19F8 0x 19FC 0x 1A00 0x 1A04 0x 1A58 0x 1A5C 0x 1A60 0x 1A64 0x 1A68 0x 1A6C 0x 1A70 0x 1A74 0x 1A78 0x 1A7C 0x 1A80 0x 1A84 0x 1A88 0x 1A8C 0x 1A90 0x 1A94 0x 1A98 0x 1A9C 0x 1AA0 0x 1AA4 0x 1AF8 0x 1AFC 0x 1B00 0x 1B04 0x 1B08 0x 1B0C 0x 1B10 0x 1B14 0x 1B18 0x 1B1C 0x 1B20 0x 1B24 0x 1B28 0x 1B2C 0x 1B30 0x 1B34 0x 1B38 0x 1B3C 0x 1B40 0x 1B44 0x 1B98 0x 1B9C 0x 1BA0 0x 1BA4 0x 1BA8 0x 1BAC 0x 1BB0 0x 1BB4 0x 1BB8 0x 1BBC 0x 1BC0 0x 1BC4 0x 1BC8 0x 1BCC 0x 1BD0 0x 1BD4 0x 1BD8 0x 1BDC 0x 1BE0 0x 1BE4 0x 1C18 0x 1C1C 0x 1C20 0x 1C24 0x 1C28 0x 1C2C 0x 1C30 0x 1C34 0x 1C38 0x 1C3C 0x 1C40 0x 1C44 0x 1C48 0x 1C4C 0x 1C50 0x 1C54 0x 1C58 0x 1C5C 0x 1C60 0x 1C64 0x 1CB8 0x 1CBC 0x 1CC0 0x 1CC4 0x 1CC8 0x 1CCC 0x 1CD0 0x 1CD4 0x 1CD8 0x 1CDC 0x 1CE0 0x 1CE4 0x 1CE8 0x 1CF4 0x 1CF8 0x 1CFC 0x 1D00 0x 1D04 0x 1D58 0x 1D5C 0x 1D60 0x 1D64 0x 1D68 0x 1D6C 0x 1D70 0x 1D74 0x 1D78 0x 1D7C 0x 1D80 0x 1D84 0x 1D88 0x 1D8C 0x 1DA4 0x 1DF8 0x 1DFC 0x 1E00 0x 1E04 0x 1E08 0x 1E0C 0x 1E10 0x 1E14 0x 1E18 0x 1E1C 0x 1E20 0x 1E24 0x 1E28 0x 1E2C 0x 1E30 0x 1E34 0x 1E38 0x 1E3C 0x 1E40 0x 1E9C 0x 1EA0 0x 1EA4 0x 1EA8 0x 1EAC 0x 1EB0 0x 1EB4 0x 1EB8 0x 1EBC 0x 1EC0 0x 1EC4 0x 1EC8 0x 1ECC 0x 1ED0 0x 1ED4 0x 1ED8 0x 1EDC 0x 1EE0 0x 1EE4 0x 1F38 0x 1F54 0x 1F58 0x 1F5C 0x 1F60 0x 1F64 0x 1F68 0x 1F6C 0x 1F70 0x 1F74 0x 1F78 0x 1F7C 0x 1F80 0x 1F84 0x 1FD8 0x 1FDC 0x 1FE0 0x 1FE4 0x 1FE8 0x 1FEC 0x 1FF0 0x 1FF4 0x 1FF8 0x 1FFC 0x 2E0 0x 2004 0x 2008 0x 200C 0x 2010 0x 2014 0x 2018 0x 201C 0x 2020 0x 2024 0x 2078 0x 207C 0x 2080 0x 2084 0x 2088 0x 208C 0x 2090 0x 2094 0x 2098 0x 209C 0x 20A0 0x 20A4 0x 20A8 0x 20AC 0x 20B0 0x 20B4 0x 20B8 0x 20BC 0x 20C0 0x 20C4 0x 2118 0x 211C 0x 2120 0x 2124 0x 2128 0x 212C 0x 2130 0x 2134 0x 2138 0x 213C 0x 2140 0x 2144 0x 2148 0x 214C 0x 2150 0x 2154 0x 2158 0x 215C 0x 2160 0x 2164 0x 21B8 0x 21BC 0x 21C0 0x 21C4 0x 21C8 0x 21CC 0x 21D0 0x 21E0 0x 21E4 0x 21E8 0x 21EC 0x 21F0 0x 21F4 0x 21F8 0x 21FC 0x 2200 0x 2204 0x 2258 0x 225C 0x 2260 0x 2264 0x 2268 0x 226C 0x 2270 0x 2274 0x 2278 0x 227C 0x 2284 0x 2288 0x 228C 0x 2290 0x 2294 0x 2298 0x 229C 0x 22A0 0x 22A4 0x 22F8 0x 22FC 0x 2300 0x 2304 0x 2308 0x 230C 0x 2310 0x 2314 0x 2318 0x 231C 0x 2320 0x 2324 0x 2328 0x 232C 0x 2330 0x 2334 0x 2338 0x 233C 0x 2340 0x 2344 0x 2398 0x 239C 0x 23A0 0x 23A4 0x 23A8 0x 23AC 0x 23B0 0x 23B4 0x 23B8 0x 23BC 0x 23C0 0x 23D0 0x 23D4 0x 23D8 0x 23DC 0x 23E0 0x 23E4 0x 242C 0x 2430 0x 2434 0x 2438 0x 243C 0x 2440 0x 2444 0x 2448 0x 244C 0x 2450 0x 2454 0x 2458 0x 245C 0x 2460 0x 2468 0x 246C 0x 2470 0x 2474 0x 2478 0x 24CC 0x 24D0 0x 24D4 0x 24D8 0x 24DC 0x 24E0 0x 24E4 0x 24E8 0x 24EC 0x 24F0 0x 24F4 0x 24F8 0x 24FC 0x 2500 0x 2504 0x 250C 0x 2510 0x 2514 0x 2518 0x 256C 0x 2570 0x 2574 0x 2578 0x 257C 0x 2580 0x 2584 0x 2588 0x 258C 0x 2590 0x 2594 0x 2598 0x 259C 0x 25A0 0x 25A4 0x 25A8 0x 25B0 0x 25B4 0x 25B8 0x 260C 0x 2610 0x 2614 0x 2618 0x 261C 0x 2620 0x 2624 0x 2628 0x 262C 0x 2630 0x 2634 0x 2638 0x 263C 0x 2640 0x 2644 0x 2648 0x 264C 0x 2650 0x 2654 0x 2658 0x DC0 0x 26B4 0x DBC 0x 620 0x 9EC 0x BDC 0x 680 0x F0 0x F4 0x 6A0 0x 740 0x D70 0x A34 0x 9E8 0x 2720 0x 5D0 0x 84 0x 26F0 0x 269C 0x 2704 0x 26FC 0x 26D0 0x 3D8 0x 2F8 0x 27D8 0x 27DC 0x 27A8 0x 27AC 0x 2790 0x 2754 0x 277C 0x 2784 0x 27B8

Host Behavior

File (3995)

Operation	Filename	Additional Information	Count	Logfile
Create	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
Create	C:\WINDOWS\System32\load0.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	2	Fn
Create	C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe	desired_access = GENERIC_WRITE	1	Fn
Create	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD.LOG	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\$WINRE_BACKUP_PARTITION.MARKER	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD.LOG1	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\BCD.LOG2	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bg-BG\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bg-BG\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootspaces.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootspaces.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootvhd.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\bootvhd.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\nl-NL\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\nl-NL\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\pl-PL\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\pl-PL\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\pl-PL\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\pl-PL\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\pt-BR\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\pt-BR\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\pt-BR\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\pt-BR\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\pt-PT\bootmgr.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\pt-PT\bootmgr.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\pt-PT\memtest.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\pt-PT\memtest.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\bootmgr	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Boot\updaterevokesipolicy.p7b	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Boot\updaterevokesipolicy.p7b	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-delete.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\correct.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Garden.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Garden.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Green Bubbles.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Hand Prints.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Orange Circles.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\OrangeCircles.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Peacock.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Roses.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Shades of Blue.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Soft Blue.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\SoftBlue.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Stationery\Stars.jpg	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\Services\verisign.bmp	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\Services\verisign.bmp	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\adojavas.inc	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\adojavas.inc	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\adovbs.inc	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\adovbs.inc	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00148_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00296_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00390_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream64.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\mso20win32client.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\mso30win32client.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uires.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uiwin32client.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\mso40uiwin32client.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE, GENERIC_READ	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00448_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00448_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00448_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\en-US\FlickLearningWizard.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01178_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01178_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01178_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msader15.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msader15.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msado15.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msado15.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msado20.tlb	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msado20.tlb	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msado21.tlb	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msado21.tlb	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msado25.tlb	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Common Files\System\ado\msado25.tlb	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Internet Explorer\circus.exe.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Internet Explorer\ExtExport.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Internet Explorer\ExtExport.exe	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Internet Explorer\hmmapi.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Internet Explorer\hmmapi.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Internet Explorer\iediagcmd.exe	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Internet Explorer\iediagcmd.exe	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Internet Explorer\SIGNUP\install.ins.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Internet Explorer\sqmapi.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Internet Explorer\sqmapi.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\awt.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\awt.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\awt.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\bci.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\bci.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\bci.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\dcpr.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\dcpr.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\dcpr.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\decora_sse.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\decora_sse.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\decora_sse.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\deploy.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\deploy.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\deploy.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\deployJava1.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\deployJava1.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\deployJava1.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npdeployJava1.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npdeployJava1.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npdeployJava1.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00074_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00074_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00074_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\dt_shmem.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\dt_shmem.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\dt_shmem.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00076_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00076_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00077_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00077_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00077_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00086_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00086_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00086_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00090_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00090_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00090_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\dt_socket.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\dt_socket.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\dt_socket.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00096_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00096_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00096_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00296_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00296_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00296_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00297_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00297_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00297_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\eula.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\eula.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\eula.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00306_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00306_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00306_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00336_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00336_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00336_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00361_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00361_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00361_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00369_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00369_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00369_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00382_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00382_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00382_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00403_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00403_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00403_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\fontmanager.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\fontmanager.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\fontmanager.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00414_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00414_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00414_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\fxplugins.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\fxplugins.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\fxplugins.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00419_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00419_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00419_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00428_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00435_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00428_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00428_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00435_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00435_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00438_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00438_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00455_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00455_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00455_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00459_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00459_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00459_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00543_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00543_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00543_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00544_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00544_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00544_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00564_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00564_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00564_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00586_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00586_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00586_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00775_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00775_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00775_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00779_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00779_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00779_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\glass.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\glass.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\glass.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\glib-lite.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\glib-lite.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\glib-lite.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\gstreamer-lite.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\gstreamer-lite.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\gstreamer-lite.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\hprof.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\hprof.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\hprof.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00799_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00799_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00799_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00814_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00814_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00814_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00965_.WMF	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00965_.WMF	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00965_.WMF.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\instrument.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\instrument.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\instrument.dll.id-B4197730.[bitcharity@protonmail.com].com	desired_access = GENERIC_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\j2pcsc.dll	desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Create	C:\Program Files\Java\jre1.8.0_144\bin\j2pcsc.dll	desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Write	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[bitcharity@protonmail.com].com	size = 16000	1	Fn Data
Write	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 18640	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 274	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 18640	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 274	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 27056	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00392_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 27568	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 11504	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00648_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4416	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00921_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 19488	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00932_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3776	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00985_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3360	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOAT.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 9600	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00525_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 6272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BL00923_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 29008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BOATINST.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1344	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 21200	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 290	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1456	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00078_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 18640	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 282	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7984	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00092_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2384	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00100_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2176	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00136_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19152	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 276	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19664	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 274	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19152	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 294	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19152	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 286	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1728	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00145_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 8368	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00174_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4992	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 12800	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00186_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3120	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00200_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1600	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00224_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 11632	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00135_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1056	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 22736	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 20688	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 284	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 278	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 278	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5584	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00440_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3536	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00441_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2064	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00439_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00442_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1680	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3904	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00444_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3808	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00445_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2736	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1216	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3504	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01634_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 15008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01635_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1888	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01636_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19664	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 272	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19152	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 276	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 27856	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 272	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 26832	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 282	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3952	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01637_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19664	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 278	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 23248	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 278	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 24784	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 274	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 24784	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 276	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01639_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19152	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 278	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 396976	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvStream32.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 250	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3568	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CG1606.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2432	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC1.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2448	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS00453_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7184	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01603_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 70864	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 278	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 21200	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLASSIC2.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 49552	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANINST.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5280	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CRANE.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 230	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 263904	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 244	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 512224	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 246	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 10544	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BS01638_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 786698	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2272	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CLIP.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 262144	3	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2976	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUP.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 226	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 10336	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\CUPINST.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 29632	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 902336	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 31136	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 8272	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 332976	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2704	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 786714	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00234_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 262144	3	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00255_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 238	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id-B4197730.[bitcharity@protonmail.com].com	size = 112	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\i641033.hash.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00121_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00117_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.en-us.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 242	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 820432	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2848	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00256_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 358624	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 242	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 37984	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00261_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 1048560	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 230	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[bitcharity@protonmail.com].com	size = 112	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-B4197730.[bitcharity@protonmail.com].com	size = 230	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 40032	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 800	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7840	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 44704	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 17600	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 61040	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 252	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\msointl30.en-us.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 250	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00405_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00407_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00372_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 720	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00419_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00297_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 996576	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 244	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1936	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00437_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 42912	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00414_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 43008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00413_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 390336	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 242	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00448_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2960	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00448_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 982736	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 20800	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00687_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 10000	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00449_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01015_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 786706	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 262144	3	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 24592	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD00705_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 14832	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01039_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[bitcharity@protonmail.com].com	size = 363744	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.id-B4197730.[bitcharity@protonmail.com].com	size = 232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3632	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01140_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3648	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01139_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3696	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01138_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	size = 590528	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.id-B4197730.[bitcharity@protonmail.com].com	size = 260	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2784	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01145_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 18640	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 260	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2144	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01143_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 990048	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.id-B4197730.[bitcharity@protonmail.com].com	size = 244304	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.id-B4197730.[bitcharity@protonmail.com].com	size = 226	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2976	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01151_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2800	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01146_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3600	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01157_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2976	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01152_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 1048560	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 12464	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 250	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2096	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01166_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2304	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01163_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01160_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2304	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01162_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2416	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01170_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2032	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01169_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2016	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01168_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2096	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01167_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 100496	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 246	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 20624	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 244	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 855392	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1904	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01176_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 367232	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01172_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2064	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01171_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 48880	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 258	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1808	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01173_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb	size = 3808	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2032	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01179_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 426608	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1456	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01181_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2096	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01180_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01182_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 168080	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 232	1	Fn Data
Write	C:\Program Files\Internet Explorer\SIGNUP\install.ins.id-B4197730.[bitcharity@protonmail.com].com	size = 464	1	Fn Data
Write	C:\Program Files\Internet Explorer\SIGNUP\install.ins.id-B4197730.[bitcharity@protonmail.com].com	size = 234	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.id-B4197730.[bitcharity@protonmail.com].com	size = 17056	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.id-B4197730.[bitcharity@protonmail.com].com	size = 238	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.id-B4197730.[bitcharity@protonmail.com].com	size = 22688	1	Fn Data
Write	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2304	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01183_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1776	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01366_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 912	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01434_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 8576	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01186_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 592	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01629_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 304	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01630_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 560	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01631_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4160	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01761_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 19072	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01628_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2336	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01586_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\dcpr.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 159824	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\dcpr.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Internet Explorer\circus.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 75792	1	Fn Data
Write	C:\Program Files\Internet Explorer\circus.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1392	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00010_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3264	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01793_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\deploy.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 587856	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\deploy.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 232	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\decora_sse.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 86096	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\decora_sse.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 13056	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00019_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2704	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00172_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 6960	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\ED00184_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2304	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01772_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 6944	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00202_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 13952	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00006_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 12368	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00222_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2288	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00319_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 6784	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00242_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2528	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\DD01585_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\bci.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 16976	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\bci.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 226	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\awt.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 1048560	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\deployJava1.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 1026128	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7952	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00902_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 17312	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00397_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 752	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\EN00320_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00074_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 17856	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00074_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\dt_shmem.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 29776	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\dt_shmem.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00086_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 29216	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00086_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 12000	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00076_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00077_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 30256	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00077_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npdeployJava1.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 1048560	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\dt_socket.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 24656	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\dt_socket.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 238	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00297_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 18208	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00297_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00096_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 37392	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00096_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00296_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 15872	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00296_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00090_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 14208	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00090_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\awt.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 468064	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00336_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 6080	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00336_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00369_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 8560	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00369_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF	size = 46816	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\eula.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 136272	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\eula.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00361_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4080	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00361_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\deployJava1.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 242	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00403_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7888	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00403_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 10832	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00397_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00414_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 11008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00414_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\fontmanager.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 274512	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\fontmanager.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 242	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00382_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 8432	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00382_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00435_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2112	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00435_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5104	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00438_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00455_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 8928	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00455_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00428_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4800	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00428_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00459_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 17408	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00459_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00419_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 16400	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00419_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00544_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5264	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00544_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00543_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1488	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00543_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\fxplugins.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 186960	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\fxplugins.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 238	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npdeployJava1.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 108128	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npdeployJava1.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 246	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\awt.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 226	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00564_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 912	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00564_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00586_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 768	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00586_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00775_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 11168	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00775_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\glib-lite.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 455760	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\glib-lite.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 238	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\hprof.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 158288	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\hprof.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 230	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\glass.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 265808	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\glass.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 230	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\gstreamer-lite.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 619600	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\gstreamer-lite.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 248	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00779_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 9024	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00779_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00799_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 13984	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00799_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00965_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 15168	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00965_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00814_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 42720	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD00814_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\j2pkcs11.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 63568	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\j2pkcs11.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01074_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01074_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01084_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2416	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01084_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01176_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4992	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01176_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\j2pcsc.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19024	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\j2pcsc.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01191_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3968	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01191_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\instrument.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 123472	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\instrument.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01193_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1168	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01193_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jaas_nt.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 21072	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jaas_nt.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 234	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jabswitch.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 34384	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jabswitch.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 238	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01548_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 10320	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01548_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01196_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2336	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01196_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\java-rmi.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 15952	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\java-rmi.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01657_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 30416	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01657_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01658_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 17936	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01658_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01659_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 31184	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01659_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01660_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 12960	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD01660_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02068_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2496	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02068_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02088_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3712	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02088_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02071_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2192	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02071_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02075_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4400	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02075_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02097_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1568	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02097_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\java.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 206928	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\java.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\javacpl.cpl.id-B4197730.[bitcharity@protonmail.com].com	size = 187408	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\javacpl.cpl.id-B4197730.[bitcharity@protonmail.com].com	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02153_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5408	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02153_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02116_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4000	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02116_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\javacpl.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 80464	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\javacpl.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 234	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\JavaAccessBridge-64.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 142416	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\JavaAccessBridge-64.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 258	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\java.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 159824	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\java.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02141_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02141_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02115_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4672	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02115_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02161_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3136	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02161_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00057_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3776	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00057_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00084_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2480	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00084_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FLAP.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2080	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FLAP.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\javaw.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 206928	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\javaw.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 230	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\javafx_font.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 69200	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\javafx_font.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 242	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02158_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1664	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\FD02158_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\javafx_font_t2k.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 538192	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\javafx_font_t2k.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 250	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\javafx_iio.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 128080	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\javafx_iio.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00231_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00231_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00235_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1040	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00235_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00241_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1968	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00241_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00236_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3296	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00236_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\java_crw_demo.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 29776	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\java_crw_demo.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 246	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jawt.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 14416	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jawt.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00260_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3664	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00260_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jfr.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 26704	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jfr.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 226	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\javaws.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 319568	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\javaws.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3312	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00443_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00334_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1536	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00334_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00276_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3024	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00276_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jdwp.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 201808	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jdwp.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\JAWTAccessBridge-64.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 15440	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\JAWTAccessBridge-64.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 258	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jjs.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 15952	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jjs.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 226	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jli.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 174672	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jli.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 226	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00527_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5808	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00527_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00513_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 832	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00513_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jfxmedia.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 139856	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jfxmedia.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00546_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3728	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00546_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jp2launcher.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 112208	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jp2launcher.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 242	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00601_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1472	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00601_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jp2native.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 20048	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jp2native.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 238	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00602_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1408	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00602_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00623_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 10656	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00623_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 14704	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00524_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00625_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2128	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00625_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jpeg.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 185936	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jpeg.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 13552	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00526_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jsdt.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 18512	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00612_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 12640	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00681_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 9312	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00669_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 11504	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00636_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1584	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jp2iexp.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 296016	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jp2iexp.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 234	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jsdt.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jp2ssv.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 235600	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jp2ssv.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 232	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jfxwebkit.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 786694	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jfxwebkit.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 262144	3	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jsound.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 35408	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jsound.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 232	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jsoundds.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 31312	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\jsoundds.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\kcms.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 220752	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\kcms.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00636_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00669_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00681_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00612_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00693_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7104	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00688_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7088	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\klist.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 16464	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\kinit.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 16464	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\ktab.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 16464	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\keytool.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 16464	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00687_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4352	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00685_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4048	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00693_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00685_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00687_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\keytool.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 234	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\ktab.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\kinit.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 230	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\klist.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 230	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH00688_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\lcms.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 233552	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\management.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 36944	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01015_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1152	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01013_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2864	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\msvcp120.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 660144	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01065_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1280	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\mlib_image.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 653904	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01058_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2768	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\lcms.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01058_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\mlib_image.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01065_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\msvcp120.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01013_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01015_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\management.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 240	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\msvcr100.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 829280	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\msvcr100.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5008	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01080_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01291_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 15808	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01291_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\net.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 96848	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\net.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 226	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01329_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 6032	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01329_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01461_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5968	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01461_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01618_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7312	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01618_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01759_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5424	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01759_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\msvcr120.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 963248	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\msvcr120.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\nio.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 60496	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\nio.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 226	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\npt.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 19024	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\npt.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 226	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01875_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2624	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01875_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01923_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 26720	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01923_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\pack200.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 16464	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\pack200.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 234	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02155_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2720	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02155_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\plugin2\msvcr100.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 829280	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\plugin2\msvcr100.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01242_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7344	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH01242_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\orbd.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 16464	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\orbd.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02166_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1328	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02166_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02282_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 7936	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02282_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\policytool.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 16464	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\policytool.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02312_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 4976	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02312_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02298_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 5568	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02298_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\prism_common.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 57424	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\prism_common.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 244	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\policytool.exe	size = 234576	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\policytool.exe	size = 230	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\prism_sw.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 97872	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\prism_sw.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02313_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 3088	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HH02313_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00005_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 23312	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00005_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\prism_d3d.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 130640	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\prism_d3d.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 238	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\resource.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 15440	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\resource.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\rmid.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 15952	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\rmid.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 228	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa.id-B4197730.[bitcharity@protonmail.com].com	size = 786690	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\rmiregistry.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 16464	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\rmiregistry.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 242	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00426_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 68784	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00426_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\servertool.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 16464	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\servertool.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 240	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00172_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2848	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00172_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00114_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 22128	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00114_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00116_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 15856	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\HM00116_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\server\classes.jsa.id-B4197730.[bitcharity@protonmail.com].com	size = 262144	3	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 70224	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\ssvagent.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\splashscreen.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 204880	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\splashscreen.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 244	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00046_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1168	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00046_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00118_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 800	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00118_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\ssv.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 571984	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\ssv.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 226	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\sunmscapi.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 31824	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\sunmscapi.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 238	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00204_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1856	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00204_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00346_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 704	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00346_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00177_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1088	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00177_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\sunec.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 135760	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\sunec.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 230	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00343_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1904	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00343_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\t2k.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 255056	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\t2k.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 226	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00915_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 12752	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00915_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00557_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 9184	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00557_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00351_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1936	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00351_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\server\jvm.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 786682	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\tnameserv.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 16464	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\tnameserv.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 238	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00233_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 11200	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00233_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00919_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 6928	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00919_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00957_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 2960	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00957_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\unpack.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 79952	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\unpack.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00956_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 1264	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\IN00956_.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\unpack200.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 197200	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\unpack200.exe.id-B4197730.[bitcharity@protonmail.com].com	size = 238	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0075478.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 1232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0075478.GIF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\w2k_lsa_auth.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 24144	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\w2k_lsa_auth.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 244	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\verify.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 49232	1	Fn Data
Write	C:\Program Files\Java\jre1.8.0_144\bin\verify.dll.id-B4197730.[bitcharity@protonmail.com].com	size = 232	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0086424.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 17024	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0086424.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0086384.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 9744	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0086384.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0086420.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 9600	1	Fn Data
Write	C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0086420.WMF.id-B4197730.[bitcharity@protonmail.com].com	size = 236	1	Fn Data
For performance reasons, the remaining 2947 entries are omitted. The remaining entries can be found in glog.xml.

Registry (8)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Startup, data = 83, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Startup, data = %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	value_name = Common Startup, data = %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, type = REG_EXPAND_SZ	1	Fn
Write Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	value_name = load0.exe, data = C:\WINDOWS\System32\load0.exe, size = 58, type = REG_SZ	1	Fn

Process (929)

Operation	Process	Additional Information	Count	Logfile
Create	C:\WINDOWS\system32\cmd.exe	os_pid = 0x2740, startup_flags = STARTF_USESHOWWINDOW, STARTF_USESTDHANDLES, show_window = SW_HIDE	1	Fn
Enumerate Processes	-	-	906	Fn
Enumerate Processes	-	-	22	Fn

Module (146)

Operation	Module	Additional Information	Count	Logfile
Load	KERNEL32.dll	base_address = 0x75420000	1	Fn
Load	kernel32.dll	base_address = 0x75420000	1	Fn
Load	advapi32.dll	base_address = 0x77a40000	1	Fn
Load	user32.dll	base_address = 0x752e0000	1	Fn
Load	Shell32.dll	base_address = 0x76060000	1	Fn
Load	ntdll.dll	base_address = 0x77da0000	1	Fn
Load	mpr.dll	base_address = 0x74600000	1	Fn
Load	ws2_32.dll	base_address = 0x75d40000	1	Fn
Get Handle	c:\programdata\microsoft\windows\start menu\programs\startup\load0.exe	base_address = 0x400000	1	Fn
Get Handle	c:\windows\syswow64\kernel32.dll	base_address = 0x75420000	16	Fn
Get Filename	-	process_name = c:\programdata\microsoft\windows\start menu\programs\startup\load0.exe, file_name_orig = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\load0.exe, size = 32767	3	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetProcAddress, address_out = 0x754351b0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = LoadLibraryA, address_out = 0x75435a80	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WaitForSingleObject, address_out = 0x7548eca0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = InitializeCriticalSectionAndSpinCount, address_out = 0x7548ebb0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = LeaveCriticalSection, address_out = 0x77deb250	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetLastError, address_out = 0x75435010	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = EnterCriticalSection, address_out = 0x77deb2d0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ReleaseMutex, address_out = 0x7548ec20	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CloseHandle, address_out = 0x7548eab0	2	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetModuleHandleW, address_out = 0x754350d0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindNextFileW, address_out = 0x7548ee40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindClose, address_out = 0x7548ed70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = MoveFileW, address_out = 0x7546e500	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetFileSizeEx, address_out = 0x7548ef40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetModuleFileNameW, address_out = 0x75435090	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetFileAttributesW, address_out = 0x7548ef10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ExitProcess, address_out = 0x75433cb0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCommandLineW, address_out = 0x75434cc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetComputerNameW, address_out = 0x754632c0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetComputerNameA, address_out = 0x75463780	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateMutexW, address_out = 0x7548eb70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrlenW, address_out = 0x75436c70	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrlenA, address_out = 0x75436c50	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCurrentProcess, address_out = 0x7548ea10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetLogicalDrives, address_out = 0x75430d20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetTickCount, address_out = 0x7548dd50	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = DeleteFileW, address_out = 0x7548ed40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WideCharToMultiByte, address_out = 0x75436b10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Sleep, address_out = 0x75436760	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ReadFile, address_out = 0x7548f090	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateFileW, address_out = 0x7548ed10	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = OpenMutexW, address_out = 0x7548ebf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WaitForMultipleObjects, address_out = 0x7548ec80	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrcmpiW, address_out = 0x75436bf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = lstrcmpiA, address_out = 0x75436bd0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = DeleteCriticalSection, address_out = 0x77dcfb90	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetVersion, address_out = 0x754356c0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateThread, address_out = 0x754346b0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = ExpandEnvironmentStringsW, address_out = 0x75434a40	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = QueryPerformanceCounter, address_out = 0x75435da0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = QueryPerformanceFrequency, address_out = 0x75435dc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetCurrentProcessId, address_out = 0x7548ea20	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetFileAttributesW, address_out = 0x7548f100	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetVolumeInformationW, address_out = 0x7548f020	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = WriteFile, address_out = 0x7548f180	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetFilePointerEx, address_out = 0x7548f130	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetEndOfFile, address_out = 0x7548f0e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = FindFirstFileW, address_out = 0x7548edf0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetProcessHeap, address_out = 0x754351f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapReAlloc, address_out = 0x77ddf630	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapAlloc, address_out = 0x77de2dc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = HeapFree, address_out = 0x754357f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreatePipe, address_out = 0x75434590	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SetHandleInformation, address_out = 0x7548eae0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateProcessW, address_out = 0x75434610	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CompareStringW, address_out = 0x75434430	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CompareStringA, address_out = 0x75434410	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = OpenProcess, address_out = 0x75435cc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = TerminateProcess, address_out = 0x754367e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = GetSystemTime, address_out = 0x754354e0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = SystemTimeToFileTime, address_out = 0x754367a0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = CreateToolhelp32Snapshot, address_out = 0x7546edc0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Process32NextW, address_out = 0x7546f8f0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Process32FirstW, address_out = 0x7546f750	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegOpenKeyExW, address_out = 0x77a5e580	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegQueryValueExW, address_out = 0x77a5e5a0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegSetValueExW, address_out = 0x77a5f530	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = RegCloseKey, address_out = 0x77a5ed60	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenProcessToken, address_out = 0x77a5efb0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = GetTokenInformation, address_out = 0x77a5ee90	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenSCManagerW, address_out = 0x77a60540	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = OpenServiceW, address_out = 0x77a5fa20	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = CloseServiceHandle, address_out = 0x77a5fc00	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = ControlService, address_out = 0x77a726d0	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = QueryServiceStatus, address_out = 0x77a62380	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = EnumDependentServicesW, address_out = 0x77a72f70	1	Fn
Get Address	c:\windows\syswow64\advapi32.dll	function = EnumServicesStatusExW, address_out = 0x77a5fc80	1	Fn
Get Address	c:\windows\syswow64\user32.dll	function = SystemParametersInfoW, address_out = 0x7530f210	1	Fn
Get Address	c:\windows\syswow64\shell32.dll	function = ShellExecuteExW, address_out = 0x761c4730	1	Fn
Get Address	c:\windows\syswow64\ntdll.dll	function = NtQuerySystemInformation, address_out = 0x77e12070	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetCloseEnum, address_out = 0x74602640	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetOpenEnumW, address_out = 0x74602790	1	Fn
Get Address	c:\windows\syswow64\mpr.dll	function = WNetEnumResourceW, address_out = 0x74602410	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = WSAStartup, address_out = 0x75d45b40	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = socket, address_out = 0x75d54510	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = send, address_out = 0x75d45030	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = recv, address_out = 0x75d50c50	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = connect, address_out = 0x75d45410	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = closesocket, address_out = 0x75d50910	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = gethostbyname, address_out = 0x75d76cb0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = inet_addr, address_out = 0x75d59160	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = ntohl, address_out = 0x75d449d0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = htonl, address_out = 0x75d449d0	1	Fn
Get Address	c:\windows\syswow64\ws2_32.dll	function = htons, address_out = 0x75d58ff0	1	Fn
Get Address	c:\windows\syswow64\kernel32.dll	function = Wow64DisableWow64FsRedirection, address_out = 0x75436b30	16	Fn

Service (66)

Operation	Additional Information	Count	Logfile
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Enumerate	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	3	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	2	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn
Open Manager	database_name = SERVICES_ACTIVE_DATABASE	1	Fn

System (1125)

Operation	Additional Information	Count	Logfile
Get Computer Name	result_out = NQDPDE	1	Fn
Sleep	duration = 0 milliseconds (0.000 seconds)	840	Fn
Sleep	duration = -1 (infinite)	1	Fn
Sleep	duration = 100 milliseconds (0.100 seconds)	43	Fn
Sleep	duration = 500 milliseconds (0.500 seconds)	21	Fn
Get Time	type = Performance Ctr, time = 12723670082	1	Fn
Get Time	type = Ticks, time = 127203	3	Fn
Get Time	type = Ticks, time = 127671	2	Fn
Get Time	type = Ticks, time = 128031	2	Fn
Get Time	type = Ticks, time = 128359	2	Fn
Get Time	type = Ticks, time = 128734	4	Fn
Get Time	type = Ticks, time = 129046	2	Fn
Get Time	type = Ticks, time = 129312	2	Fn
Get Time	type = Ticks, time = 129578	2	Fn
Get Time	type = Ticks, time = 129812	4	Fn
Get Time	type = Ticks, time = 130015	2	Fn
Get Time	type = Ticks, time = 130468	2	Fn
Get Time	type = Ticks, time = 130687	2	Fn
Get Time	type = Ticks, time = 131203	4	Fn
Get Time	type = Ticks, time = 131406	2	Fn
Get Time	type = Ticks, time = 131671	2	Fn
Get Time	type = Ticks, time = 131828	2	Fn
Get Time	type = Ticks, time = 131968	2	Fn
Get Time	type = Ticks, time = 132140	2	Fn
Get Time	type = Ticks, time = 132359	4	Fn
Get Time	type = Ticks, time = 132500	2	Fn
Get Time	type = Ticks, time = 132625	2	Fn
Get Time	type = Ticks, time = 132734	2	Fn
Get Time	type = Ticks, time = 132875	2	Fn
Get Time	type = Ticks, time = 133000	2	Fn
Get Time	type = Ticks, time = 133109	2	Fn
Get Time	type = Ticks, time = 133218	2	Fn
Get Time	type = Ticks, time = 133343	2	Fn
Get Time	type = Ticks, time = 133453	4	Fn
Get Time	type = Ticks, time = 133625	2	Fn
Get Time	type = Ticks, time = 133750	2	Fn
Get Time	type = Ticks, time = 133859	2	Fn
Get Time	type = Ticks, time = 133968	2	Fn
Get Time	type = Ticks, time = 134078	2	Fn
Get Time	type = Ticks, time = 134187	2	Fn
Get Time	type = Ticks, time = 134296	2	Fn
Get Time	type = Ticks, time = 134390	2	Fn
Get Time	type = Ticks, time = 134500	4	Fn
Get Time	type = Ticks, time = 134609	2	Fn
Get Time	type = Ticks, time = 134718	2	Fn
Get Time	type = Ticks, time = 135312	2	Fn
Get Time	type = Ticks, time = 135484	2	Fn
Get Time	type = Ticks, time = 135640	4	Fn
Get Time	type = Ticks, time = 135750	2	Fn
Get Time	type = Ticks, time = 135859	2	Fn
Get Time	type = Ticks, time = 136031	2	Fn
Get Time	type = Ticks, time = 136515	2	Fn
Get Time	type = Ticks, time = 136625	2	Fn
Get Time	type = Ticks, time = 136734	4	Fn
Get Time	type = Ticks, time = 137187	2	Fn
Get Time	type = Ticks, time = 138218	4	Fn
Get Time	type = Ticks, time = 138484	1	Fn
Get Time	type = Ticks, time = 138500	1	Fn
Get Time	type = Ticks, time = 138593	1	Fn
Get Time	type = Ticks, time = 139515	4	Fn
Get Time	type = Ticks, time = 139953	2	Fn
Get Time	type = Ticks, time = 140062	2	Fn
Get Time	type = Ticks, time = 140343	2	Fn
Get Time	type = Ticks, time = 140453	2	Fn
Get Time	type = Ticks, time = 140578	4	Fn
Get Time	type = Ticks, time = 140703	2	Fn
Get Time	type = Ticks, time = 140875	2	Fn
Get Time	type = Ticks, time = 141015	2	Fn
Get Time	type = Ticks, time = 141156	2	Fn
Get Time	type = Ticks, time = 141265	2	Fn
Get Time	type = Ticks, time = 141468	2	Fn
Get Time	type = Ticks, time = 141593	4	Fn
Get Time	type = Ticks, time = 141890	2	Fn
Get Time	type = Ticks, time = 142031	2	Fn
Get Time	type = Ticks, time = 142156	2	Fn
Get Time	type = Ticks, time = 142250	2	Fn
Get Time	type = Ticks, time = 142375	2	Fn
Get Time	type = Ticks, time = 142468	2	Fn
Get Time	type = Ticks, time = 142578	2	Fn
Get Time	type = Ticks, time = 142703	4	Fn
Get Time	type = Ticks, time = 142796	2	Fn
Get Time	type = Ticks, time = 142921	2	Fn
Get Time	type = Ticks, time = 143078	2	Fn
Get Time	type = Ticks, time = 143203	2	Fn
Get Time	type = Ticks, time = 143531	2	Fn
Get Time	type = Ticks, time = 143687	2	Fn
Get Time	type = Ticks, time = 143843	4	Fn
Get Time	type = Ticks, time = 143953	2	Fn
Get Time	type = Ticks, time = 144078	2	Fn
Get Time	type = Ticks, time = 144171	2	Fn
Get Time	type = Ticks, time = 144281	2	Fn
Get Time	type = Ticks, time = 144390	2	Fn
Get Time	type = Ticks, time = 144500	2	Fn
Get Time	type = Ticks, time = 144609	2	Fn
Get Time	type = Ticks, time = 144734	2	Fn
Get Time	type = Ticks, time = 144875	4	Fn
Get Time	type = Ticks, time = 145031	2	Fn
Get Time	type = Ticks, time = 145156	2	Fn
Get Time	type = Ticks, time = 145281	2	Fn
Get Time	type = Ticks, time = 145468	2	Fn
Get Info	type = Operating System	2	Fn

Mutex (2)

Operation	Additional Information	Success	Count	Logfile
Open	mutex_name = Global\syncronize_Q25317A, desired_access = SYNCHRONIZE		1	Fn
Open	mutex_name = Global\syncronize_Q25317U, desired_access = SYNCHRONIZE		1	Fn

Process #15: cmd.exe

284

Information	Value
ID	#15
File Name	c:\windows\system32\cmd.exe
Command Line	"C:\WINDOWS\system32\cmd.exe"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:04:45, Reason: Child Process
Unmonitor	End Time: 00:04:52, Reason: Self Terminated
Monitor Duration	00:00:06

OS Process Information

Information	Value
PID	0x2740
Parent PID	0xc6c (c:\programdata\microsoft\windows\start menu\programs\startup\load0.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 26F8 0x B5C

Host Behavior

File (218)

Operation	Filename	Additional Information	Count	Logfile
Get Info	C:\WINDOWS\system32	type = file_attributes	1	Fn
Get Info	C:\Windows\System32	type = file_attributes	1	Fn
Get Info	STD_OUTPUT_HANDLE	type = file_type	14	Fn
Get Info	STD_INPUT_HANDLE	type = file_type	7	Fn
Open	STD_OUTPUT_HANDLE	-	36	Fn
Open	STD_INPUT_HANDLE	-	81	Fn
Read	STD_INPUT_HANDLE	size = 1, size_out = 1	65	Fn Data
Write	STD_OUTPUT_HANDLE	size = 38	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 2	5	Fn Data
Write	STD_OUTPUT_HANDLE	size = 52	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 20	3	Fn Data
Write	STD_OUTPUT_HANDLE	size = 24	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 36	1	Fn Data
Write	STD_OUTPUT_HANDLE	size = 5	1	Fn Data

Registry (17)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data = 4, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = AutoRun, data = 9, type = REG_NONE	1	Fn

Process (4)

Operation	Process	Additional Information	Count	Logfile
Create	C:\WINDOWS\system32\mode.com	os_pid = 0x272c, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Create	C:\WINDOWS\system32\vssadmin.exe	os_pid = 0x9bc, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Get Info	C:\WINDOWS\system32\mode.com	type = PROCESS_BASIC_INFORMATION	1	Fn
Get Info	C:\WINDOWS\system32\vssadmin.exe	type = PROCESS_BASIC_INFORMATION	1	Fn

Memory (2)

Operation	Process	Additional Information	Success	Count	Logfile
Read	C:\WINDOWS\system32\mode.com	address = 760962887680, size = 1952		1	Fn Data
Read	C:\WINDOWS\system32\vssadmin.exe	address = 1041611698176, size = 1952		1	Fn Data

Module (10)

Operation	Module	Additional Information	Count	Logfile
Load	NTDLL.DLL	base_address = 0x7ffa99050000	1	Fn
Get Handle	c:\windows\system32\cmd.exe	base_address = 0x7ff783ff0000	1	Fn
Get Handle	c:\windows\system32\kernel32.dll	base_address = 0x7ffa96710000	2	Fn
Get Filename	-	process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetThreadUILanguage, address_out = 0x7ffa9672a990	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = CopyFileExW, address_out = 0x7ffa9672e830	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = IsDebuggerPresent, address_out = 0x7ffa9672e300	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetConsoleInputExeNameW, address_out = 0x7ffa961b0a40	1	Fn
Get Address	c:\windows\system32\ntdll.dll	function = NtQueryInformationProcess, address_out = 0x7ffa990f56b0	1	Fn

System (1)

Operation	Additional Information	Success	Count	Logfile
Get Info	type = Operating System		1	Fn

Environment (30)

Operation	Additional Information	Count	Logfile
Get Environment String	-	10	Fn Data
Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	3	Fn
Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	3	Fn
Get Environment String	name = PROMPT	1	Fn
Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Get Environment String	name = KEYS	1	Fn
Get Environment String	name = PROMPT, result_out = $P$G	3	Fn
Set Environment String	name = PROMPT, value = $P$G	1	Fn
Set Environment String	name = =C:, value = C:\Windows\System32	1	Fn
Set Environment String	name = COPYCMD	2	Fn
Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Set Environment String	name = =ExitCodeAscii	2	Fn
Set Environment String	name = =ExitCode, value = 00000002	1	Fn

Process #17: cmd.exe

Information	Value
ID	#17
File Name	c:\windows\system32\cmd.exe
Command Line	"C:\WINDOWS\system32\cmd.exe"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:04:46, Reason: Child Process
Unmonitor	End Time: 00:04:50, Reason: Self Terminated
Monitor Duration	00:00:04

OS Process Information

Information	Value
PID	0x27b0
Parent PID	0xdac (c:\programdata\microsoft\windows\start menu\programs\startup\load0.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 2758 0x 2730

Host Behavior

File (25)

Operation	Filename	Additional Information	Count	Logfile
Get Info	C:\WINDOWS\system32	type = file_attributes	1	Fn
Get Info	C:\Windows\System32	type = file_attributes	1	Fn
Get Info	STD_OUTPUT_HANDLE	type = file_type	5	Fn
Get Info	STD_ERROR_HANDLE	type = file_type	1	Fn
Open	STD_OUTPUT_HANDLE	-	10	Fn
Open	STD_INPUT_HANDLE	-	2	Fn
Open	STD_ERROR_HANDLE	-	2	Fn
Write	STD_OUTPUT_HANDLE	size = 38	1	Fn
Write	STD_OUTPUT_HANDLE	size = 2	1	Fn
Write	STD_ERROR_HANDLE	size = 51	1	Fn

Registry (17)

Operation	Key	Additional Information	Count	Logfile
Open Key	HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	-	1	Fn
Open Key	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	-	1	Fn
Open Key	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	-	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data = 4, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Read Value	HKEY_CURRENT_USER\Software\Microsoft\Command Processor	value_name = AutoRun, data = 9, type = REG_NONE	1	Fn

Module (4)

Operation	Module	Additional Information	Count	Logfile
Get Handle	c:\windows\system32\cmd.exe	base_address = 0x7ff783ff0000	1	Fn
Get Handle	c:\windows\system32\kernel32.dll	base_address = 0x7ffa96710000	1	Fn
Get Filename	-	process_name = c:\windows\system32\cmd.exe, file_name_orig = C:\WINDOWS\system32\cmd.exe, size = 32743	1	Fn
Get Address	c:\windows\system32\kernel32.dll	function = SetThreadUILanguage, address_out = 0x7ffa9672a990	1	Fn

System (1)

Operation	Additional Information	Success	Count	Logfile
Get Info	type = Operating System		1	Fn

Environment (11)

Operation	Additional Information	Count	Logfile
Get Environment String	-	4	Fn Data
Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps;	1	Fn
Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Get Environment String	name = PROMPT	1	Fn
Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Get Environment String	name = KEYS	1	Fn
Set Environment String	name = PROMPT, value = $P$G	1	Fn
Set Environment String	name = =C:, value = C:\Windows\System32	1	Fn

Process #19: mode.com

Information	Value
ID	#19
File Name	c:\windows\system32\mode.com
Command Line	mode con cp select=1251
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:04:50, Reason: Child Process
Unmonitor	End Time: 00:04:51, Reason: Self Terminated
Monitor Duration	00:00:01
Remark	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0x272c
Parent PID	0x2740 (c:\windows\system32\cmd.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 4C4 0x 26D4

Process #20: vssadmin.exe

Information	Value
ID	#20
File Name	c:\windows\system32\vssadmin.exe
Command Line	vssadmin delete shadows /all /quiet
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:04:50, Reason: Child Process
Unmonitor	End Time: 00:04:52, Reason: Self Terminated
Monitor Duration	00:00:01
Remark	No high level activity detected in monitored regions

OS Process Information

Information	Value
PID	0x9bc
Parent PID	0x2740 (c:\windows\system32\cmd.exe)
Bitness	64-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 27FC 0x 3E0 0x 27D0 0x 27F0 0x 27F8

Remarks (1/1)

Monitored Processes

Behavior Information - Grouped by Category

Before

After