mdsqvy.exe
Windows Exe (x86-32)
Created at 2019-05-29T00:51:00
Monitored Processes
Behavior Information - Grouped by Category
Process #1: mdsqvy.exe
55832
0
| Information | Value |
|---|---|
| ID | #1 |
| File Name | c:\users\5p5nrgjn0js halpmcxz\desktop\mdsqvy.exe |
| Command Line | "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mdsqvy.exe" |
| Initial Working Directory | C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ |
| Monitor | Start Time: 00:00:36, Reason: Analysis Target |
| Unmonitor | End Time: 00:01:49, Reason: Self Terminated |
| Monitor Duration | 00:01:13 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x7a4 |
| Parent PID | 0x45c (c:\windows\explorer.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
7AC
0x
4E8
0x
7E4
0x
780
0x
5A4
0x
320
0x
8D0
0x
9AC
|
Memory Dumps
| Name | Start VA | End VA | Dump Reason | PE Rebuilds | Bitness | Entry Points | AV | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| mdsqvy.exe | 0x00400000 | 0x00406FFF | Relevant Image | - | 32-bit | - |
|
|
|
Dropped Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | 1.53 KB |
MD5:
37806358124de52b3b02a66f8676c0c6
SHA1: c9886cdbb21cd88fd6eddd1b36d5c5495875f519 SHA256: 9529c75d1261c6748f2d9fcc88b9cef08f3f1d5353dc16a21d400f30c03cc128 SSDeep: 24:6IvxacXaDyA3y3DilNsvncs363py2lScFyy2JTPQE2cFrVRBq54G/7/XZF+Jk:TyDF3yivuc4mpyThyUfrZx4dFMk |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | 1.42 KB |
MD5:
c42a2e34822b56c6e95bebdfcd83fe24
SHA1: 1a9f19f3dab4e5fcc7550846f85d15f34e4b0477 SHA256: ec4913bb592a9028011cef10bd05d47f9e6edb2b05cdf808c5be842d88a88cdd SSDeep: 24:6IvAjCvmIBC1tdAAw/yEDrlN1dmH6BAOIy2qYFyz+V1k3Z8kkOymUHkvBSgltbvR:IC+IBgKLjrvDzAOIyEF0RyuhJ+V5C |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.NHCR | 2.41 MB |
MD5:
7836fff3f74b233070356037d33631cd
SHA1: a13ca1ad0714fda0641cecca07a65c6075c3e6fd SHA256: 21eefe02115433b255c95aa5a4437a737bdeb603f676273c1df68831cef7d8e6 SSDeep: 49152:7K9DxL8QBoI9eljidTex4S120ytJyhaM6CLC:u9R89EQ1o |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | 1.76 KB |
MD5:
e8d033a09afa8b6320e3c93c687296e3
SHA1: f37154c8b5023785c791f5979f83c78d12526588 SHA256: c1e4c4ce369c8ddf75990665b88fb2194c2ea746a09d48e5012a559f7726e587 SSDeep: 24:6IvWFjv+LgnpMAWabg7rg9cAOvm0GukCgsXUsRjmF9lxiMmeln9lxUoacBQAO4GJ:gjv+LgprWBAVVukChAEoQAT20tBjUyQ |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | 1.42 KB |
MD5:
72881927b442f923e595ed305cfc05ef
SHA1: 1ee65ddd03109defa225d413f5684e8481cb0f02 SHA256: 8a8d85b86429622388832d573de10538635d2c59829ee31eccb9b53fab0edbe1 SSDeep: 24:6IvAjS6IWY5KWAqr6DdhkAvPfiYeu9QpFBdMy29uL5AbrbRBZO4G/7iXZqLSdzq:WO6IjcfDdhkAXx9QBCyCUqrvZT4oHdzq |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.NHCR | 20.09 MB |
MD5:
addf9d7e718c2f65d01054e528df0fe0
SHA1: d4779accdd400bf8efc370c0db1dadc6bba70a70 SHA256: 7b01a7950fc3b9cc2816355f88e36714d67439e04d723afc5754ddb7b5fe232f SSDeep: 196608:YcFNUxdiOm1j3/abCsYwFOSQo2eWDOQs4hW6s63HS:gPmN3/abtYIQo2OQ93RS |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.NHCR | 853.50 KB |
MD5:
5d97e099aa92a0548528e2e37a14688e
SHA1: f0ee4e407c18f6633b6d0f96a8538a3701dacaee SHA256: 71e2664fbc1884ce1a903da36c4e735248ce252f12321f36038552ce659f4f97 SSDeep: 24576:fYg4gEgx3P6WBWkmf3egDqo8o93PU6py1p:fYCzgLf7qo26py1 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml | 1.35 KB |
MD5:
a899f80a3dbfb49b460b00d75d9ff550
SHA1: 6c6fad2e0587d3236d67d376484581d8a7e25efb SHA256: da9d111e3db3c736ba19797728d571fcb789fed280a9ebaf4d06bedcce7617a6 SSDeep: 24:6IvxQaQC0YA44WvVg7z0FaNYvbIeiE47jHL+/ROH1S/fcFrYSgoXwP:TR0HWCeQYbNIv+/ROVU+RoP |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml | 1.20 KB |
MD5:
1840e86417195e4909efd37d3cecdcb6
SHA1: a5787113cf75371ab323650bc1e7bd7acef6cd12 SHA256: aa13200dd93c16ab922af11334306e7dbdc66a8620581dda6f6063b752a6afd8 SSDeep: 24:6IvPe1rxAdWNWg7ZpAhKYkC/eNcHYkOymUds5YSgoXwP:1wqg5pA9kCqYuoP |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.NHCR | 9.28 KB |
MD5:
2e74c7ee17acbcd58ab657e40de8b5d6
SHA1: 08b3a9738f0b1a2784ab3f7e30b70ea577871594 SHA256: 857e1bed58029b6dc6bb6b3c55f7f7eeff5fe08025cdf19095fda48bbdff4784 SSDeep: 192:R/bi2gngyfq+NPBbBUMjzozn6uCnGDuvv0uUoghgtJ31GBV8z9R:R/bOTZBbBxjkzBCnGkUoEy1GBV2 |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | 1.57 KB |
MD5:
752e6be1be2463e4feb4a5659777dee7
SHA1: 779db2666f9b49dd7c888583fbf842402e53b2fa SHA256: 044e115b95e7dd465eee12e0e0592521b0bec7d599a2ac876906af73d1f058f2 SSDeep: 48:pfG6zSTR6zzzyU4mpybQP3TGy/FUrOtwpVV50:pflzSTRAbekrRO/g |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | 1.42 KB |
MD5:
8a94f0b60076af090132564c6eb3ed6f
SHA1: 61c71c614bf16e1ea9d5d4973c1cf4ee4956d50c SHA256: fc7ce14661a2dba55717fabb373cabf10b64db39090ef7dbbddad9fd7bcc7c06 SSDeep: 24:6IvFTh8JbgA1JGMyDIPI2FsMhsSsphIrmf78y2NPAeYB9Qvpzf3ky2NGm/4P:Sh/1J3yDIPI4RRs+478yF/QBjUydF |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | 819 bytes |
MD5:
c0a8432f7ab6f4fb775dad6df59ad612
SHA1: 165198984f17e769a42424a103dae8426987ab79 SHA256: d8a25afd703ab4730daaf0cbe9ea7904041de3b76740971ad0e6dde66cc8f99b SSDeep: 24:6Iv0szb3PdsxA4GyUBDElN1dmH6/eFrYSXDxSX:WszDeuBjNEvDBQRXUX |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST.NHCR | 3.50 KB |
MD5:
9909ea53dba324b89e201b688919ece5
SHA1: e53349020aac2a6de35024cb8e8b1893e28e6e7a SHA256: 28177c666922c63e7b67fcf933aaa8a596499d5437931d0002263b1475ff3075 SSDeep: 24:MoUAwheCHiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii4g:D+wJWOLr2OUHWr9K5KvvBC7QhCtUL |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.NHCR | 16.46 KB |
MD5:
1d26d305072747afc97bee84182a07af
SHA1: c36499c04a1482028196525e5edaccc5215a7238 SHA256: f78187ec11000fae162e8108a69ae72d0d44f1901c8f37fc634a2c68452889ec SSDeep: 384:Eaac80WEnHA0lnx3np1rXUjOfrt7niwPZ5Zz5kX4i:E0HAImOT5Q |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.NHCR | 4.17 KB |
MD5:
5e4170a3a1dba32af74e4793094ffd0f
SHA1: 6fb2cdb0e6bd5c88309570523e3d967a692ed4a7 SHA256: fe390ae4b4702477de7852a811e47c7dcdd2e77b299fbb7ba50cd0c7515d281c SSDeep: 96:r92sTJi6YCy2+2/9QYmZNi0CIPIQQjSYtof6q+I19+W:AQivv2+2/juQ0CMijSYtof6q+I4W |
|
|
| \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe.NHCR | 1.31 MB |
MD5:
123b973f0627398f39d2de0dccf524c1
SHA1: ef4b0ca19326e7e421582ca52d344eb815221f7e SHA256: db3930685aca3f6a42f4961ee005b0493d68edb50ed3537415103170d4589372 SSDeep: 24576:50YWf5eMkHHfKnE+RUi/LHgZJJkbipjZSMP:50YF+RUi/LHkJkOZ3 |
|
|
| \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.NHCR | 16.29 KB |
MD5:
63fc122b0793e39221800edefb11d054
SHA1: 36eefdfe8706e4bb9f8bf8fa405f3c50cffdcb77 SHA256: f74f0e6737feece2631fd68cf4b3032983466e8199c464e55ed0e792f905a06a SSDeep: 192:b9oymG9i0VzmdtJTqjTDBBc93dqak1hip3mg8g9GVWz8CuDMk7hbTBNM0OorzsE+:poBsaC4pMNPBNMxSW0DSVP0y9bgkfOG |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi.NHCR | 1.90 MB |
MD5:
f7bf23488c694b1ceb7a87770712cc49
SHA1: 59bebd54ac92047e84465f9b1000041e0c22b12d SHA256: 753ee226dad40b571afd99a9984174c872c874df2b8fbdad3f79ca7617623929 SSDeep: 24576:4kTxhF6WBckmh7EgVEG8o93s0ZWdrU+MAR+acIty0BqEI2S+o0k4Xqb9:ZHWLhHEGr0BqEI2S |
|
|
| C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\encrypted_key.bin | 684 bytes |
MD5:
4a11b2284091fcbef7dcd16bdb88a47e
SHA1: 092ef932b0c748b4b82d9393129e829c2a35c0a7 SHA256: d4eb12d36b0e3b9b644f18a509c551131aa43e9f899c6d95366e28112354f037 SSDeep: 12:lLns4fiAjk20iKka2UDdumdIlm1gE/1huQ792L+7a3bF6OOwgqXO0HeN4jIlMvM:ZjqxOfURtdIMNRm6OZHeN4jxM |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.NHCR | 2.39 MB |
MD5:
4dbf54e38d68669d6fdacf542fe04406
SHA1: 6c33940e7c81217dc23fafeb2ccbf5f99e8904a1 SHA256: b63dbdc34f5aa1fcf9658e9a7b84464f3ddefe731abbf4cc91fdea90f5a5fc93 SSDeep: 49152:xK9DxL8QBoI9eljidTex4S120ytJyham6Co6:c9R89EQ1o |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | 1.42 KB |
MD5:
53dd1847fa9d13850c9395092346d5f9
SHA1: d24b4802b975da3905d1ad6c19c3b1e89997eccb SHA256: 77b13deafd4cf4d1fe3e0a56223f7c4150e8d923439e798c02d1844c208e6a3d SSDeep: 24:6Iv7lqkOSrprImACdM6EhkAsAwUdyIw/kAXcA5k+09u3/XZGQyy2bAw0gltbvR+i:Kl8prIJCxEhkAsAuhXcA5kpUOyCAw0uD |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | 1.84 KB |
MD5:
0941cb9d161a4771cc8d046a1832e7f6
SHA1: 6fe646d80fc2e0a1f0b8763c37e387fc46d78af1 SHA256: 745796c541770a9a566d0bb75b7c10e9df5fecbeaeb977fcf77f7a6f78cd70ba SSDeep: 48:0xxMwcP/lkKldSOcQNESEgB0aWPpsEP1U4dE0K4:0Xeu+fcQOH7dPV9tEG |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | 1.57 KB |
MD5:
1ccaee907c3f2806173c620011b21899
SHA1: 2236dfdecaf2e4ca5775e0a83ec4101bf6cc6048 SHA256: 9c95938cec8b4c263c38517393cae33b22c73757a94b2d965ef33c420ce774f2 SSDeep: 48:YRgRTvpq2MVGFrpq2MsiUBw5J72l/4zjTap4hbNw1hR:YQvU2M4VU2MtUBw5J7YYTapphR |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.NHCR | 14.13 MB |
MD5:
81af8425eb02984fa0593be1b27a480d
SHA1: 83e6dd62566b86a2ad3cef887535286ba561d3be SHA256: 9cb577c7776c550cd1ab625f4582142328e122d0a9c80054f7a2141972049df3 SSDeep: 196608:rIwm3nNVAl+ig71eZ8FclBElWHp8byLbyo9crpLlR8ioLO0ZF9CrpbQ:GL71eiFgepGHyo2rpLkcoCrpbQ |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.NHCR | 3.11 KB |
MD5:
d56866c92b74dbdd7e2b856904973615
SHA1: 55d917072b38e077962a2311fdcaa3fe13ac6550 SHA256: bc54c9d9ece7687a0a7d961929a1154b39c3eff171b891d4942d00d82ca22100 SSDeep: 48:8mkg7XzHy6/yolGy8H9IqHSEsjA4YXpz3wa0/UrXLT3Zy3yykC:hkg7j5aM8jkSzUEXLT3q9F |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.NHCR | 10.95 MB |
MD5:
15aae47c663acec6da178877f8a59efd
SHA1: 9db561aee5fb579d989d5fc9067a62e52cc11469 SHA256: 16faa59f5b5ef6c19017f7c530ae43b894466773921c054b3825e4e446941c4e SSDeep: 196608:hffxkf1gRyjQR9g8YYIcjfX+vntQdQGzFZaGkGdN7p06H1JX/WanfW/OIV0h:hHxU1WbR9YY5mvJGBZWGRz1kaza0h |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | 1.32 KB |
MD5:
67eb1e618a4c58e4bf549f1370c2d349
SHA1: 86f25d3295e74f73c2bd05d187d020d94fd42520 SHA256: a83e6a8a512c399bcd3b130369513553ae0c70e657540179e951150df3c096fd SSDeep: 24:6Iv38ww6rWAtr6ShkTxFVs363py2KjeDt2b9CrbPBQAO4GfCyRG/7iXZqLSX:6Z6V4ShkFFV4mpyH0r1QATI4oHX |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.NHCR | 860.50 KB |
MD5:
a28aa372da71487e6cf8fbdf13ee7edd
SHA1: f45a120179ecaded17c0621b62dee54633b04b36 SHA256: 169b17be24552eb2a3a868da4675ffbd1d301a026fdec5b0d98530515dfc1b29 SSDeep: 24576:9RcQPmbxnP6WBzkm83xgDBo8o93OOr8Bky:rIDxL8QBohr8Bk |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | 1.42 KB |
MD5:
7b33b6877d6ddb40fee374c5b79123a5
SHA1: 8e0979aa489d5eeb62473cf3865c338e0efabf16 SHA256: a60fe80ba96471cab8161282253d697138c5bf288293f97423c35aab3694c4c8 SSDeep: 24:6Iv3i2ZWY+Aar6udhkCtEO4GvvP2f/glkMkbpFSTTy2+4WRdmCbxgFXZzEMX1C:LvPudhkCtETSEuT0S/ykWRdPUzEMC |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | 811 bytes |
MD5:
40602f9ccb139ba45afe9b439e66ead6
SHA1: 9fa288b70b72854f469b39acb094d3b2259a4bc1 SHA256: 92f8d4e09039cec808630fc7dcb32d61426aed7f3e5015369b3ae68c076581a9 SSDeep: 24:6Iv1ROX8YoA30DFDalN1dmH6/eFrYSXDxSX:/YX8YX3mhavDBQRXUX |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.NHCR | 18.00 MB |
MD5:
b4b8f9ea1e3b27253446bf294b543443
SHA1: 9f8f4ed601da71fb0a0a7eb3e3da4c3b0a5427f0 SHA256: 2bef8ce6ff641a266ddd9c3ce77e04cbfdf0151280049561dbb95ad859afe921 SSDeep: 196608:0aDH9F7/iHXDI2CPKBUq6qMuGm9vqrRxoi93nnedBwzSlmKwDhANZbPhn:NDdFDX2J5uuGyCEi9uIQmlANRh |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml | 1.81 KB |
MD5:
a79c70e7b28c1c1f113e7682987c5231
SHA1: 18b280e1dbdfc14e5e42c2cc52f5e312d2f1fc0e SHA256: 44c6b6489cd571a200692b2fa6629e7edeb80b4a69ca165b113a0fa3e01be557 SSDeep: 48:nOYqgAYSghiUTMYpRSMfmEU4jnTVXKGhV6BtlGdyQ5K:OYqgAY1cUTHpRjuEUkTs2qtwdyQ5K |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | 1.94 KB |
MD5:
9fef390f0bb0a649bc560f2123d16bf6
SHA1: 095565a1e9b58b9cdfeb456ee85cf733cf002ee9 SHA256: f07defd74a6270873f34d10efaf90a20320288da1975c136c2566f153499140e SSDeep: 48:KYoqasTkO2Mu6fy2DbwSHX8XYlnm8cNQ/DJLxIP3zmGdyQ5K:noqas22DbwUX8olTKQ//I79dyQ5K |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | 1.83 KB |
MD5:
f13fecda5df322520849b34a1c84f127
SHA1: 5f837bce0b9759c2e0c668a3f89b08f9b079c3e4 SHA256: 5647f262c58e13b6e208e3189e9ac1e7bc9a840cb017319aaed8a970ef7f526d SSDeep: 48:+bCx2Mu6fHB9yRSkQPkB0voDgnPf5Nw1hR:MOB9yRFSwsn+hR |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | 913 bytes |
MD5:
8e3d51837caeaabf52b3210627900f39
SHA1: d6cb2cd7b446d590fe333602af74480fbfa61c7d SHA256: 26301a9e2c0d48baa565d6da252232de44134a740664dd3df2419993e9921537 SSDeep: 24:6Ivlwx3ADA156UhkAvR+V+Uvy2OH2rmff:MQUaUhkAJ+VLyFo4f |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | 1.42 KB |
MD5:
6d6b0dffcc3f7486c15f45da3eb53541
SHA1: f5b88a355196499f2fac5c34e2914bd50c85acef SHA256: 126b7d47f08fa26008ac38a7ffed3d83982c804a6d5702a48b35d8c68b29b733 SSDeep: 24:6Iv/DxVu0vL3tJF/lD8f/Mq1ffYlD7IW45/66tzUSplnPlgWnsQ/kyN0FGdyx+xw:3jvLV/lkKloph666SplndBhiGdyQ5K |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest | 1.81 KB |
MD5:
0ce46a9229f7adca02372817c08c5947
SHA1: 16690300b3981afcda479da3e0f567e7fe63c574 SHA256: 453d77a654201feb6a6e53c1783417f728e29d8090ae5cf6a8e5bf49ebe47e2c SSDeep: 48:KzSa3K3nRM5Zl2TUjQMVGngmLM1u9GS4n:KzSiynIZl2ojQoGnlKuAN |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll.NHCR | 640.50 KB |
MD5:
0c21b97ac21843329053cbd0073f3683
SHA1: 1ac7f3720d52e8e50978eade9d3485a6ac452eb9 SHA256: 9bc64c1aea2ee8a730e257cb7ee15b7dc6cfab277475531618d9bdebf62bea64 SSDeep: 12288:/fwlQ+kEwOqdZkDlqfeHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axPFmRyy6aE:nwlQ+kxZ5e2g5gmO791I0E5uO9FAN9mW |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.NHCR | 5.43 KB |
MD5:
32e7e650f5a08a544a30fb900041e756
SHA1: 4558a91f16d1ca5b10b8962bd1e828dd491f6f69 SHA256: f47e0a0332d313578d4bf492dfcbfa3c9b6f6d9a342a61e4d2b69527730fec21 SSDeep: 48:PIFcIug8hkKqByhIryqscrNYAFKVA4Qy2VmyQy3yLeVArZ0A+okAO4QyAo+7WxTB:gFzJq7hn+fK/2b/CSCXR/Ao+Jr7SYtG |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.NHCR | 9.13 KB |
MD5:
64389e61afcab0fb46c84b8aad988109
SHA1: 9a864c6c2a8eebae79755963ecaa574f3d6ce9ea SHA256: dc55bd5dfe05c31767645a990510ef1845bad402ab9a122f8053ac4e7d1da4c5 SSDeep: 192:ktaoMZs+BVAZwto0Y4CjJ2MqwZcp8E6Nup9hxneOQdhKUUTLEhR:koxBuTGAQ9PnfQdNcLET |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml | 1.32 KB |
MD5:
06e9977f8d5306ee1a84da225dcead05
SHA1: c5dd8d9175eec752f4bb01f447df6aeb59d5be64 SHA256: 204e6dfea004a739c768da9bcf7a55f13c4b0c310e891f48371218c79c7aeb35 SSDeep: 24:6IvkIRpzbTjtA/MAE1oa6vhkgI1bxA4DIPI2oTZklWuki+fXDxSglef35k:LNTi/rEy9vhkxA4DIPI5XUuQpk |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | 819 bytes |
MD5:
d653f795663be54aacc96d4b90e2196f
SHA1: d4a5201d4465c15abb9d204323d55b6dd343325f SHA256: d2923a2b11e4b27fdf55750f6bda628a0cd9e2c40e3602f82970aff6b757695a SSDeep: 24:6IvN5bGgx0AXyXsD+lN1dmH6/eFrYSXDxSX:P53jXmE+vDBQRXUX |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab.NHCR | 212.62 MB |
MD5:
8f20e87c336e51854294e2738fc59c3c
SHA1: 6f62804f2e8ba2a36cebf9ff46cfbc5e510b93a5 SHA256: 1a782a812cfc569cce4fa28b27fe633f97532469d53a62524d4ae7ebd3e8eb59 SSDeep: 196608:VP3/TFnjAduH665BYmIx2hgRz86QBtbFCGNlxXcbKHG6yNmE:V3TH6QBYNx2h4hQYGNlVOqGfJ |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.NHCR | 30.37 KB |
MD5:
8947e3403ef1fde38bc71ff6e0d80c74
SHA1: e8af052eb2550aac0d7277c0ae4ace7300268546 SHA256: 0f8b8de1b009d442a58b040e122cc796d4b9897d8cbd2f803d6c105f3675bc74 SSDeep: 384:ssRMEHlhV8zHiy99beHGiaybe2mcgUXpvv3mfpKUtG6rS5xNNMsKwSxtcG:ss1lhVUCelo4ybKcR9eKkGmOG |
|
|
| \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.NHCR | 6.27 KB |
MD5:
29ef4499abfa278cdabcc0bd050f50ba
SHA1: f3e410e5706fdd4969f97fa599f94df8ca398e9f SHA256: d8840a8ca910262698b5c41ef8aa255ac32baaa5d00757a5786083a9a6775cec SSDeep: 192:kiMbH2zUNOBFpgHeHZjrMtyrJ6YJJke+FhUjJ+BzlOmnt5:kbUE8g+5Xsy6Y/kFFhUm4mnv |
|
|
| \\?\C:\# DECRYPT MY FILES #.txt | 1.38 KB |
MD5:
f25c04975af79c8baf77b44af7e534a7
SHA1: 18bc638de65f212095cebcf629dc90ccf1381cb0 SHA256: 2ba7fa23a2d63918616893d01c0937fe1aff11adaf1d2a6cd26de3e7c87f0b64 SSDeep: 24:zgTZgizuV3jqxOfURtdIMNRm6OZHeN4jxLenR34eksVHFymW+KEHav:zg8mof8gMN4J+wxLcRp9Y4KTv |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.NHCR | 34.55 MB |
MD5:
46fc5c2efdc4bbb68a99ba74231c6a80
SHA1: 1fbf5002cb04c42af8777e65fb01e3afc9d235e1 SHA256: 6b1f5386de31e00c42423f2ee8242c1e9159ef68f66b5f45379dec0d9245ba1b SSDeep: 196608:J8veXcJFdz5BF4YeDuFPDNErW0uwIUIvilceWyiKjnh+KvxKA:WveMJFdnpEu7mWrwIUIKV9vxKA |
|
|
| \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab.NHCR | 185.98 MB |
MD5:
cbb7678b36b78f8997db01e1813c9cd7
SHA1: 2ae7cdac0f740543e6a7496ecf6d91dabc1968e0 SHA256: 4d65855f545f9a88210cff3a28304558c46dcf300999e4ec9609c35e91667c47 SSDeep: 196608:dsILwohZMFfAzx8Am1TUXqVu0NhwZOUjmAZF7bPHmUJ71u:WwhZMpff1Qo+5jRZlzHfu |
|
|
Modified Files
| Filename | File Size | Hash Values | YARA Match | Actions |
|---|---|---|---|---|
| \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | 1.53 KB |
MD5:
37806358124de52b3b02a66f8676c0c6
SHA1: c9886cdbb21cd88fd6eddd1b36d5c5495875f519 SHA256: 9529c75d1261c6748f2d9fcc88b9cef08f3f1d5353dc16a21d400f30c03cc128 SSDeep: 24:6IvxacXaDyA3y3DilNsvncs363py2lScFyy2JTPQE2cFrVRBq54G/7/XZF+Jk:TyDF3yivuc4mpyThyUfrZx4dFMk |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | 1.42 KB |
MD5:
c42a2e34822b56c6e95bebdfcd83fe24
SHA1: 1a9f19f3dab4e5fcc7550846f85d15f34e4b0477 SHA256: ec4913bb592a9028011cef10bd05d47f9e6edb2b05cdf808c5be842d88a88cdd SSDeep: 24:6IvAjCvmIBC1tdAAw/yEDrlN1dmH6BAOIy2qYFyz+V1k3Z8kkOymUHkvBSgltbvR:IC+IBgKLjrvDzAOIyEF0RyuhJ+V5C |
|
|
| \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | 1.76 KB |
MD5:
e8d033a09afa8b6320e3c93c687296e3
SHA1: f37154c8b5023785c791f5979f83c78d12526588 SHA256: c1e4c4ce369c8ddf75990665b88fb2194c2ea746a09d48e5012a559f7726e587 SSDeep: 24:6IvWFjv+LgnpMAWabg7rg9cAOvm0GukCgsXUsRjmF9lxiMmeln9lxUoacBQAO4GJ:gjv+LgprWBAVVukChAEoQAT20tBjUyQ |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | 1.42 KB |
MD5:
72881927b442f923e595ed305cfc05ef
SHA1: 1ee65ddd03109defa225d413f5684e8481cb0f02 SHA256: 8a8d85b86429622388832d573de10538635d2c59829ee31eccb9b53fab0edbe1 SSDeep: 24:6IvAjS6IWY5KWAqr6DdhkAvPfiYeu9QpFBdMy29uL5AbrbRBZO4G/7iXZqLSdzq:WO6IjcfDdhkAXx9QBCyCUqrvZT4oHdzq |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml | 1.35 KB |
MD5:
a899f80a3dbfb49b460b00d75d9ff550
SHA1: 6c6fad2e0587d3236d67d376484581d8a7e25efb SHA256: da9d111e3db3c736ba19797728d571fcb789fed280a9ebaf4d06bedcce7617a6 SSDeep: 24:6IvxQaQC0YA44WvVg7z0FaNYvbIeiE47jHL+/ROH1S/fcFrYSgoXwP:TR0HWCeQYbNIv+/ROVU+RoP |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml | 1.20 KB |
MD5:
1840e86417195e4909efd37d3cecdcb6
SHA1: a5787113cf75371ab323650bc1e7bd7acef6cd12 SHA256: aa13200dd93c16ab922af11334306e7dbdc66a8620581dda6f6063b752a6afd8 SSDeep: 24:6IvPe1rxAdWNWg7ZpAhKYkC/eNcHYkOymUds5YSgoXwP:1wqg5pA9kCqYuoP |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | 1.57 KB |
MD5:
752e6be1be2463e4feb4a5659777dee7
SHA1: 779db2666f9b49dd7c888583fbf842402e53b2fa SHA256: 044e115b95e7dd465eee12e0e0592521b0bec7d599a2ac876906af73d1f058f2 SSDeep: 48:pfG6zSTR6zzzyU4mpybQP3TGy/FUrOtwpVV50:pflzSTRAbekrRO/g |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | 1.42 KB |
MD5:
8a94f0b60076af090132564c6eb3ed6f
SHA1: 61c71c614bf16e1ea9d5d4973c1cf4ee4956d50c SHA256: fc7ce14661a2dba55717fabb373cabf10b64db39090ef7dbbddad9fd7bcc7c06 SSDeep: 24:6IvFTh8JbgA1JGMyDIPI2FsMhsSsphIrmf78y2NPAeYB9Qvpzf3ky2NGm/4P:Sh/1J3yDIPI4RRs+478yF/QBjUydF |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | 819 bytes |
MD5:
c0a8432f7ab6f4fb775dad6df59ad612
SHA1: 165198984f17e769a42424a103dae8426987ab79 SHA256: d8a25afd703ab4730daaf0cbe9ea7904041de3b76740971ad0e6dde66cc8f99b SSDeep: 24:6Iv0szb3PdsxA4GyUBDElN1dmH6/eFrYSXDxSX:WszDeuBjNEvDBQRXUX |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | 1.42 KB |
MD5:
53dd1847fa9d13850c9395092346d5f9
SHA1: d24b4802b975da3905d1ad6c19c3b1e89997eccb SHA256: 77b13deafd4cf4d1fe3e0a56223f7c4150e8d923439e798c02d1844c208e6a3d SSDeep: 24:6Iv7lqkOSrprImACdM6EhkAsAwUdyIw/kAXcA5k+09u3/XZGQyy2bAw0gltbvR+i:Kl8prIJCxEhkAsAuhXcA5kpUOyCAw0uD |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | 1.84 KB |
MD5:
0941cb9d161a4771cc8d046a1832e7f6
SHA1: 6fe646d80fc2e0a1f0b8763c37e387fc46d78af1 SHA256: 745796c541770a9a566d0bb75b7c10e9df5fecbeaeb977fcf77f7a6f78cd70ba SSDeep: 48:0xxMwcP/lkKldSOcQNESEgB0aWPpsEP1U4dE0K4:0Xeu+fcQOH7dPV9tEG |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | 1.57 KB |
MD5:
1ccaee907c3f2806173c620011b21899
SHA1: 2236dfdecaf2e4ca5775e0a83ec4101bf6cc6048 SHA256: 9c95938cec8b4c263c38517393cae33b22c73757a94b2d965ef33c420ce774f2 SSDeep: 48:YRgRTvpq2MVGFrpq2MsiUBw5J72l/4zjTap4hbNw1hR:YQvU2M4VU2MtUBw5J7YYTapphR |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | 1.32 KB |
MD5:
67eb1e618a4c58e4bf549f1370c2d349
SHA1: 86f25d3295e74f73c2bd05d187d020d94fd42520 SHA256: a83e6a8a512c399bcd3b130369513553ae0c70e657540179e951150df3c096fd SSDeep: 24:6Iv38ww6rWAtr6ShkTxFVs363py2KjeDt2b9CrbPBQAO4GfCyRG/7iXZqLSX:6Z6V4ShkFFV4mpyH0r1QATI4oHX |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | 1.42 KB |
MD5:
7b33b6877d6ddb40fee374c5b79123a5
SHA1: 8e0979aa489d5eeb62473cf3865c338e0efabf16 SHA256: a60fe80ba96471cab8161282253d697138c5bf288293f97423c35aab3694c4c8 SSDeep: 24:6Iv3i2ZWY+Aar6udhkCtEO4GvvP2f/glkMkbpFSTTy2+4WRdmCbxgFXZzEMX1C:LvPudhkCtETSEuT0S/ykWRdPUzEMC |
|
|
| \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | 811 bytes |
MD5:
40602f9ccb139ba45afe9b439e66ead6
SHA1: 9fa288b70b72854f469b39acb094d3b2259a4bc1 SHA256: 92f8d4e09039cec808630fc7dcb32d61426aed7f3e5015369b3ae68c076581a9 SSDeep: 24:6Iv1ROX8YoA30DFDalN1dmH6/eFrYSXDxSX:/YX8YX3mhavDBQRXUX |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml | 1.81 KB |
MD5:
a79c70e7b28c1c1f113e7682987c5231
SHA1: 18b280e1dbdfc14e5e42c2cc52f5e312d2f1fc0e SHA256: 44c6b6489cd571a200692b2fa6629e7edeb80b4a69ca165b113a0fa3e01be557 SSDeep: 48:nOYqgAYSghiUTMYpRSMfmEU4jnTVXKGhV6BtlGdyQ5K:OYqgAY1cUTHpRjuEUkTs2qtwdyQ5K |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | 1.94 KB |
MD5:
9fef390f0bb0a649bc560f2123d16bf6
SHA1: 095565a1e9b58b9cdfeb456ee85cf733cf002ee9 SHA256: f07defd74a6270873f34d10efaf90a20320288da1975c136c2566f153499140e SSDeep: 48:KYoqasTkO2Mu6fy2DbwSHX8XYlnm8cNQ/DJLxIP3zmGdyQ5K:noqas22DbwUX8olTKQ//I79dyQ5K |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | 1.83 KB |
MD5:
f13fecda5df322520849b34a1c84f127
SHA1: 5f837bce0b9759c2e0c668a3f89b08f9b079c3e4 SHA256: 5647f262c58e13b6e208e3189e9ac1e7bc9a840cb017319aaed8a970ef7f526d SSDeep: 48:+bCx2Mu6fHB9yRSkQPkB0voDgnPf5Nw1hR:MOB9yRFSwsn+hR |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | 913 bytes |
MD5:
8e3d51837caeaabf52b3210627900f39
SHA1: d6cb2cd7b446d590fe333602af74480fbfa61c7d SHA256: 26301a9e2c0d48baa565d6da252232de44134a740664dd3df2419993e9921537 SSDeep: 24:6Ivlwx3ADA156UhkAvR+V+Uvy2OH2rmff:MQUaUhkAJ+VLyFo4f |
|
|
| \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | 1.42 KB |
MD5:
6d6b0dffcc3f7486c15f45da3eb53541
SHA1: f5b88a355196499f2fac5c34e2914bd50c85acef SHA256: 126b7d47f08fa26008ac38a7ffed3d83982c804a6d5702a48b35d8c68b29b733 SSDeep: 24:6Iv/DxVu0vL3tJF/lD8f/Mq1ffYlD7IW45/66tzUSplnPlgWnsQ/kyN0FGdyx+xw:3jvLV/lkKloph666SplndBhiGdyQ5K |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest | 1.81 KB |
MD5:
0ce46a9229f7adca02372817c08c5947
SHA1: 16690300b3981afcda479da3e0f567e7fe63c574 SHA256: 453d77a654201feb6a6e53c1783417f728e29d8090ae5cf6a8e5bf49ebe47e2c SSDeep: 48:KzSa3K3nRM5Zl2TUjQMVGngmLM1u9GS4n:KzSiynIZl2ojQoGnlKuAN |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml | 1.32 KB |
MD5:
06e9977f8d5306ee1a84da225dcead05
SHA1: c5dd8d9175eec752f4bb01f447df6aeb59d5be64 SHA256: 204e6dfea004a739c768da9bcf7a55f13c4b0c310e891f48371218c79c7aeb35 SSDeep: 24:6IvkIRpzbTjtA/MAE1oa6vhkgI1bxA4DIPI2oTZklWuki+fXDxSglef35k:LNTi/rEy9vhkxA4DIPI5XUuQpk |
|
|
| \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | 819 bytes |
MD5:
d653f795663be54aacc96d4b90e2196f
SHA1: d4a5201d4465c15abb9d204323d55b6dd343325f SHA256: d2923a2b11e4b27fdf55750f6bda628a0cd9e2c40e3602f82970aff6b757695a SSDeep: 24:6IvN5bGgx0AXyXsD+lN1dmH6/eFrYSXDxSX:P53jXmE+vDBQRXUX |
|
|
Host Behavior
File (55233)
| Operation | Filename | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Create | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\encrypted_key.bin | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\$Recycle.Bin | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Boot | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\bootmgr | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\BOOTSECT.BAK | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Config.Msi\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Config.Msi\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\hiberfil.sys | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | desired_access = GENERIC_WRITE, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\.. | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Create | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab | desired_access = GENERIC_WRITE, GENERIC_READ, file_attributes = FILE_ATTRIBUTE_NORMAL, share_mode = FILE_SHARE_READ |
|
1 | |
| Move | \\?\C:\$Recycle.Bin.NHCR | source_filename = \\?\C:\$Recycle.Bin |
|
1 | |
| Move | \\?\C:\Boot.NHCR | source_filename = \\?\C:\Boot |
|
1 | |
| Move | \\?\C:\bootmgr.NHCR | source_filename = \\?\C:\bootmgr |
|
1 | |
| Move | \\?\C:\BOOTSECT.BAK.NHCR | source_filename = \\?\C:\BOOTSECT.BAK |
|
1 | |
| Move | \\?\C:\Config.Msi\..NHCR | source_filename = \\?\C:\Config.Msi\. |
|
1 | |
| Move | \\?\C:\Config.Msi\...NHCR | source_filename = \\?\C:\Config.Msi\.. |
|
1 | |
| Move | \\?\C:\hiberfil.sys.NHCR | source_filename = \\?\C:\hiberfil.sys |
|
1 | |
| Move | \\?\C:\MSOCache\..NHCR | source_filename = \\?\C:\MSOCache\. |
|
1 | |
| Move | \\?\C:\MSOCache\...NHCR | source_filename = \\?\C:\MSOCache\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\..NHCR | source_filename = \\?\C:\MSOCache\All Users\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\...NHCR | source_filename = \\?\C:\MSOCache\All Users\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\..NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\...NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\.. |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml |
|
1 | |
| Move | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab.NHCR | source_filename = \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab |
|
1 | |
| Read | System Paging File | size = 8, size_out = 0 |
|
45 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | size = 8, size_out = 8 |
|
195 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | size = 8, size_out = 5 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | size = 8, size_out = 8 |
|
181 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | size = 8, size_out = 2 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
235 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 6 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | size = 8, size_out = 8 |
|
181 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | size = 8, size_out = 2 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
201 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 0 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | size = 8, size_out = 8 |
|
225 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | size = 8, size_out = 0 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | size = 8, size_out = 8 |
|
168 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | size = 8, size_out = 3 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | size = 8, size_out = 8 |
|
182 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | size = 8, size_out = 1 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | size = 8, size_out = 8 |
|
182 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | size = 8, size_out = 2 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | size = 8, size_out = 8 |
|
101 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | size = 8, size_out = 3 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml | size = 8, size_out = 8 |
|
172 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml | size = 8, size_out = 7 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml | size = 8, size_out = 8 |
|
153 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml | size = 8, size_out = 7 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
231 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 4 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | size = 8, size_out = 8 |
|
200 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | size = 8, size_out = 6 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
248 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 4 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | size = 8, size_out = 8 |
|
181 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | size = 8, size_out = 4 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
234 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 0 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | size = 8, size_out = 8 |
|
114 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | size = 8, size_out = 1 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
181 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 4 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest | size = 8, size_out = 8 |
|
232 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest | size = 8, size_out = 1 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | size = 8, size_out = 8 |
|
102 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | size = 8, size_out = 3 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml | size = 8, size_out = 8 |
|
168 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml | size = 8, size_out = 5 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | size = 8, size_out = 8 |
|
102 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | size = 8, size_out = 3 |
|
1 | |
| Read | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPrWW2.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\setup.exe | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\osetup.dll | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\OWOW32WW.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PidGenX.dll | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjPrrWW.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\setup.exe | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\osetup.dll | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\OWOW32WW.cab | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\setup.exe | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml | size = 8, size_out = 8 |
|
249 | |
| Read | \\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.cab | size = 8, size_out = 8 |
|
249 | |
| Write | C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\encrypted_key.bin | size = 684 |
|
1 | |
| Write | \\?\C:\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | System Paging File | size = 0 |
|
45 | |
| Write | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\Config.Msi\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\Documents and Settings\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | size = 8 |
|
195 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml | size = 5 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | size = 8 |
|
181 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml | size = 2 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8 |
|
235 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml | size = 6 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | size = 8 |
|
181 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml | size = 2 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8 |
|
201 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml | size = 0 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | size = 8 |
|
225 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml | size = 0 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | size = 8 |
|
168 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml | size = 3 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | size = 8 |
|
182 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml | size = 1 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | size = 8 |
|
182 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml | size = 2 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | size = 8 |
|
101 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml | size = 3 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml | size = 8 |
|
172 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml | size = 7 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml | size = 8 |
|
153 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml | size = 7 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8 |
|
231 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml | size = 4 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | size = 8 |
|
200 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml | size = 6 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8 |
|
248 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml | size = 4 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | size = 8 |
|
181 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml | size = 4 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjLR.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8 |
|
234 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml | size = 0 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | size = 8 |
|
114 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml | size = 1 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8 |
|
181 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml | size = 4 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwdcw20.dll | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest | size = 8 |
|
232 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest | size = 1 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\msvcr90.dll | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeLR.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | size = 8 |
|
102 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml | size = 3 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\osetupui.dll | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\ShellUI.MST | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml | size = 8 |
|
168 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml | size = 5 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccLR.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | size = 8 |
|
102 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml | size = 3 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 32 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 3 |
|
5 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 15 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 20 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 45 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 42 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 12 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 23 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 684 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 35 |
|
2 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 62 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 83 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 16 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 98 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 110 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt | size = 44 |
|
1 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms | size = 8 |
|
249 | |
| Write | \\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.msi | size = 8 |
|
249 | |
|
For performance reasons, the remaining 59 entries are omitted.
The remaining entries can be found in glog.xml. |
|||||
Process (1)
| Operation | Process | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Get Info | c:\users\5p5nrgjn0js halpmcxz\desktop\mdsqvy.exe | type = PROCESS_BASIC_INFORMATION |
|
1 |
Module (19)
| Operation | Module | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|---|
| Load | ntdll.dll | base_address = 0x77130000 |
|
6 | |
| Load | Netapi32.dll | base_address = 0x74b10000 |
|
2 | |
| Get Filename | - | process_name = c:\users\5p5nrgjn0js halpmcxz\desktop\mdsqvy.exe, file_name_orig = C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mdsqvy.exe, size = 260 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = RtlCreateProcessParametersEx, address_out = 0x7717bd9b |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtWow64ReadVirtualMemory64, address_out = 0x771520f4 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtWow64QueryInformationProcess64, address_out = 0x771520dc |
|
1 | |
| Get Address | c:\windows\syswow64\netapi32.dll | function = NetApiBufferFree, address_out = 0x74b013d2 |
|
1 | |
| Get Address | c:\windows\syswow64\netapi32.dll | function = NetWkstaGetInfo, address_out = 0x74b15570 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = NtQueryInformationProcess, address_out = 0x7714fac8 |
|
1 | |
| Get Address | c:\windows\syswow64\ntdll.dll | function = RtlInitUnicodeString, address_out = 0x7715e208 |
|
4 |
Keyboard (5)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Info | type = KB_LOCALE_ID |
|
5 |
System (4)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Sleep | duration = -1 (infinite) |
|
1 | |
| Get Info | type = Operating System |
|
1 | |
| Get Info | type = Hardware Information |
|
1 | |
| Get Info | type = Windows Directory, result_out = C:\Windows |
|
1 |
Environment (1)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Environment String | name = APPDATA, result_out = C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming |
|
1 |
Process #2: dllhost.exe
0
0
| Information | Value |
|---|---|
| ID | #2 |
| File Name | c:\windows\syswow64\dllhost.exe |
| Command Line | C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:00:46, Reason: RPC Server |
| Unmonitor | End Time: 00:00:56, Reason: Self Terminated |
| Monitor Duration | 00:00:10 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x5cc |
| Parent PID | 0x254 (c:\windows\system32\svchost.exe) |
| Bitness | 32-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
808
0x
804
0x
62C
0x
178
0x
114
0x
61C
0x
644
0x
80C
0x
810
|
Process #3: vssadmin.exe
0
0
| Information | Value |
|---|---|
| ID | #3 |
| File Name | c:\windows\system32\vssadmin.exe |
| Command Line | "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet |
| Initial Working Directory | C:\Windows\sysnative\ |
| Monitor | Start Time: 00:00:47, Reason: Child Process |
| Unmonitor | End Time: 00:01:21, Reason: Self Terminated |
| Monitor Duration | 00:00:33 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x814 |
| Parent PID | 0x5cc (c:\windows\syswow64\dllhost.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | High (Elevated) |
| Username | XDUWTFONO\5p5NrGJn0jS HALPmcxz |
| Enabled Privileges | SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege |
| Thread IDs |
0x
818
0x
82C
0x
830
0x
834
0x
838
|
Process #4: vssvc.exe
3
0
| Information | Value |
|---|---|
| ID | #4 |
| File Name | c:\windows\system32\vssvc.exe |
| Command Line | C:\Windows\system32\vssvc.exe |
| Initial Working Directory | C:\Windows\system32\ |
| Monitor | Start Time: 00:00:50, Reason: RPC Server |
| Unmonitor | End Time: 00:04:36, Reason: Terminated by Timeout |
| Monitor Duration | 00:03:46 |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x83c |
| Parent PID | 0x1cc (c:\windows\system32\services.exe) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
850
0x
84C
0x
848
0x
844
0x
840
0x
854
0x
858
0x
874
|
Host Behavior
System (3)
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Get Time | type = System Time, time = 2019-05-29 00:51:42 (UTC) |
|
1 | |
| Get Time | type = Ticks, time = 111571 |
|
1 | |
| Get Time | type = Performance Ctr, time = 17045649389 |
|
1 |
Process #7: System
0
0
| Information | Value |
|---|---|
| ID | #7 |
| File Name | System |
| Command Line | - |
| Initial Working Directory | - |
| Monitor | Start Time: 00:02:35, Reason: Kernel Analysis |
| Unmonitor | End Time: 00:04:36, Reason: Terminated by Timeout |
| Monitor Duration | 00:02:00 |
| Remark | No high level activity detected in monitored regions |
OS Process Information
| Information | Value |
|---|---|
| PID | 0x4 |
| Parent PID | 0x0 (Unknown) |
| Bitness | 64-bit |
| Is Created or Modified Executable |
|
| Integrity Level | System (Elevated) |
| Username | NT AUTHORITY\SYSTEM |
| Enabled Privileges | SeLockMemoryPrivilege, SeTcbPrivilege, SeSystemProfilePrivilege, SeProfileSingleProcessPrivilege, SeIncreaseBasePriorityPrivilege, SeCreatePagefilePrivilege, SeCreatePermanentPrivilege, SeDebugPrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege, SeIncreaseWorkingSetPrivilege, SeTimeZonePrivilege, SeCreateSymbolicLinkPrivilege |
| Thread IDs |
0x
8
0x
C0
0x
28
0x
40
0x
90
0x
44
0x
38
0x
9C
0x
30
0x
5C
0x
4C
0x
34
0x
C4
0x
CC
0x
D0
0x
B8
0x
D4
0x
D8
0x
DC
0x
E8
0x
EC
0x
48
0x
64
0x
2C
0x
FC
0x
100
0x
104
0x
108
0x
10C
0x
110
0x
B0
0x
80
0x
128
0x
12C
0x
130
0x
134
0x
170
0x
68
0x
20
0x
24
0x
98
0x
60
0x
74
0x
264
0x
2E0
0x
88
0x
8C
0x
3B0
0x
C8
0x
45C
0x
84
0x
4A4
0x
518
0x
528
0x
78
0x
5A4
0x
94
0x
670
0x
684
0x
690
0x
698
0x
6AC
0x
6B0
0x
F8
0x
50
0x
770
0x
CC
0x
7BC
0x
1C
0x
0
0x
444
0x
5A4
0x
BC
0x
5A0
|
